Splunk Search

Community Activity

Extract fields from Windows Event Log Message I have events that do not extract the fields from the message field by default. I'm trying to setup props/transforms... by dw385 Explorer in Splunk Search 06-26-2017 0 7	0	7
Problem with Fields Aliases Hi all, I have some problem with fields aliases. I try to explain, I receive a message MQ with a XML message body; i... by mcalta New Member in Splunk Search 06-26-2017 0 3	0	3
i want split all the "modify" tags value under a column and other tags vice versa. Extends Asasociaoted With Deicooration: Linseld - Acation Coade; modify:extends -act5iodn; modify:extends -date;Exten... by DataOrg Builder in Splunk Search 06-25-2017 0 2	0	2
Relative Time based on last event I want to be able to compare 48 hours from my last event date, thought this would work but I keep getting 0 as my res... by JoshuaJohn Contributor in Splunk Search 06-25-2017 0 4	0	4
How to timechart time with SLA I'm trying to replicate the following graph (not based on splunk data) into splunk. On Time Batch - Planned Time i... by clarksinthehill Explorer in Splunk Search 06-25-2017 0 11	0	11
How to generate a search to check memory, cpu, disk usage for each host? Hello, I would like to do a search against forwarders, once I found that forwarder is running, I need to check me... by ananthan123 Explorer in Splunk Search 06-24-2017 1 3	1	3
Add the column of numbers for the same result I have 2 columns. One of them lists IP address of which many are repeating and the other column is of purchases. The ... by mwadhwa New Member in Splunk Search 06-24-2017 0 1	0	1
How to use a Lookup table to search against two sourcetypes with a common field that's named differently I have two sources from Log files: “source1web”, “source2auth”, they both list IP addresses, but are named differentl... by cryptosmasher86 New Member in Splunk Search 06-24-2017 0 3	0	3
How to create the Regular Expression for the xml Hi Team, I have XML in the format present below and i am trying to use field transformation and field extraction in ... by m7787580 Explorer in Splunk Search 06-24-2017 0 8	0	8
filtered sub search Hi I want to search for Text A on a index and find the Source Files and then on these source files search for Text ... by athorat3 New Member in Splunk Search 06-23-2017 0 3	0	3
Different search results in Different systems Hello All, I have a search query which gives the below results: Now the same query when my friend runs in his sys... by patilsh Explorer in Splunk Search 06-23-2017 0 4	0	4
Search Query for Nested Jobs Hi Everyone, I am a newbie to Splunk and trying to create Dashboards for Data Visualization. I have Real Time Data L... by snehasal Explorer in Splunk Search 06-23-2017 0 8	0	8
case function -- why can't I operate on the results of a case function? case function -- why can't I operate on the results of a case function? After the eval case function, I got 100 rows.... by pgiffd New Member in Splunk Search 06-23-2017 0 3	0	3
How to edit my search to find the average events per second for each day from the past week? I am using the following query to calculate the average events per second \| tstats count where index=* groupby index... by splunkrocks2014 Communicator in Splunk Search 06-23-2017 0 2	0	2
Adding lookup files for tuning purposes So I'm new to Splunk (and ES) and have been asked to tune out some noise as we are getting a lot of false positives f... by Robbie1194 Communicator in Splunk Search 06-23-2017 0 3	0	3
How to correlate 3 different CSV files with different column names? I have 3 different source CSV (file1, file2, file3) files. In file 1, I have field(place) with value NJ and In file... by krishnacasso Path Finder in Splunk Search 06-23-2017 0 4	0	4
Join two searches based on a condition Hi, We have two kind of logs for our system: First one logs all the user sessions with user name, src ip, dst ip, and... by rakes568 Explorer in Splunk Search 06-23-2017 0 6	0	6
How to trim off characters before "\" Hello, Could someone please advise of the most efficient way to trim off everything to the left of a "\" character i... by rbardonetorian Path Finder in Splunk Search 06-23-2017 1 5	1	5
Quick way to add fields to a table? If I want to table out a field called "A," I have to manually type "A" in my search. Is there a quicker way to add fi... by swayzy_youssef Engager in Splunk Search 06-23-2017 0 3	0	3
Need splunk query to get alerts/saved searches/dashboards created by each index Can anyone help me to get all saved searches/alerts configured using particular index . by srinivasup Explorer in Splunk Search 06-23-2017 0 3	0	3
How to have 'count as' and also 'count by' for one search The following query should be intuitive enough to see what am trying to do. This query will list Success_file field v... by jcunningham_con Explorer in Splunk Search 06-23-2017 0 8	0	8
Need regex to extract specific data I need a regex to get the output as below - Input /ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017 /ABCD / Safe +A... by ninadbhaskarwar Path Finder in Splunk Search 06-23-2017 0 8	0	8
Join two searches based on a condition We have two kind of logs for our system: First one logs all the user sessions with user name, src ip, dst ip, and log... by rakes568 Explorer in Splunk Search 06-23-2017 0 6	0	6
correlation of events (different sourcetypes) with "from" and "to" Hi there, i have planning events which i need to correlate with "actual" values from sensoring. The planning data ... by swe Path Finder in Splunk Search 06-23-2017 0 5	0	5
How to search for fields that contain numbers Hi, I need to run a search the would select only those events where field Id contains numbers For example: it can be ... by mlevsh Builder in Splunk Search 06-23-2017 0 3	0	3