Splunk Search

Community Activity

Regex/sed replaces and issues with succeeding numbers Hi all, I'm having issues with a rex/sed replace not cleanly working. I'm trying to anonymise session IDs in order t... by alekksi Communicator in Splunk Search 03-30-2017 0 5	0	5
Why does using the by and over clauses not work simultaneously with the chart command? Hello guys, i have a csv file with rows Resource Contract Category Sub Activity Team Activity Descrip... by amitmenon123 New Member in Splunk Search 03-30-2017 0 4	0	4
How to write regex to extract multi-value fields and graph data by time? Hello, I have a log file with a bunch of entries like this: <carrier-index>[<error>]: 0[0], 1[0.0363152], 2[0.022826... by lwm4p Path Finder in Splunk Search 03-30-2017 2 9	2	9
Removing duplicate entries considering multiple fields Hi, I have a file containing 1000 records. There are multiple entries for each of the fields Eg- camp_label, del_co... by k_harini Communicator in Splunk Search 03-30-2017 0 3	0	3
How to edit my search so that columns show events per date? Hi, I am new to Splunk and I am having a hard time to achieve something I believe is basic. I am trying to run the ... by mforgues Engager in Splunk Search 03-29-2017 0 1	0	1
Add column names to already existing column names Hello, I have excel data as shown in the attached screenshot, I want to have same report in my splunk enterprise wit... by Chinmai Explorer in Splunk Search 03-29-2017 0 6	0	6
How to generate a search that will display values in my sample data in a table? Hi I have events coming from the servers. here we have some sample data. 2017-03-29 13:57:09.892 [WMQJCAResourceAdap... by prashanthberam Explorer in Splunk Search 03-29-2017 0 4	0	4
Alternative suggestions needed for join and subsearch commands as my Splunk instance is limited to 50k results I am facing an issue with the subsearch limitations when using the join statement. My organizations Splunk implementa... by bcatwork Path Finder in Splunk Search 03-29-2017 1 8	1	8
Searches not being scheduled on Search Head Cluster when created locally in an application In order to organised things on a search head cluster for various teams/permissions we've been setting up application... by splunkto Explorer in Splunk Search 03-29-2017 0 6	0	6
how to extract string started with different words Hi, I have logs like I want to extract the Bold string from the below logs. I used below rex but it's showing no re... by Laya123 Communicator in Splunk Search 03-29-2017 0 3	0	3
Count each Item of a multivalue table field Hey everybody, I got a search in which I'll try to visualize who many calls from an IP a calling a specific URL. The... by hypePG Path Finder in Splunk Search 03-29-2017 0 7	0	7
Compare Lookup CSV with Search Dear Experts , I have created the Lookup Hostname.csv(Contain only one field Hostname) which contain 100 number of h... by sumit29 Path Finder in Splunk Search 03-29-2017 0 2	0	2
Help extracting fields from raw event Here's what my raw event looks like: 58daf92d66c83d000e469dfd.txt unsupported file format I'd like to extract the... by hippe21 Explorer in Splunk Search 03-29-2017 0 2	0	2
Merge results of multiple queries I have used the multiple queries and merged them in single output. When I using timechart, getting the expected resul... by twh1 Communicator in Splunk Search 03-29-2017 0 1	0	1
Why are searches only showing "Parsing job...", and drilldowns do not render properly in Firefox with version 6.5.0? Our users are encountering intermittent problems with using Firefox after we've upgraded to version 6.5. In basic ... by kearaspoor SplunkTrust in Splunk Search 03-29-2017 0 3	0	3
create a table by comparing data from 2 different indexes Hi, I am trying to create a table by comparing data from 2 different indexes & compare certain search terms from one ... by arjun_hcl Explorer in Splunk Search 03-29-2017 0 2	0	2
How to escape a parentheses in sed rex command ? Hello dearest Splunkers, I am trying to convert "(A=hi) OR (B=bye)" to "(A=hi) NOT (B=bye)" using sed. So far I have... by DavidHourani Super Champion in Splunk Search 03-29-2017 0 2	0	2
how to create a single search where the output of the first query should act as input to the second query. We have two indexers in place. index=A & index=B. From index=A I have queried out the field which I want the value fo... by dina1701 Engager in Splunk Search 03-29-2017 0 2	0	2
Predict - 95% Confidence Interval I have read through Splunk docs that Splunk defaults lower and upper Confidence Interval to 95% for its prediction us... by arielpconsolaci Path Finder in Splunk Search 03-29-2017 1 3	1	3
srchFilter and inputlookup Is it possible to filter results in a lookup-file with filters defined in "srchFilter" in authorize.conf? Example lo... by reubentrapdoor Engager in Splunk Search 03-29-2017 0 2	0	2
how to display all values within the same field name. Ex log: (This is a XML log, giving details from the middle and not the entire log) Event 1: <students> <stu... by ndayanat Explorer in Splunk Search 03-28-2017 0 5	0	5
Creating a graph with two columns of a table Hello, I need to make a simple line chart with the values of two columns of a table. the first column is the x axis ... by matansocher Contributor in Splunk Search 03-28-2017 0 8	0	8
Sort the query based on firstime and count Hi, Is there a way to sort the below query based on both firstime and total count . I want to know which sourcetype... by kteng2024 Path Finder in Splunk Search 03-28-2017 0 4	0	4
REX Non-Capture Group Hi Everyone, Trying to understand non-capture groups better Trying to build rex that captures 2 conditions but us... by subtrakt Contributor in Splunk Search 03-28-2017 0 1	0	1
Splunk Time stamp modification Hi Team, We are in splunk 6.5. Our forwarder machines are having Brasilia Time zone and our indexer is on UTC time ... by Abilan1 Path Finder in Splunk Search 03-28-2017 0 7	0	7