Splunk Search

Community Activity

How to edit my search to find percentage of duplicate events? Hey Folks, Any suggestions on how to report on the total percent of my events that are duplicates? I can find my du... by RocIngersol Explorer in Splunk Search 05-30-2017 0 1	0	1
How to generate a search to find delta between totals from yesterday and today? I have a log for a documents database. It gives me a daily report of total documents in each collection (each collect... by feickertmd Communicator in Splunk Search 05-30-2017 0 2	0	2
what command will remove status the field from the returned events what command is used to remove the status field from the returned events by scs1960 New Member in Splunk Search 05-30-2017 0 3	0	3
Seeing duplicate events in Search Results ? I have a source as ///application.log in my inputs.conf.On the servers the application.log will be rolled when it fil... by arunsony New Member in Splunk Search 05-30-2017 0 23	0	23
Duplicate rex field extraction results In my log files there is a field (path = info.message) that has a certain string. I want to extract a part of that st... by funghorn Explorer in Splunk Search 05-30-2017 0 5	0	5
Rename values extracted into field Can you rename values extracted into fields? Example - Here is a field i have called "filename" and some examples of... by gnovak Builder in Splunk Search 05-30-2017 1 8	1	8
How many CPU cores required for handling concurrent searches no . of search head -1 (8 cores) no. of indexers - 4 (24-cores each) So, my system-wide concurrent searches limit i... by splunker12er Motivator in Splunk Search 05-30-2017 0 2	0	2
Calculations on fields with multiplier abbriviations Any ideas on how to handle this - I am imaging a horrible if/string statement, but any other ideas? i have a field "... by nickhills Ultra Champion in Splunk Search 05-30-2017 0 7	0	7
how to extract the below words from a log Hi, I have following sample log string , May 13 14:20:32 pcpsd1sb.smart.net 318324: May 13 14:20:31.282 EDT: %CDP-4... by umsundar2015 Path Finder in Splunk Search 05-30-2017 0 2	0	2
How to use wildcard in search command where to compare values? Hello guys I have lots of columns such as test1 ,test1_up ,test1_down ,test2 ,test2_up, test2_down ,tmp1, tmp1_up,... by laudai Path Finder in Splunk Search 05-30-2017 0 6	0	6
display results from map on inputlookup as events I have a search like this: \|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv \| map [search index="... by fvegdom Path Finder in Splunk Search 05-29-2017 0 5	0	5
what does status=200 mean? Hi, please explain, what is the function of 'status'? why we use status? what's its function?what does it do? what d... by Akshay2Patil Engager in Splunk Search 05-29-2017 0 3	0	3
Filter Multiple Event Results Into A Single Value I would like to return the value of a string only once even if it shows up multiple times in splunk. For example: "r... by dunsha New Member in Splunk Search 05-29-2017 0 3	0	3
Combine two record sets where a distinct value matches (without using join) I have a search that generates two distinct types of record entries (searching for "for event"): 2015-05-05 for eve... by chinchin96 New Member in Splunk Search 05-29-2017 0 8	0	8
multi field in different rows Hi at all, I'm ingesting many csv where there are a variable number of columns. some of this columns have name "ser... by gcusello SplunkTrust in Splunk Search 05-29-2017 0 4	0	4
Display data on single bar line in chart I have some records in csv, each record has a column 'payment method'. I have to count by 'payment method' and the re... by rvisj New Member in Splunk Search 05-29-2017 0 5	0	5
How to use evaluate function across multiple multivalue fields Hi, I am trying to create an anomaly detector for unusually high thruputs across all sourcetypes in my Splunk intern... by mngeow Engager in Splunk Search 05-29-2017 0 1	0	1
Convert JSON to table I tried looking up for a solution and went through almost all suggestions. None worked for me. I have the following j... by splunk_skr Explorer in Splunk Search 05-29-2017 0 4	0	4
How to split event into multiple rows in a table? Hello everyone, I'm trying to get an analysis of an process log file. The logfile contains an event for every ended ... by mihenn Path Finder in Splunk Search 05-29-2017 0 3	0	3
Using regex to extract word after semicolons Hi I am attempt to extra host names from logs they always appear after the 4th semicolon : E.g. I want the extra t... by TCK101 New Member in Splunk Search 05-29-2017 0 2	0	2
How to determine if logs are not being used? Is there a way to determine which logs are not being used anymore, and therefore can be deleted? For example, maybe ... by JimSchlaker New Member in Splunk Search 05-27-2017 0 4	0	4
Why does my summary search not produce any results? Hi to all, I have a summary search that doesn't produce results, if I copy and paste the same search in "search & re... by andreac81 Explorer in Splunk Search 05-27-2017 0 4	0	4
How to append search results multiple times based on change in particular field value Hi, I want to something like - append [Query-2] by clause Situation is I have a result set from query-1 and query-... by sunilpanda023 Path Finder in Splunk Search 05-27-2017 0 2	0	2
Is it possible to search Splunk for list of concurrent searches usage over time? Hello, is it possible to search Splunk for list of concurrent searches usage over time by searching internal log? S... by Motoko89 Path Finder in Splunk Search 05-26-2017 0 3	0	3
SPlunk Searches slow Hello, I am facing challenges to search query in SPlunk 6.4.1 environment But Splunk Performance is very slow. We ha... by sahils New Member in Splunk Search 05-26-2017 0 15	0	15