Splunk Search

Community Activity

	How to find historical concurrent searches? hi, Is there any search or way to find the historical concurrent searches in Splunk? I would like to know trend in t... by kteng2024 Path Finder in Splunk Search 05-04-2017 0 1	0	1
	What is the regular expression to extract the numbers in my sample? I am trying to get the 432233 extracted into a field called memory memorythread = "432233 KB"; tried ?(/d) by JoshuaJohn Contributor in Splunk Search 05-04-2017 0 2	0	2
	Using nested subsearch where subsearch is results of a regex Hi Splunk friends, looking for some help in this use case i'm trying to use results from a subsearch to feed a searc... by eddychuah Path Finder in Splunk Search 05-04-2017 0 8	0	8
	Join 2 indexes I have 2 indexes that I am joining and I am getting different results based on whether I start the search with one in... by jwgiblin3 Engager in Splunk Search 05-04-2017 0 2	0	2
	regex to extract each line having a specific keyword Hi , I am trying to extract each line having a keyword, till the end of that line. below is my data and the query I ... by maniishpawar Path Finder in Splunk Search 05-04-2017 0 1	0	1
	Help me with my usecase -------------------------------------\| stats count by status \| eval status=" Status: ".status.", Count : ".count \| fi... by sravankaripe Communicator in Splunk Search 05-04-2017 0 4	0	4
	RegEx Square Brackets not supported? Using rex and it seems as if Splunk sees the open square bracket as the beginning of a subsearch. Have I written this... by svercelli Path Finder in Splunk Search 05-04-2017 0 3	0	3
	Getting _time into a \|rest search Hello, I have a client that does not have the App for Unix/Nix and does not want to install it. Problem: I need to g... by TheJagoff Communicator in Splunk Search 05-04-2017 0 3	0	3
	How to sum float value in stats I have that field "numberOfDays" that I have created that returns values of number of days in float type (0.345, 1.43... by matansocher Contributor in Splunk Search 05-04-2017 0 1	0	1
	Help me get started with a custom Splunk Lookup or command All, We are a user of Puppet and it's PuppetDB service. Which is a great place to get system information. I can fro... by daniel333 Builder in Splunk Search 05-04-2017 0 1	0	1
	how to combine two columns values based Hi, I have a table like below Name Percentage1 Percentage2 T1 25 T1 56 ... by snam New Member in Splunk Search 05-04-2017 0 3	0	3
	How to run the main search only if the subsearch returns true? I have to run the Main search only on the last working day of the month, and I got to a search that should work, but ... by prakashbhanu407 New Member in Splunk Search 05-03-2017 0 4	0	4
	How to join two searches with no common field? I have two searches search 1 -> index=myIndex sourcetype=st1 field_1=* search 2 -> index=myIndex sourcetype=st2 Fie... by jwhughes58 Contributor in Splunk Search 05-03-2017 0 4	0	4
	timechart per_second working. Hi, I found a query I could not understand: \| eval foo=1 \| timechart per_second(foo) as "Bytes per second" Why set... by deepak02 Path Finder in Splunk Search 05-03-2017 0 2	0	2
	Splunk query. I would like to count the number of times a Server went down, based on up/down state field. State field receives up o... by biec1 Explorer in Splunk Search 05-03-2017 0 2	0	2
	extract date time from log entries I have the following log structure from which I want to index date time properly. INFO :20170503:11.21.54.48:XYZW... by muriloalves Explorer in Splunk Search 05-03-2017 0 6	0	6
	Display the "others" or the rest after showing top results I have this search to show top 5 values: search... \| fields ALARM \| stats count by ALARM \| sort limit=5 -count Resu... by christopheryu Communicator in Splunk Search 05-03-2017 0 8	0	8
	Setting a default action for alert in splunk HI, Is there anyway in splunk to set the "email" as default trigger action for an alert. by kteng2024 Path Finder in Splunk Search 05-03-2017 0 2	0	2
	Cannot find any featureID in Geospatial Visualization. Hi Splunkers, I tried the new feature, Geospatial Visualization in Splunk V6.3 as "Option 1" posted on splunk blog. ... by sunrise Contributor in Splunk Search 05-03-2017 0 4	0	4
	lookup table does not exist I am getting error as "Lookup table does not exist. It is referenced by configuration", but i have the lookup on the ... by srinathd Contributor in Splunk Search 05-03-2017 0 3	0	3
	How to prevent "max concurrent searches reached" messages on the distributed management console? I've configured a dev Splunk 6.4 env, and noticed that my Distributed Management Console is getting "max concurrent s... by a212830 Champion in Splunk Search 05-03-2017 0 4	0	4
	How to achieve vlookup in Splunk Hi, Kindly help me with the search query for my scenario. I have a lookup table A and a search B with common field u... by karthikklv Engager in Splunk Search 05-03-2017 0 4	0	4
	How to edit my search to use transaction command to exclude values? Hi, I have the following search that returns 10,552 events over a given period of time: index=oracle (INSTANCE_NAME=... by ggiovan Engager in Splunk Search 05-03-2017 0 13	0	13
	Counting from log based on email add for successful logins / incorrect password The following are sample logs for successful login and incorrect password attempts based on email address: May 2 0... by babidi New Member in Splunk Search 05-03-2017 0 3	0	3
	Log filtering based on field value change. I have two kinds of logs sourcetype = abc IP = a.b.c.d status=active sourcetype = abc IP = a.b.c.e status=active so... by rakes568 Explorer in Splunk Search 05-03-2017 0 3	0	3