Splunk Search

Community Activity

	How to split my sample events using regular expression Hi, i have a sample data file like this, all columns are tab separated TYPE Category ... by prathapkcsc Explorer in Splunk Search 06-16-2017 0 15	0	15
	Why does my rex search with a regex only match a few of the results even with max_match? i have an odd issue that i cant seem to get beyond it might be as simple as a regex change but I can seem to figure i... by roayers Explorer in Splunk Search 06-16-2017 0 16	0	16
	How to troubleshoot why our lookup that is updated by "outputlookup append=true" missing data added from the last 2 months? We have small lookup updated in search by outputlookup append=true This is a SMALL size Our users noticed the lookup ... by Chamrong Explorer in Splunk Search 06-16-2017 0 6	0	6
	How to remove multiple spaces in a single field containing unique words Hello guys, I'm having a bit of problem removing spaces in between several words in a column. For example, the User_... by timyong80 Explorer in Splunk Search 06-16-2017 0 10	0	10
	Tstats with a different field Hello, I recently setup a summary index. I'm searching with "tstats" in that summary index to get a single integer ... by curry59 New Member in Splunk Search 06-16-2017 0 1	0	1
	In a CSV lookup, is the first column always the input ? In Vlookup for excel, the input is always the first column on the left. In Splunk, is this required? I am having di... by dxw350 Path Finder in Splunk Search 06-16-2017 0 2	0	2
	Count of each field value (I only get total counts) I have: sourcetype=squid_proxy \| stats count, values(url) as url, sum(bytes) as bytes by client_ip Which almost ge... by jkfierro Explorer in Splunk Search 06-16-2017 0 7	0	7
	search results Why would these searches return different results? I'm searching over the same time range with both. index=main sour... by jephillips Explorer in Splunk Search 06-16-2017 0 8	0	8
	Values with Pipe as String Hi, I have events which look like that: a=test1 b=test2 func=test3\|test4\|test5 and a=test1 b=test2 func=test5 if a ... by andimak New Member in Splunk Search 06-16-2017 0 1	0	1
	How to pull one variable with multiple changing values? I have for example something as follows, "Request X\|Y\|Z" where X, Y, and Z all change each time the message is displa... by aohls Contributor in Splunk Search 06-16-2017 0 5	0	5
	Unable to mask PII data on JSON at indexer Hello friends, My data is in json format and i have credit card info which i need to mask at indexer level. I tried b... by mehala12 Explorer in Splunk Search 06-15-2017 0 6	0	6
	Using eval to set token in drilldown does not work I have a row in a table called DMPrice <set token="dmp">$row.DMPrice$</set> this works, however, if there is no DM... by bowesmana SplunkTrust in Splunk Search 06-15-2017 0 2	0	2
	How to use stats command after top command. Hi all I am trying to do the following search. which would result in Top 5 apiname values along with their apitime(a... by rakshithreddy Explorer in Splunk Search 06-15-2017 0 4	0	4
	Event sampling with specific event gaps for multiple hosts I have multiple hosts in my result table and there is no specific sampling interval for each. However it is sure that... by AshimaE Explorer in Splunk Search 06-15-2017 0 3	0	3
	Correlate received Up down Traps in Splunk Looking for ideas on how to correlate between an updown trap event like the one shown below - would be nice to have t... by Esky73 Builder in Splunk Search 06-15-2017 0 1	0	1
	remove URL from search result is not working My Splunk Query index= index1 sourceType=source1 "Error" OR requestURl != "/test/abc" OR requestURI != "/person" ... by jw44250 New Member in Splunk Search 06-15-2017 0 4	0	4
	How to generate a search for specific words in row data? My search result is like this : result 1 . message hello test helo test result 2 . message hello test helo tes... by jw44250 New Member in Splunk Search 06-15-2017 0 13	0	13
	lookup using 2 search results hi, from 1 search i got below results. txn ref no \|amount\|date and another search got the below. acct no\|txn ref... by nvegesn222 New Member in Splunk Search 06-15-2017 0 2	0	2
	How to combine multiple searches into 1 related table/graph? I have two searches something like this: "ns=my_project" message="RESPONSE_CODE=200" OR "RESPONSE_CODE=400" METH... by lordhans Explorer in Splunk Search 06-15-2017 0 2	0	2
	how to tell splunk automatically extract fields with symbols besides "=" Splunk can extract fields when events contain "key=value" strings Could I tell splunk to extract fields automatically... by crazyeva Contributor in Splunk Search 06-15-2017 0 6	0	6
	Is it possible to set up a multidimensional CSV lookup? Hello, I'd like to setup a lookup table to provide additional static information for a set of known parameters. How... by brcrommett Engager in Splunk Search 06-15-2017 0 5	0	5
	Do two joins matching inputlookup data to build table I have a lookup - ips.csv - formated like... ip,name 1.2.3.4,server1 2.3.4.5,server2 My indexed data is source, de... by yacht_rock Explorer in Splunk Search 06-15-2017 0 1	0	1
	How to find the difference between time stamps in 2 different events? Hello! I am have a bunch of logs stating when a job has started and finished. I have been asked to find a way to tel... by MWAKburns Engager in Splunk Search 06-15-2017 0 1	0	1
	How to reduce the DNS logs using regex? Hi I have the DNS debug logs enabled, is there a way to index only failures ignoring the successful one's? I have m... by kiran331 Builder in Splunk Search 06-15-2017 0 2	0	2
	How to generate a search to find the number of days that exceeds mean by certain ranges? Hello all! I'm trying to find the number of days that the daily count of my event exceeds the daily mean + standard ... by jrnastase Explorer in Splunk Search 06-15-2017 0 3	0	3