Splunk Search

Community Activity

Is there a search or command that will number rows in a table? is there any command to get row numbers in table? Like, I have a table like host source type DFR splunk_id FGH... by ThiruSplunk5676 New Member in Splunk Search 04-26-2017 0 3	0	3
Grouping a "time" span from one true value to another I have a boolean value in my data set. I want to group all event together that are between the event(a) right after a... by krwinters11 Path Finder in Splunk Search 04-26-2017 0 2	0	2
How to edit my search to format String to Number with fieldformat for all 60 columns? Hey guys Is there a quick way to format data? I want to format data like this <search> \|fieldformat test1a=tonumber... by laudai Path Finder in Splunk Search 04-26-2017 0 3	0	3
Which users have done this but have not done that ? Hello there, I'm struggling a little bit with the search language, booleans, eventtypes and stuff ... I can't find a... by Mahieu Communicator in Splunk Search 04-26-2017 0 6	0	6
How to exclude last 3 values in the search results. Hi , I need exclude the values last 3 three values from the search results. Can someone please help me on this. ind... by vkumar6 Explorer in Splunk Search 04-26-2017 0 1	0	1
SEDCMD: to filter the character between the user Curently our proxy logs with user having special characters inbetween. ref: DC=local/bob\, tom I have created a prop... by neelamsantosh Path Finder in Splunk Search 04-26-2017 0 1	0	1
OR operator problem Hi all, Hey, what's wrong with the next search structure? I'm using OR operator because the field names are differe... by bugnet Path Finder in Splunk Search 04-26-2017 0 2	0	2
Is there a way to speed up my search through millions windows security logs? Doing some long-tail analysis and I am running in Fast Mode but the query for 24 hours is taking a long time. Please... by packet_hunter Contributor in Splunk Search 04-26-2017 0 10	0	10
best tips for speeding up searches? best tips for speeding up searches? by transamrit Explorer in Splunk Search 04-26-2017 1 5	1	5
Group full auditd (rlog) EXECVE commands by User? Hello, I have been trying to write some custom searches against linux auditd logs to get a list of all commands exec... by pierceward Engager in Splunk Search 04-25-2017 2 2	2	2
inputlookup format to insert wildcard * is it possible? inputlookup like: user mailbox smithj john smith bloggsj joe bloggs search string: \| inputlookup use... by r999 Path Finder in Splunk Search 04-25-2017 1 2	1	2
Need help on finding daily hourly max for a month for a timechart Hi All, I am pretty new to splunk and trying to figure out a splunk search query. I am extracting a monthly report o... by payalgarg27 Explorer in Splunk Search 04-25-2017 0 4	0	4
unable to filter specific source with REX i have data coming from different sources (catalina,sailpoint,accesslogs,etc) now i want to filter it into different ... by cleelakrishna Loves-to-Learn in Splunk Search 04-25-2017 0 1	0	1
Extract out the first line of results from Transaction command Hello guys, I have a sample log that looks like this: DATE, TIME, LOGIN, IP_ADDRESS, USERID, EMPLOYEE_ID, WORKSTAT... by silvermail Path Finder in Splunk Search 04-25-2017 0 7	0	7
Show meesage if no results but continue applyng commands if there are results I have a following query: index=main source=mylogsource.log "Response Message:*" "234998102" \| ifnoresults ---> (ev... by gpincheiraa Engager in Splunk Search 04-25-2017 0 1	0	1
Why does the timechart command give different values than stats command? Hi, I am getting difference in count while using stats in piechart and with same search with timechart in line graph... by umsundar2015 Path Finder in Splunk Search 04-25-2017 0 8	0	8
Splunk rex bring back sql query Hi Guys, I'm hoping someone can help. I have log data which is generated from SAS EG. I want to create a report whic... by ATMO1 New Member in Splunk Search 04-25-2017 0 4	0	4
what is difference between if search head fetching data from stand alone indexer and index clusterding environment Hi Folks, what is difference between if search head fetching data from stand alone indexer and index clustering envi... by lksridhar Explorer in Splunk Search 04-25-2017 0 1	0	1
For large lookups, should I use the kv store? Hi, I am developing a dashboard and search that needs to utilize a large lookup file (75k lines) that gets generated... by a212830 Champion in Splunk Search 04-25-2017 5 9	5	9
Case insensitive field extraction and reporting Hi, I am trying to extract a field from logs and generate report from it. Basically, I am trying to identify the aut... by rahiparikh Explorer in Splunk Search 04-25-2017 0 5	0	5
EventCode 4672 extraction prob? Hi, did anyone also figure out that the 4672 Windows Event is not completly extracted by splunk? 4672 is a importen... by ndcl Path Finder in Splunk Search 04-25-2017 0 6	0	6
Chart increment problem (decimal not integer) Hello guys, I've a problem : I can't set integers for the X axis, I have sometimes decimal values : XML options: ... by splunkreal Influencer in Splunk Search 04-25-2017 0 4	0	4
Regex in transform.conf delete text in the middle I'm having some trouble to delete the text in "plugin_set". Sample Incoming data: {"plugin_family": "somestuff", ... by Alwiinie New Member in Splunk Search 04-25-2017 0 6	0	6
Is there a way to auto adjust the Y-value to just show the significant part of the chart? All, Often times I just want to see the delta, not the sum of a timechart. Any ideas on if there is a way have Spl... by daniel333 Builder in Splunk Search 04-24-2017 0 2	0	2
How to find difference in value between search strings? Hi, I am using a single search string with two different time rage to find the disk space. Search string : index= ... by Gowtham0809 New Member in Splunk Search 04-24-2017 0 6	0	6