Splunk Search

Community Activity

How to trim values from results Hi, We are looking to have my file name more readable and that being said FIlename looks like below and need to trim ... by splunker9999 Path Finder in Splunk Search 03-01-2017 0 6	0	6
How to generate a search to find unique IPs hitting a specific URL in Specific Time Range? Hello - I'm trying to write a search string that finds unique IPs hitting a specific URL in 30 minute bursts. For exa... by mistydennis Communicator in Splunk Search 03-01-2017 0 6	0	6
How to extract source and destination IP fields? I am trying to configure various search fields for a firewall log from the field extractor but Splunk is pulling up s... by rootchin Engager in Splunk Search 03-01-2017 1 3	1	3
Display only differences in values, between 2 events Hello, I'm looking events that track changes to a configuration. The first event is the "before" state the newest e... by chengka Explorer in Splunk Search 03-01-2017 0 14	0	14
How to edit my search to limit results to a specific user? Hi i'm working w/ the below search and getting good results for all currently logged in user accounts but would anyon... by cjsweeney1 Explorer in Splunk Search 03-01-2017 0 3	0	3
How to include only certain fields in an email sent from an alert I have an alert that looks for a pattern in an event that is an xml: ie. ":2017-03-01 06:02:16,194 INFO 7010 Syste... by riotto Path Finder in Splunk Search 03-01-2017 0 3	0	3
How to generate a search that determines inactivity of firewall rules? I'm having issues creating a search that determines inactivity of firewall rules. I'd like to determine if a firewal... by elpfarr Explorer in Splunk Search 03-01-2017 0 5	0	5
Unknown error for peer xxx. Search Results might be incomplete Splunk 6.4.2のSearch head 2台、Indexer 12台の分散環境を使っていますが、時間がかかるサーチを実行するとUI上に以下のエラーが表示されることがありますが、エラーが表示される原因および解決方法を教えてくだ... by cwl Contributor in Splunk Search 03-01-2017 0 1	0	1
Why does appendcols cause a search to produce different results? Hello all, I have an index of events, each of which has an enter and exit timestamp where _time is associated to the... by andrewtrobec Motivator in Splunk Search 03-01-2017 0 8	0	8
How can I merge 2 tabled rows and add field values from columns as new fields? I am looking to combine columns/values from row 2 to row 1 as additional columns. I am not sure which commands shoul... by nidhsha2 New Member in Splunk Search 03-01-2017 0 5	0	5
Why am I receiving "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" error with my current search? Hi Folks, While executing the below command on Search and Reporting app, we are getting below error. could you pleas... by lksridhar Explorer in Splunk Search 03-01-2017 0 5	0	5
Searching Splunk logs and looking for occurrences of values fed from a CSV file Hi, All, Here's what I have: I have a csv file (1 column, 1000 values) which I've uploaded to the lookup dir: "/opt/... by carpe_diem12 New Member in Splunk Search 03-01-2017 0 9	0	9
mainframe log parsing help - crazy log format Greetings I have been staring at the below for sometime and I have no idea where to start to get this log to parse c... by ebailey Communicator in Splunk Search 03-01-2017 0 7	0	7
Group by two or many fields fields Hi This is my data : I want to group result by two fields like that : I follow the instructions on this topic ... by Naaba New Member in Splunk Search 03-01-2017 0 9	0	9
What is the max value for maxsearches? Is there a way to NOT have a max (set to 0 or -1)? What is the max value for maxsearches? Is there a way to NOT have a max (set to 0 or -1)? by dougmartin Path Finder in Splunk Search 02-28-2017 0 2	0	2
Would my search detect a malicious user, attempting to connect to multiple destinations, but only one failed login to each destination? Problem with this search? Would the following search detect a malicious user, trying to connect to multiple destinat... by jacqu3sy Path Finder in Splunk Search 02-28-2017 0 3	0	3
can i pass a subsearch argument as a greater than relationship? I've looked into format and it doesn't look like I can replace the "=". I want to change ( ( DateStart="12/14/2016... by _jgpm_ Communicator in Splunk Search 02-28-2017 0 10	0	10
How to remove max outliers from timechart? I'm time-charting public transit vehicle "layover" time. ("Layover" is how long a driver takes a break upon reaching ... by plucas_splunk Splunk Employee in Splunk Search 02-28-2017 0 9	0	9
Why is my search skipping? Hi, index=_internal source=*metrics.log group=searchscheduler \| timechart partial=false span=10m sum(dispatched) su... by kteng2024 Path Finder in Splunk Search 02-28-2017 1 2	1	2
getting the list of all saved searches hi, can i please know the query to list all the saved searches and query used for those saved searches , user id . by kteng2024 Path Finder in Splunk Search 02-28-2017 0 1	0	1
subtract response time value in 'ms' from the _time field and assign it to new field. Hi, Our application logs an event at the end of completion of an api call with response time in milliseconds(ms) li... by nmohammed Builder in Splunk Search 02-28-2017 0 3	0	3
How to compare a lookup field value with my current search? HI All, I have a lookup table with host names value around 10 field name host. I have this search index=Application ... by AdixitSplunk Path Finder in Splunk Search 02-28-2017 0 4	0	4
How to extract field:value pairs from within the value of other field? Hi, We are capturing a custom log from Windows event viewer using Splunk forwarder. Most of the fields are extracted... by att35 Builder in Splunk Search 02-28-2017 0 12	0	12
Multiple Where Claus in the same search I have a search like this sourcetype=foo-bar category=foo \| stats count by category \| where count>5 I have 5 catego... by hartfoml Motivator in Splunk Search 02-28-2017 0 8	0	8
Multiple where values how can I use multiple values in where clause for ex:index=xyz sourcetype=abc \| dedup name \| where name="2009-2274"... by ashishlal82 Explorer in Splunk Search 02-28-2017 0 3	0	3