Splunk Search

Community Activity

Why does expanding time range on search cause results to disappear? When I run the following search with a time range restricted to a single day (9th of January) index=main sourcetype=... by fvegdom Path Finder in Splunk Search 02-21-2017 0 7	0	7
Popup window from drilldown link Hi, I have a summary dashboard with drilldown links and once the user clicks on the link, the page is redirected t... by shangshin Builder in Splunk Search 02-21-2017 2 2	2	2
Rex - Extract till first set of numbers Hi, I have following values in field - DATA for which I want to extract text from start till the first set of number... by harshal_chakran Builder in Splunk Search 02-21-2017 0 4	0	4
Generic search to pull Job Name 20170221/032119.169 - U0020408 UC4ALERT: External Dependency inside jobplan NEWREL.JOBPLAN.X. CLEAN.SET_PARA.RTH_FOR_... by harsush Path Finder in Splunk Search 02-21-2017 0 1	0	1
How to wait for the SearchManager job to finish? Currently, I run the search query and get the last 3 records, basic on these records and generate the charts. However... by chrismok Path Finder in Splunk Search 02-21-2017 5 6	5	6
Do we have to write fields .conf file for every indexed field extraction Hi I have extracted ipaddress during indextime. Do I have to use fields.conf for every time I during the Index time ... by ankithreddy777 Contributor in Splunk Search 02-21-2017 0 1	0	1
Passing results from subsearch to a field in parent search Hello! I'm interested in passing a result or results (a list of users from proxy logs) from a subsearch into a field... by Splunkquish Explorer in Splunk Search 02-21-2017 1 8	1	8
Regex assistance We have a field such as - activity="POST->/cirrus/v1.0/providers" We would like to extract everything after the POST-... by ddrillic Ultra Champion in Splunk Search 02-20-2017 0 8	0	8
How to hide some specific events from the search results? On my search results, I need to hide some specific events from the output? Currently I am running a search to find if... by sreejith2k2 Explorer in Splunk Search 02-20-2017 0 13	0	13
Average between 2 fields D+HH:MM:SS Hi, I try to realize an average enter 2 fields which appear in the form of D+HH:MM:SS so i converted with dur2sec. ... by Abarny Path Finder in Splunk Search 02-20-2017 0 7	0	7
How to extract and calculate the sum of a field from different searches? Hello, i have on a dashboard with 5 different searches, where i have a common (calculated) field (let's call it a sc... by papemalik Explorer in Splunk Search 02-20-2017 0 17	0	17
How to edit my configurations to perform an index time field extraction? Hello All My current environment is as follows : Syslog/UF (Universal Forwarder) -> HF (Heavy Forwarder) -> Indexer... by vr2312 Builder in Splunk Search 02-20-2017 0 5	0	5
How to convert time to strptime? TransactionEndTime=2017-02-20T05:11:16.255-05:00; TransactionStartTime=2017-02-20T05:11:16.216-05:00; by karthi2809 Builder in Splunk Search 02-20-2017 0 1	0	1
for every command we filter fields and giving few fields to the next command, why eval gives all fields to the next command index=* sourcetype=history browser=chrome \| eval name="raj" giving output as many fields like sourecetype, browser, ... by nagarjuna280 Communicator in Splunk Search 02-20-2017 0 1	0	1
How to map the lookup conditions and get the indexed data in splunk Hello Everyone, I have requirement where i need to search eventtype which are present in my lookup table, say in loo... by snehalk Communicator in Splunk Search 02-19-2017 0 5	0	5
Real Time Monitoring Hunk Data I got to know from the hunk documentation currently hunk does not support real time monitoring of hadoop data Can we ... by basilarockiaedw Path Finder in Splunk Search 02-19-2017 0 1	0	1
How do I create a table result with "stats count by ‘field’"? I have a set of events which have multiple values for a single field such as: accountName=customerA result=[passed\|f... by nickhills Ultra Champion in Splunk Search 02-19-2017 0 4	0	4
How to generate a search to find out whether indexer queues were blocked during a particular period of time? Is there any search to find out whether indexer queues were blocked at a particular period of time? With Distributed ... by kteng2024 Path Finder in Splunk Search 02-17-2017 0 2	0	2
How to get my eval statement to output a certain value, even if there is no result for a certain field? Hello, Here's my search string: index=myindex host=server1 source=mysource \| multikv \| search Process=process1 OR P... by lloydknight Builder in Splunk Search 02-17-2017 0 15	0	15
Can I add REST search results to an in-line search that contains multi-value field? If so, how do I parse it? This is a piece of a search that I have been working on: eventtype=knoob (file_name=authorize.conf) \| eval zip1 =... by khaleihla Engager in Splunk Search 02-17-2017 0 3	0	3
Using perfmon and inputs.conf, how do we pull in data for specific processes (by name)? This is the route we are heading: [perfmon://ProcessandProcessor] object = Process.* counters = % Processor Time;ID ... by jasondell New Member in Splunk Search 02-17-2017 0 3	0	3
How to generate a search that will display successful login attempts by members of Domain Admin group? Pretty new to all this. I've got a Splunk 6.5.1 environment gathering data from Windows servers/desktops and Active ... by scottwhittier New Member in Splunk Search 02-17-2017 0 3	0	3
search broken in splunk 6.5 This probably is partially covered by https://docs.splunk.com/Documentation/Splunk/6.5.2/ReleaseNotes/Workaroundforse... by akazarov Path Finder in Splunk Search 02-17-2017 1 14	1	14
Is my search correctly using the bucket command in order to detect brute force attempts against multiple destinations? I have the following search and I'm not certain it's producing the correct results. The idea is to use it to detect b... by jacqu3sy Path Finder in Splunk Search 02-17-2017 1 9	1	9
How to split count of events based on conditions? Let's say that I have the following query: (...) \| stats count AS Foo by X I would like to split Foo based on cond... by Yaichael Communicator in Splunk Search 02-17-2017 0 7	0	7