Splunk Search

Community Activity

Eval RegEx for Host Name from FQDN Is there a way to write an eval to pull back host name Server1 from Server1.12.city.net by jhayIV Engager in Splunk Search 04-21-2017 0 2	0	2
How to edit my search to track event counts by Index/Sourcetype to see when data is no longer being received? Looking to build a report to list all the indexes/sourcetypes in use. And be able to monitor event counts as they go ... by joesrepsol Path Finder in Splunk Search 04-21-2017 0 8	0	8
How to check if a word is in a CSV file, and if it is, display results in a table? I have some data, if the message contains a word which is in a csv file, then results should show in a table. How sho... by nagarjuna280 Communicator in Splunk Search 04-21-2017 0 3	0	3
Why is there a difference in results depending on whether or not there are quotation marks in my search syntax? A search for "ip=100.2.2.2" userid=foobar (identifying information has been changed) produces 5 results. However, whe... by jian Explorer in Splunk Search 04-21-2017 0 7	0	7
How can I find the reoccurring group of transactions over time? Hey Folks, I have a transaction search that "groups" various things of interest (5m maxspan etc ). I was wondering -... by RocIngersol Explorer in Splunk Search 04-21-2017 0 6	0	6
how to extract these fields using regular expression "cvpEditAction" : "R", "cvpEditAllowedAmount" : 333.57, Could someone please help me how to extract these? thanks. by prashanthberam Explorer in Splunk Search 04-21-2017 0 7	0	7
Could anyone explain what the below eval condition is doing my search? The following is the search in my Splunk. Now I am just trying to understand the structure and that condition means c... by pavanae Builder in Splunk Search 04-21-2017 1 4	1	4
How to serach for Windows Server created and enabled accounts of type Administrator - excluding Standard user account type. I thought the following query would return that but I can see accounts of type "Standard User". "search host=* AND s... by acabralg Explorer in Splunk Search 04-21-2017 0 11	0	11
how to find out scripts running on indexers hi, Is there a way to find out the scripts running by users on indexers because few backs when i ask a user , he tol... by kteng2024 Path Finder in Splunk Search 04-21-2017 0 3	0	3
MV field split by comma and not line break I have a group of multivalue fields that are listed with linebreaks . I'm looking to remove the line breaks from one ... by mdsnmss SplunkTrust in Splunk Search 04-21-2017 1 1	1	1
Evaluate multiple events with same data. I would like to count the number of times a Server went down based on up/down status field. How can i evaluate multip... by biec1 Explorer in Splunk Search 04-21-2017 0 4	0	4
Cannot sort dynamic column in date format Hi, I tried to summary data in each assignment_group_name by month here is my code: index="snow" sourcetype="snow:... by urapaveerapan Explorer in Splunk Search 04-21-2017 0 3	0	3
Stats Distinct Count (X) + X[Values] Hi Splunkers, I have a query that gives me the following fields I want to work with. username Country (after usin... by JRamirezEnosys Explorer in Splunk Search 04-21-2017 0 3	0	3
Relative Time search (e.g. today 4AM) Hi, I have a report (scheduled to be run every 5 minutes) that I have built, it list the number of specific events ... by nicolas_pons New Member in Splunk Search 04-21-2017 0 3	0	3
Why are some searches only rarely executed without any warning or error? Hey everyone i have a little bit of a problem with some of my searches, as I am only rarely able to execute them. Sp... by hbusch New Member in Splunk Search 04-21-2017 0 5	0	5
how does the attribute "maxHotIdleSecs" work? In my indexes.conf file (C:\Program Files\Splunk\etc\system\local) I have the attribute "maxHotIdleSecs = 86400" So ... by aywong Path Finder in Splunk Search 04-21-2017 0 10	0	10
SPL: extract logfile name from source field Hi, I am trying to setup a dropdown bar for a dashboard and would like to setup dynamic inputs based on the source lo... by danielsofoulis Path Finder in Splunk Search 04-21-2017 0 6	0	6
How edit my search to get a chart of bin counts over time? I'd like to create a chart of bin counts over time (with a span defined). Right now, I can get the result over the wh... by viraptor New Member in Splunk Search 04-21-2017 0 4	0	4
Why I have "Duplicate values causing conflict" with eval ? Hi, Can you tell me why i can't update my dynamic list on my dashboard ? I have this message : "Duplicate values cau... by Abarny Path Finder in Splunk Search 04-21-2017 0 5	0	5
Group multiple Keys and count the values by status and table the results Good day, i have the follwing key values: CMD=LOOK ITEM1=APPLE ITEM2=APPLE ITEM3=ORANGE STAT=0 CMD=LOOK ITEM1=APPLE ... by mkrauss1 Explorer in Splunk Search 04-21-2017 0 5	0	5
HELP! Extracting JSON rex not working... Hello all, I am trying new things and expanding my palate but having a problem extracting JSON. My Search: index=t... by leomedina Explorer in Splunk Search 04-20-2017 0 6	0	6
How to use a list of whitelist mac addresses to find "bad" mac addresses? Hello, for control dhcp server, need to search "bad" mac addresses, but use whitelist . And need modify search string... by k909 Engager in Splunk Search 04-20-2017 0 5	0	5
Is there a search that can be used to determine if Linux logs have been cleared or deleted? Greetings, In Windows, there's a nice EventID you can query to see when system, application, or security event logs ... by SplunkLunk Path Finder in Splunk Search 04-20-2017 0 3	0	3
How to use join to combine my two search? i have to two different sourcetypes with two different key but values are same for both keys Please help me with se... by sravankaripe Communicator in Splunk Search 04-20-2017 0 4	0	4
How to find duplicate values in a multivalue field? Hi I have logs in Splunk containing lines like this: UserPolicies=13=5\|0=81540803\|7=137\|9=76\|13=3\|1=11\|21=10 UserPoli... by jovi New Member in Splunk Search 04-20-2017 0 3	0	3