Splunk Search

Community Activity

How can you restrict a role or user from creating field extractions? How do you restrict a role from creating field extractions? There's event actions drop down for search results where ... by devinmclean Path Finder in Splunk Search 03-09-2017 0 3	0	3
use a subsearch to define earliest and latest for main search I want to use a sub search to find events, then use the time as a boundary for the main search. In my case, I search ... by yannK Splunk Employee in Splunk Search 03-09-2017 6 3	6	3
Unable to get graph from csv data input. I must have this data to be converted to graph. I have attached the csv. Is it possible? When I try this it gives be ... by kingshukm New Member in Splunk Search 03-09-2017 0 5	0	5
Give complete log output on search When I do a search, the search results only show the lines of the logs that are matching my query. Is it possible to ... by YanwuGuTelus New Member in Splunk Search 03-09-2017 0 5	0	5
How do I include time range fields, Cron Schedule, and Alert Condition in my search to validate my Splunk Alert? Hello Everyone , We need to validate our teams Splunk Alerts are correct. And that the Alert conditions thresholds... by theoborrero Explorer in Splunk Search 03-09-2017 0 3	0	3
Is it possible to group events by date range within 1 second? Sorry if this was a question asked before but i couldn't seem to find it. I am trying to do a group by on _time so th... by dcheng123 Engager in Splunk Search 03-09-2017 0 4	0	4
How to edit my search to convert a string to date format? hello! i have this date: 20150225123000998 I want this format date : 25/02/2015 12:30:00 998 (not important) m... by gasdrubadiss New Member in Splunk Search 03-09-2017 0 1	0	1
How to use the time input field to calculate time as seconds? Hi, In my form, I have labeled my time input as field3 such as: input type="time" token="field3" searchWhenCha... by abzmhzsplunk New Member in Splunk Search 03-09-2017 0 6	0	6
How to remove values of 0 from my search results? I have a search that calculates a time duration for windows events logon and logout. ....\| eval duration=tostrin... by packet_hunter Contributor in Splunk Search 03-09-2017 0 8	0	8
How do i get Unique events for my search keyword I am getting so many results for a single search keyword.how do i make a unique single result for that search keyword... by rakesh_498115 Motivator in Splunk Search 03-09-2017 0 2	0	2
Identify searches that take long time in a SH Cluster. Is there a way to find out which query i staking long time and consuming more CPU and memeory utilisation via a splun... by sarnagar Contributor in Splunk Search 03-09-2017 0 4	0	4
index=_audit contents? Could someone please tell me what these following fields in the audit index refer to? OR please guide me to the right... by saranya_fmr Communicator in Splunk Search 03-09-2017 0 3	0	3
How to find an active user session on different machines at the same time? Hello Splunkers. Using the wineventlog I can tell when a user logged on and off based on EventCodes 4624 and 4634 an... by guimilare Communicator in Splunk Search 03-09-2017 0 3	0	3
Null Search Swapper Hello, When using the "Null Search Swapper" functionality with code like the one we can find in the "Splunk 6.x Dash... by jebabin Engager in Splunk Search 03-09-2017 0 3	0	3
How can I report on only current data in a file being refreshed every minute? A file is being referenced, that is updated every minute. I would like to report on data that only exists in that fil... by bcarnot Path Finder in Splunk Search 03-09-2017 0 2	0	2
Is there a way to copy a field and not rename it? I need to display _time field1 field1 where field 1 and field 1 are the same, however if you try to do this it wont d... by robertlynch2020 Influencer in Splunk Search 03-09-2017 0 2	0	2
how much data coming to an index hi, Is there any way we couldn't find out how much data coming to an particular index ? by kteng2024 Path Finder in Splunk Search 03-09-2017 0 3	0	3
Keeping long events together I've got a log of rails requests which are mostly parsed correctly. Almost every request seems to be a single event w... by viraptor New Member in Splunk Search 03-09-2017 0 1	0	1
streamstats event question Hi I amb calculating the averge between two consecutive events using streamstats, the question is that I have to do i... by jperezes Path Finder in Splunk Search 03-09-2017 0 2	0	2
Any regex masters out there? Working on a regex for a script log. Need to pull out user: User accounts for \\ -----------------------------------... by tkwaller Builder in Splunk Search 03-09-2017 0 9	0	9
Can I count multi-value fields? My event(NOT table): _time,id,eth_src,eth_dst 090000,1,u,v 090001,1,w,x 090002,1,y,z 090003,2,u,v 090004,2,w,x 09000... by i111040d New Member in Splunk Search 03-09-2017 0 5	0	5
How to edit my search to exclude events outside of certain times of the day? Greetings, I need to run a search and only pull certain events that happen between midnight and 5:00 AM. So I use t... by SplunkLunk Path Finder in Splunk Search 03-09-2017 0 13	0	13
How to extract string from a position until the end of line? I have lines like this: [2011/02/11@10:33:13.978+0100] P-18679 T-0 I Usr 2: (49) SYSTEM ERROR: Memor... by mdzmuran Observer in Splunk Search 03-09-2017 0 2	0	2
How to parse a JSON array into Splunk table? I have been searching for how to do this and I haven't really come across anything that matches my use case. I have ... by bshega Explorer in Splunk Search 03-09-2017 0 7	0	7
notify users to change password on their first login and every 3 month the password we share should expire in 3 days Hi all Can any one help me with password change notification to the user What exactly we need is if we create new u... by puneethgowda Communicator in Splunk Search 03-09-2017 0 4	0	4