Splunk Search

Community Activity

How to append search results multiple times based on change in particular field value Hi, I want to something like - append [Query-2] by clause Situation is I have a result set from query-1 and query-... by sunilpanda023 Path Finder in Splunk Search 05-27-2017 0 2	0	2
Is it possible to search Splunk for list of concurrent searches usage over time? Hello, is it possible to search Splunk for list of concurrent searches usage over time by searching internal log? S... by Motoko89 Path Finder in Splunk Search 05-26-2017 0 3	0	3
SPlunk Searches slow Hello, I am facing challenges to search query in SPlunk 6.4.1 environment But Splunk Performance is very slow. We ha... by sahils New Member in Splunk Search 05-26-2017 0 15	0	15
Manage alert threshold and rows returned all within the custom condition in the alert This kind of spiraled as I was helping a coworker with an alert they had all the duration and times hardcoded in the ... by Cuyose Builder in Splunk Search 05-26-2017 0 4	0	4
Search event format in Splunk Suppose I have a log file having 11 lines like below having two line same as in G: A B C G D E F G H I J Now in Splu... by loveforsplunk Explorer in Splunk Search 05-26-2017 0 2	0	2
How to use rex to extract the values? I want to make a table that shows ACTION, DATABASE USER, PRIVILEGE, CLIENT USER and DBID; I want the value between '... by ewise1 New Member in Splunk Search 05-26-2017 0 3	0	3
Replacing part of string when it's equal to a field value Hi! I have fields myfield and name which contains text of an email going like this: Example1: myfield="From: Smith, ... by mszopa Explorer in Splunk Search 05-26-2017 0 9	0	9
Can I add events to a transaction? I have a transaction based on a bunch of events from a common source with a common transaction ID, something like \|"... by MonkeyK Builder in Splunk Search 05-26-2017 0 8	0	8
How to edit my regex to replace a number 0-9? Hi Team, I have requirement, where I need to replace a series of numbers with something like this a/b/c/123456 with ... by smaran06 Path Finder in Splunk Search 05-26-2017 0 9	0	9
question on search query Looking for a single result that includes both values of clicked link then added up in a total column search... \| ev... by roayers Explorer in Splunk Search 05-26-2017 0 5	0	5
Why am I getting error "Unknown search command 'sourcetype'" using a subsearch in a where command? I want to do something like the below command but it is giving me an error. sourcetype=SplunkKafka_messaging \| spath... by maximus_reborn Path Finder in Splunk Search 05-26-2017 0 6	0	6
How to create splunk search for common filed/value across the multiple servers? Hello All, I am trying to build search for common value across multiple host. For example , i have a common field ca... by agarwal_sumit New Member in Splunk Search 05-26-2017 0 2	0	2
How to get timestamp of the beginning event in the stats count by sourcetype=priorityEvents \| rex field=_raw "User\sID\s(?<user_id>.\d{0,8}+)" \| stats count by user_id \| where count ... by ibob0304 Communicator in Splunk Search 05-26-2017 0 1	0	1
How to extract content between two strings? Hi Team, I have an error message coming up in Splunk like below. The required log message will come in the middle of... by senthamilselvan Engager in Splunk Search 05-26-2017 0 5	0	5
MAP command in splunk Hi Team, I am having a difficulty in understanding map command. In the below commands, we need to extract work order ... by arjitgoswami Explorer in Splunk Search 05-26-2017 0 5	0	5
map command not working Hi All, when I am trying to run the subsearch separately, I am getting values. But when I am using map to run the b... by arjitgoswami Explorer in Splunk Search 05-26-2017 0 4	0	4
Time difference where values are at random place in a file. Hi All, I need to search for time taken since a value popped up in the logs. The problem here is that this value is... by arjitgoswami Explorer in Splunk Search 05-26-2017 0 9	0	9
tstats behaviour change in Splunk 6.6, expected change or bug ? Hi ! Splunk 6.6 being out officially, I had the (bad) surprise to discover is very annoying change in tstats command... by guilmxm Influencer in Splunk Search 05-26-2017 1 7	1	7
regular express to stop at "=" Hi, I have a search string that does the following: temperature sourcetype=kaa \| rex field=_raw "\"endpointKeyHash\"... by wuming79 Path Finder in Splunk Search 05-25-2017 0 8	0	8
DHCP and Proxy Search - Join Performance Issues I have a working search using join that correlates DHCP addresses by machine name to find web proxy traffic as the de... by michaeldeck Engager in Splunk Search 05-25-2017 0 3	0	3
Multiple regex in a field extraction Hi, What I mean is that I want to parse all the error messages in my logs into one field called Errors but the regul... by byu168 Path Finder in Splunk Search 05-25-2017 0 4	0	4
stats by _time and field values in that time frame Expected stats result Time every 5mins \| Apps \|count 1:00 \|app1,ap... by knarayana New Member in Splunk Search 05-25-2017 0 1	0	1
How to get max value of string inside braces Hi All, I am new to splunk and need help in creating a table to get max value. Below are my sample logs - 2017-05-2... by jsamadhan New Member in Splunk Search 05-25-2017 0 3	0	3
IP Range Lookup I have IP lookup table (ips.csv) mixed with different types of formats such as ip ----------------------- 192.168.1.... by splunkrocks2014 Communicator in Splunk Search 05-25-2017 1 4	1	4
remove the special character ' from beginning and end of the field value Hi, I am reeving the logs from email gateway and all the field values are between ' character and those are captur... by mustafag Path Finder in Splunk Search 05-25-2017 0 12	0	12