Splunk Search

Community Activity

How to write a regular expression to extract a long string until a group of multiple characters, and ignore if it begins or ends with double quotes? I am trying to extract fields out of events that are tab-delimited unless there are quotes around them. For example, ... by jwalthour Communicator in Splunk Search 03-11-2017 0 9	0	9
What is the best way to extract data when my log has with comma separated fields and the field-value pairs are separated by a colon? How would I go about parsing out/extracting the field data for the following log format? "fieldname1":"fieldvalue1",... by nunyabizness123 New Member in Splunk Search 03-11-2017 0 2	0	2
How to edit my search to show the last successful server imaging ("Build Succeeded") from the the failures ("Build Failed")? sourcetype="my_sourcetype" ("Build Failed" NOT "Build Succeeded") earliest=@d+2h \| rename host as "Imaging Server" \| ... by rlseafor New Member in Splunk Search 03-11-2017 0 2	0	2
Is there a way to determine days between with this search? Is there a way to determine days between with the search below? convert ctime(LastScanDate)\|eval tnow = now() \| conv... by jhayIV Engager in Splunk Search 03-11-2017 0 2	0	2
What is the regular expression to replace a dash '-' in a string with a period '.' 12-000-000-222 for the above IP address, i want to change it to 12.000.000.222. pls help. by shivac New Member in Splunk Search 03-11-2017 0 4	0	4
Field extraction using Splunk dashboard - appending constant text to an extracted field I am wanting to extract a new field from the original source field, based on regex matches. I would then like to prep... by jamesar Explorer in Splunk Search 03-11-2017 1 4	1	4
How to edit my search to find the top 5 distinct count and the total? Assuming I have a lookup table with movie title and location, and I got the top 5 location based on distinct title co... by splunkrocks2014 Communicator in Splunk Search 03-11-2017 0 6	0	6
Break JSON file into separate events, removing the header and footer I've just started using RegEx and I'm currently looking on a way to extract multiple events from my JSON flight infor... by mblauw Path Finder in Splunk Search 03-11-2017 0 2	0	2
Dropdown creation and configuration for a dashbaord Hi, I wrote one simple query index=nmon host=* type=DISKXFER \| timechart avg(value) by host and created a dashba... by shabdadev Engager in Splunk Search 03-10-2017 0 3	0	3
Is there an alternative search approach to using a transaction with maxspan? I'm curious if there is a way to get the same effect of transaction w/maxspan, without having to use that process int... by smwilli1 Explorer in Splunk Search 03-10-2017 0 6	0	6
How to verify if a document has been reviewed based on the last update date and the versioning? Hi all, I need your help. I retrieve a log from Sharepoint which contains the list of all published document with i... by danje57 Path Finder in Splunk Search 03-10-2017 0 5	0	5
tcp data not replicated I have replication factor of 3 but the data is not replicated to any other indexers. This is happening for tcp input ... by sbhaskaran Explorer in Splunk Search 03-10-2017 0 2	0	2
Remove multiple values of attributes using single NOT Hello Everyone, I want to block multiple IP address I got my using IP!=xxx.xx.xx.xx OR IP!=yyy.yy.yy.yy Is there an... by vittal_kumar Engager in Splunk Search 03-10-2017 0 3	0	3
Index XML files from a url How can we index XML files from a url ending in .xml in splunk? We have an XML URL that we need to index into splunk,... by abhijitnath89 Path Finder in Splunk Search 03-10-2017 0 5	0	5
Display Date on Dashboard panel I want to show the previous week date on Title of panel. Can anyone have some thoughts for it? by chintan_shah Path Finder in Splunk Search 03-10-2017 0 3	0	3
Swap field and values I have a list of fields within a Datamodel collected as values within the field named "unknown" \| datamodel Authenti... by muebel SplunkTrust in Splunk Search 03-10-2017 0 2	0	2
append search incorrect time window I have a multisearch to view data for yesterday only. [search index=... earliest = -1d@d latest=+0d@d\| search .... ... by akhasriya Engager in Splunk Search 03-10-2017 0 2	0	2
What to do when appendcols command can't handle larger counts? We need to determine a 30 day average based on the count of two events, a request and a response. The issue is that e... by f5x6kb8 Explorer in Splunk Search 03-10-2017 0 4	0	4
How to combine my two search queries using join or subsearch? Hi, I have 2 different search queries which i need to combine and generate the report as similar to dashboard and ou... by Gowtham0809 New Member in Splunk Search 03-10-2017 0 1	0	1
setup.xml: problems with windows scripted input format I have a setup.xml which uses the following format for scripted inputs on Unix systems: # inputs.conf [script://./bi... by mw Splunk Employee in Splunk Search 03-10-2017 2 9	2	9
Could not use strptime to parse timestamp Hi all, I'm adding detail files from FreeRadius, which looks like following: Wed May 2 10:28:04 2012 NAS-IP-Ad... by stwong Communicator in Splunk Search 03-09-2017 1 6	1	6
How to a create a table search for my data? i have fields key and value field "key" contains values sessionID txnID eventSeverity msgType ... by sravankaripe Communicator in Splunk Search 03-09-2017 0 2	0	2
How to generate a search to find persistent connections between client workstations to the internet? I have squid proxy log that I want to mine for persistent connections from my client workstations to the internet (ie... by pdumblet Explorer in Splunk Search 03-09-2017 0 3	0	3
How to use eval to sum a large set of fields with field name matching a pattern? I have several fields like this: types.events.1 types.events.2 types.events.3 etc I can use eval to sum them like t... by driekhof Path Finder in Splunk Search 03-09-2017 0 7	0	7
How can you restrict a role or user from creating field extractions? How do you restrict a role from creating field extractions? There's event actions drop down for search results where ... by devinmclean Path Finder in Splunk Search 03-09-2017 0 3	0	3

Get Updates on the Splunk Community!

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026 | 10:00AM PT / ...

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

Inside Splunk Agent Observability:Understanding Agent Behavior, Tokens & Costs Thursday, August 06, ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Search

How to write a regular expression to extract a long string until a group of multiple characters, and ignore if it begins or ends with double quotes?

What is the best way to extract data when my log has with comma separated fields and the field-value pairs are separated by a colon?

How to edit my search to show the last successful server imaging ("Build Succeeded") from the the failures ("Build Failed")?

Is there a way to determine days between with this search?

What is the regular expression to replace a dash '-' in a string with a period '.'

Field extraction using Splunk dashboard - appending constant text to an extracted field

How to edit my search to find the top 5 distinct count and the total?

Break JSON file into separate events, removing the header and footer

Dropdown creation and configuration for a dashbaord

Is there an alternative search approach to using a transaction with maxspan?

How to verify if a document has been reviewed based on the last update date and the versioning?

tcp data not replicated

Remove multiple values of attributes using single NOT

Index XML files from a url

Display Date on Dashboard panel

Swap field and values

append search incorrect time window

What to do when appendcols command can't handle larger counts?

How to combine my two search queries using join or subsearch?

setup.xml: problems with windows scripted input format

Could not use strptime to parse timestamp

How to a create a table search for my data?

How to generate a search to find persistent connections between client workstations to the internet?

How to use eval to sum a large set of fields with field name matching a pattern?

How can you restrict a role or user from creating field extractions?

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation