Splunk Search

Community Activity

How to plot a delta timechart of average response time I have data like: timestamp, serviceName, responseTime(in ms) I want to plot the per minute delta of avg. response... by gokadroid Motivator in Splunk Search 03-18-2017 0 3	0	3
stats min/max not returning the correct result? Hi! I'm trying to figure out what I'm doing wrong with this stats query: "Advanced checkpoint" \| rex "shardId-0+(?<s... by rododoodles New Member in Splunk Search 03-17-2017 0 5	0	5
How to create a timechart that takes the remainder of a field value and add it to the previous bucket? I have the following metrics: date:01 yada yada yada total 80 date:02 yada yada yada total 120 date:03 yada yada yad... by jfraiberg Communicator in Splunk Search 03-17-2017 0 3	0	3
How to pause a dashboard panel's real-time search? I've built a dashboard panel that looks for blocked web traffic in real-time. Everything works great except I cannot ... by daishih Path Finder in Splunk Search 03-17-2017 1 6	1	6
How to edit my table to plot transactions? I was trying to create a table like below. We have a log with below fields, [Date][PreciseTime][Pid][Tid][Transactio... by krishnacasso Path Finder in Splunk Search 03-17-2017 0 6	0	6
How to generate a search that finds events that are older than 90 days? Hi, Below is my sample event. I want to create a search base which would return all such below events where FirstOcc... by srikanthpanchak New Member in Splunk Search 03-17-2017 0 2	0	2
How to do a time based search for router logs? Hello, I am new to Splunk, so trying to get familiarize with it. I want to do a time based search for router logs, fo... by salmanrc New Member in Splunk Search 03-17-2017 0 2	0	2
How to generate a conditional search based on time? I need to figure out a way to execute one of two different search strings based on the time range in a first search. ... by mstark31 Path Finder in Splunk Search 03-17-2017 0 9	0	9
How to list all the saved searches, macros, tags which contains a source=ABC? Is there any way to list out all the saved searches, macros, tags,etc which have a source=ABC in a search? Is there ... by pavanae Builder in Splunk Search 03-17-2017 0 3	0	3
Why are some events not summarized in a data model? I have an accelerated datamodel configured, and if I run a tstats against it, I'm getting the results as expected. Ho... by szabados Communicator in Splunk Search 03-17-2017 1 2	1	2
Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML? I want to be able to use my search for a few things, i.e. a table then further search or html display based on certai... by helenashton Path Finder in Splunk Search 03-17-2017 3 13	3	13
multiple field extraction with Regex I'm trying to use the Extract fields wizard to pull a field out of a log, but running into an issue. Here a portion o... by dwear Explorer in Splunk Search 03-17-2017 0 8	0	8
How to create table with two variables? Regex Hi, I am very rusty with my splunk. I have this query: index=nitros_prod_stores_servers sourcetype=_json OR sourcety... by JoshuaJohn Contributor in Splunk Search 03-17-2017 0 2	0	2
Why are the values on y-axis of my bar chart different than what I have set? I have a bar chart, I need values on the y - axis like 0, 1000000, 2000000, 3000000, .... ,7000000. I did this by us... by Chinmai Explorer in Splunk Search 03-17-2017 0 3	0	3
How to use if condition along with count in a where condition? Hi All, I need to build a search that to show result as below. I have grouped the events based on the id which is uni... by mudunuru_rk New Member in Splunk Search 03-17-2017 0 6	0	6
Regex to match two fields in transforms.conf I'm looking to match against two fields in transforms.conf. I would like to match against a customer _meta field and ... by danbrook Explorer in Splunk Search 03-16-2017 0 5	0	5
For a field user, which has precedence: an eval defined in local folder or a regex defined in default folder? Hi, I am having the following issue/conflict when resolving the field user from events (coming with sourcetype WinEv... by skender27 Contributor in Splunk Search 03-16-2017 0 4	0	4
Is it possible to create a data model lookup attribute that is based on a CSV file that contains a name column and a CIDR column? Is it possible to create a data model lookup attribute that is based on a CSV file that contains a name column and a ... by yacht_rock Explorer in Splunk Search 03-16-2017 0 1	0	1
How do you write a regular expression for all events with a certain string? I want to blacklist or send to nullqueue ANY event with a particular phrase. I can use the literal string and just e... by colbymahan Explorer in Splunk Search 03-16-2017 0 2	0	2
Is there a default sourcetype for /opt/log/www1/secure.log? Wondering if there a default sorucetype that can be used to extract source_ip and user from secure.log files? source... by jagadeeshm Contributor in Splunk Search 03-16-2017 0 2	0	2
How to make my simple timechart search run faster? I'm guessing this should be a very basic task, if it's possible. My current search below produces exactly what I wan... by adamsmith47 Communicator in Splunk Search 03-16-2017 0 2	0	2
How to create an alert based on the thresholds in a lookup table? Hello, Is there way to create an alert based on the thresholds in a lookup table? I have a search which will give ... by vrmandadi Builder in Splunk Search 03-16-2017 0 2	0	2
How to edit my search to find the last seen date of our computers? What I am trying to do is currently search for Computers that were last seen 10 days or more ago. Currently right now... by jmcaloon Explorer in Splunk Search 03-16-2017 0 1	0	1
How to edit my configurations to extract a multivalue field from an extracted field? I am trying to extract fields for OpenDNS logs. These come in a CSV format: "2015-01-01 20:39:57","client1","clien... by reedmohn Communicator in Splunk Search 03-16-2017 0 8	0	8
How can we modify the wrong _raw timestamp for a summary index? After populating data under summary index we are getting wrong timestamp for all the fields. Original search query:... by abhijit_mhatre Path Finder in Splunk Search 03-16-2017 0 4	0	4