Splunk Search

Community Activity

Usage of Token for eval function in dashboard query Hi All, How to use tokens in the eval function when we write query in the dashboard: I have a token with name "IN" ... by bharathkumarnec Contributor in Splunk Search 03-15-2017 0 4	0	4
How to combine my 2 reports? I think this is simple and I think I see similar questions, but I've failed to implement them for my case and any hel... by chaoservices Explorer in Splunk Search 03-15-2017 0 6	0	6
How to search for newly added hosts? Hi we have some new hosts added in our instance. we need to built a search to check for newly added hosts. We have... by Gayathirik Path Finder in Splunk Search 03-15-2017 0 8	0	8
How to search for newly added servers by comparing today's log with the previous week's logs? Hi, I have a file with hostname. I need to find out the newly added server in it. When I use the set diff command, i... by SathyaNarayanan Path Finder in Splunk Search 03-15-2017 1 7	1	7
How to hide input based on another input? I have two different inputs, "by usage" and "by process", and I want to use a radio button to control the those input... by splunkrocks2014 Communicator in Splunk Search 03-15-2017 1 2	1	2
Not displaying Events list when Searching Hello, I have been using splunk for a few months with no issues. Now when I run any search on flashtimeline I can s... by re24610 New Member in Splunk Search 03-15-2017 0 9	0	9
Help parsing out events - need to get timestamp, host and sourcetype to rewrite metadata I have the following event: { [-] ident: vcap.cloud_controller_ng message: {"timestamp":1489461... by brent_weaver Builder in Splunk Search 03-15-2017 0 5	0	5
Change Row Values to Column Headings Hi, I wonder whether someone may be able to help me please. I'm using the query below which extracts a column of fie... by IRHM73 Motivator in Splunk Search 03-15-2017 0 2	0	2
Regular expression in Splunk for extracting fields I have some uneven stings and I need to extract a field from all the strings. Unique thing is the required field lies... by Gowtham0809 New Member in Splunk Search 03-14-2017 0 2	0	2
how can I calculate the average of field1,field2,field3 for users and display the average of each user? I have a splunk result as below user field1 field2 fi... by pavanae Builder in Splunk Search 03-14-2017 0 3	0	3
Convert log time (epoch) to readable Date and time I have this on my log including epoch time, how I can convert the time next to msg to readable time. "rank=msg(14895... by raindrop18 Communicator in Splunk Search 03-14-2017 0 3	0	3
no data from specific data source hi, How to find out whether a forwarder sending an events which belongs to specific data source because i don't see ... by kteng2024 Path Finder in Splunk Search 03-14-2017 0 1	0	1
How generate a search to monitor devices that send out an unusual amount of logs? Dear fellows， i am trying to write a search string to monitor which of my devices send out an unusual amount of log... by willluo Engager in Splunk Search 03-14-2017 0 2	0	2
Verify a list of values Hello everybody (皆おはようございます) I have a new request for all members  This search : sourcetype=sccm \|streamstats count... by LNebout Path Finder in Splunk Search 03-14-2017 0 2	0	2
Does Splunk recognize LEEF formatted? I am trying to import "LEEF" formatted data (from an IBM mainframe) into Splunk, but none of the name / value pairs a... by steveirogers Communicator in Splunk Search 03-14-2017 0 10	0	10
Why am I unable to search my extracted fields? I'm trying to ingest airwatch syslog events but not all fields are searchable only those with Field=Value in the mess... by hmasten Explorer in Splunk Search 03-14-2017 0 10	0	10
How to use result from subsearch in my search? Hi All, My data looks like this: sourcetype - Loginstats contents - Hostname, host, Address sourcetype - Clientstat... by billycote Path Finder in Splunk Search 03-14-2017 0 10	0	10
How to extract a field and send an email alert? Hi, I have the below event for which I need to get an alert whenever the event occurs and get the version of the fil... by macadminrohit Contributor in Splunk Search 03-14-2017 0 4	0	4
How to use a lookup file as a whitelist? I'm having problems to use a lookup file as a whitelist. Basically, I have a simple ip address list with CIDR mask ap... by alainrojas New Member in Splunk Search 03-14-2017 0 3	0	3
Which of these searches is the best way to filter (by index, by source, or both)? Which of these would be the most efficient/fast/best way to start filtering for a search? index=foo \| ... or so... by driekhof Path Finder in Splunk Search 03-14-2017 0 5	0	5
DNS Resolution in a search Is it possible to have ip addresses in a search resolved to a host name and displayed in the results rather then the ... by balcv Contributor in Splunk Search 03-14-2017 2 10	2	10
How to read a file and use the data inside in a eval function? I am new using Splunk, sorry. I need to separate a lot of subnets by name. I would like (txt) to read a file kind of... by langanix New Member in Splunk Search 03-14-2017 0 2	0	2
How to generate a search where the count is greater than 0 after 5 days? I need to see if errors are still continuing after 5 days. If they are there then there is an issue and I need it to ... by nickyp86 Engager in Splunk Search 03-14-2017 0 2	0	2
How to filter results based on date (not _time)? I'm trying to filter my data results based on the following: myDate format: yyyy-mm-dd HH:MM:SS (Ex: 2017-03-14 03:5... by tmaltizo Path Finder in Splunk Search 03-14-2017 2 3	2	3
My management URI is not showing correctly in the rest endpoint info I am getting an incorrect value for the mgmt_uri value when accessing the rest endpoint /services/shcluster/status T... by ben_leung Builder in Splunk Search 03-14-2017 0 2	0	2