Splunk Search

Community Activity

Is the usage of multiple eval calculations in one pipe a feature or an unsupported hack? Hi, I did not know that it is possible: \| makeresults \| eval fieldA=123, fieldB=456, fieldC=789 I assume that thi... by HeinzWaescher Motivator in Splunk Search 06-20-2017 0 5	0	5
i want to match the word "Modify" but it should skip the first match. i want the second match "Modify" till the semi colon delimiter Modify:extended value attribut -"to be processed";Action:"will not be processed";Modify:attributs to be processed-"he... by DataOrg Builder in Splunk Search 06-20-2017 0 1	0	1
Spath and Rename Hi, I wonder whether someone may be able to help me please. I'm trying to create a query which extracts given values... by IRHM73 Motivator in Splunk Search 06-20-2017 0 1	0	1
how to replace using SED command ? Hi Splunker, I would like to know and learn how to replace ^ns4: with < Please find below dummy data. ^ns4:Channel... by m7787580 Explorer in Splunk Search 06-20-2017 1 7	1	7
How to Extract exact result from rex command? rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"MY result is------------ 41.4 expected result41.4 by karthi2809 Builder in Splunk Search 06-20-2017 0 3	0	3
Search output in tabular format I am looking for help to extract the values from my log files my log file has a sequence of data as follows 1.){xxx... by 4myexperiment Explorer in Splunk Search 06-19-2017 0 2	0	2
Removing 1st line from the event Hi, I have a event with the column names like Type Category Count CPU in my event 1st line. I don... by prathapkcsc Explorer in Splunk Search 06-19-2017 0 14	0	14
Multiple graphs in line chart Hello All, I have a data as below : Where for every callId there are list of values in next column. So I have some 1... by patilsh Explorer in Splunk Search 06-19-2017 0 5	0	5
How to send an alert when a Job does not finish within expected time? Hi Everyone, I am a newbie to Splunk and need little help with the alerting system. I want to setup a real time aler... by snehasal Explorer in Splunk Search 06-19-2017 0 2	0	2
If I want to remove an IP address and do a wildcard search, are there any search filter priorities? if I want to remove one IP address and then do a wildcard search, would that wildcard host IP search override the rem... by dxw350 Path Finder in Splunk Search 06-19-2017 0 3	0	3
How to add custom time range to my xyseries search? I have this search: index="tticket_contact_request" \|eval date=strftime(_time, "%Y-%m") \|stats count by des... by cvalenti Explorer in Splunk Search 06-19-2017 0 4	0	4
How to create a search based on a conditional dashboard token value? Psuedocode: If dashboard token is empty, run X search. If token is not empty, run Y search. if($field$ is omitted)... by rubyboomslang New Member in Splunk Search 06-19-2017 0 1	0	1
Record value from a lookuptable at indextime I would like to record a user's department at the time of the event rather than search time. I have username => depar... by fooflington New Member in Splunk Search 06-19-2017 0 3	0	3
Comparison of two date fields gives bad result I use the following query in an attempt to view a subset of the file test10UniqueActiveUsers.csv \|inputlookup test1... by niamurph Explorer in Splunk Search 06-19-2017 0 7	0	7
extract field for below mentioned log From the log mentioned below I need to extract the field 'Response Time' and then frame a query for response time < 1... by vikram_m Path Finder in Splunk Search 06-19-2017 0 4	0	4
i want to match the text "followed the escaped error:" and remove the following text till the delimiter dot. it should cut other fields followed the escaped error: "An error has happened executing a dash statement. hello good morning followed the escape... by DataOrg Builder in Splunk Search 06-19-2017 0 3	0	3
How do I reuse multiple eval statements in multiple dashboards without recoding in every one? I have a series of eval statements that I'd like to call from multiple dashboards, but have it coded in only one plac... by pxs0514 Explorer in Splunk Search 06-19-2017 1 3	1	3
Grouping by a substring Hello, I'm having trouble grouping errors in our Splunk logs. The date and time is appended to the error messages, m... by R0ss Engager in Splunk Search 06-19-2017 0 2	0	2
Is there any way to overlay vertical lines for event marking in Splunk timecharts? Tools such as graphite allow for the concept of "infinity" in charts in order to display vertical lines to be overlay... by aramirez_evolut Engager in Splunk Search 06-19-2017 13 6	13	6
Regex to remove optional trailing text from field with transforms/props I have a field called Title, where it may sometimes end with the text Ends 9 P.M. or varying case related variant... by bowesmana SplunkTrust in Splunk Search 06-19-2017 0 8	0	8
how to get the average time for latest event and previous event I am looking for a solution to show for every latest event time and previous event time average duration (and the tim... by remoharish Engager in Splunk Search 06-19-2017 0 1	0	1
i want to remove the date occurrence for all the line The value '20/SEP/13' can removed The hello '28/JUN/14' can be removed The today '23/JUN/14' can be removed by DataOrg Builder in Splunk Search 06-19-2017 0 6	0	6
Adding an second identical column and field to Splunk table In order to coincide with an excel spreadsheet, I was hoping that Splunk table can provide two columns that our ident... by dxw350 Path Finder in Splunk Search 06-18-2017 0 2	0	2
Is there a limit on searchable characters in an event? I am searching on an event with has on an average 25000 - 30000 characters. When I search on the auto extracted field... by t_splunk_d Path Finder in Splunk Search 06-18-2017 0 7	0	7
filter stats on two different "where" clauses Bonus points to the folks who can help me. I'm trying to first filter (stats count) results above a threshold of 100 ... by mbond81 Engager in Splunk Search 06-17-2017 0 8	0	8