Splunk Search

Community Activity

mvexpand multiple multi-value fields that may be null The answer here https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html works if all the ... by ronykrell4694 Explorer in Splunk Search 03-27-2017 3 3	3	3
Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error? We get the error such as - [subsearch]: Search auto-finalized after time limit(60 seconds) reached. We changed the... by ddrillic Ultra Champion in Splunk Search 03-27-2017 1 9	1	9
How to have Splunk recognize %Y%m%d%H%M%S formatted date time? I would to create charts using timestamped data. I have a CSV file representing a table which has a TRANSACTIONDATETI... by sakeebhossain Explorer in Splunk Search 03-27-2017 0 5	0	5
Need to get the count of number of times a field is used in a request Need to get the count of number of times a field is used in a request Ex log: (This is a XML log, giving det... by ndayanat Explorer in Splunk Search 03-27-2017 0 4	0	4
How to have Pivot Report show both chart and table Hi, I was reviewing this tutorial on Youtube about how to create Pivot report https://www.youtube.com/watch?v=MdjDrDT... by pal4life Path Finder in Splunk Search 03-27-2017 1 1	1	1
can we monitor our devices under splunk ? I want to be able to monitor all the devices including unix servers, windows, network and firewall devices under Splu... by mintughosh Path Finder in Splunk Search 03-27-2017 0 2	0	2
How to index a file without extracting fields? I'm trying to index a file but I don't want Splunk to try to extract interesting fields. Or if it does, I want the fi... by leunammejii New Member in Splunk Search 03-27-2017 0 4	0	4
String split to the same field Hi, I am doing some email count analysis and run into the following problem. For inbound email the recipients field... by ttchorz Path Finder in Splunk Search 03-27-2017 0 3	0	3
How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip Right now Im using rex field=cs_uri_path "^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$" but im missing files like blah.1.0.8fi... by alexburst37 Explorer in Splunk Search 03-27-2017 1 4	1	4
How is regex in whitelist of inputs monitor for indexing file to start with special characters? I try to index sybase logs which are located in /sybase/SID/ASE-1(5\|6)_0/install/SID.log (SID is variable System-ID)... by klowk Path Finder in Splunk Search 03-27-2017 0 3	0	3
How do I convert this string into a timestamp? the convert and eval functions don't work. I have the following string: 20170306155556+0000 Splunk doesn't seem to understand that format. I've tried strpti... by gregbo Communicator in Splunk Search 03-27-2017 0 2	0	2
How do I connect to a local SQLite database? Hi all, This has been asked before, but I have yet to find an answer on Splunk Answers that details the actual steps... by wcooper003 Communicator in Splunk Search 03-27-2017 0 6	0	6
Add specific fields into the timechart OTHER category. I'm generating a report of the daily usage of my users indexes over the past week using this search: earliest=-7d@d ... by dglinder Path Finder in Splunk Search 03-27-2017 1 2	1	2
Create Scatter Diagram That Show Data Fall Within Average Range Hi all, i try to create a scatter diagram that will show idea range of values and how many fall within it. I try use ... by qygoh Engager in Splunk Search 03-27-2017 0 4	0	4
multiple search queries in one panel Can anyone help simplify attached XML to display result in one panel as described below Current Result 3 panels ... by luvukrishna Engager in Splunk Search 03-26-2017 0 3	0	3
Excute sql statement on splunk db connect Hi All, am connected to oracle database & am trying to get data from it using splunk dbconnect, amd trying to excute... by MAShawky Explorer in Splunk Search 03-26-2017 0 1	0	1
How to setup multiple SQL statements in a single DB Connection input Hi Everyone, I am creating DB inputs in the Splunk DB Connector 3.0.2. I would like to run 2 sql statements or possi... by tpirozzi Explorer in Splunk Search 03-26-2017 0 3	0	3
indexer search limits reached Hi, When i ran a command which will fetch the events from last 7 days from a host , splunk is throwing below message... by kteng2024 Path Finder in Splunk Search 03-26-2017 0 1	0	1
Creating local temporary file creates Checksum mismatch Hello, I'm trying to create an app that runs a script that executes an app, and the app creates a log file that I'm ... by Epicism1 Explorer in Splunk Search 03-26-2017 0 2	0	2
How to count hosts that have a field value of ((X OR Y) AND (A OR B)), over the course of time? I am looking to find hosts that have two field values over the course of time for the search, for example a week. T... by stakor Path Finder in Splunk Search 03-26-2017 0 2	0	2
How to use rex to extract values from URLs into a field? Hello all, From the following list http://www.foo.com:80/main.html http://www.foo.com:80/xe/journal/v1/book/nF1.jpg... by willamwar Path Finder in Splunk Search 03-26-2017 0 4	0	4
How to pass unused fields in an outer search? Hello, I need to execute a search where the 5 fields from one search would be used to search another data. Also, I n... by jagdeepgupta813 Explorer in Splunk Search 03-26-2017 0 4	0	4
How to identify symantec ep av logs in splunk Can any one tell how we can identify the symantec EP old av logs and will be there any source to pull these logs ? by vkumar6 Explorer in Splunk Search 03-26-2017 0 1	0	1
kvstore lookups and efficiency I wanted to get peoples thoughts on using multiple data sources in Splunk and whether it’s worth doing some processin... by brent_weaver Builder in Splunk Search 03-25-2017 0 1	0	1
searching bro_dns answers{} array bro_dns shows the results of a dns query as what I presume is an array, for example: answers: [ [-] mt-inges... by splunkjosef Explorer in Splunk Search 03-25-2017 0 6	0	6