Splunk Search

Community Activity

How do I delete previously loaded data before new data is indexed in Splunk? Hi I am using SQL Source as my Data Source. I have written a Select query which loads data in the Database every 5 ... by shivendra_infy Path Finder in Splunk Search 12-03-2016 0 3	0	3
Searching and adding values in stats counter I have a logfile looking like this; some long text at the start of the logline which, Read: 950 Imported: 800 Failed... by jhusum Engager in Splunk Search 12-03-2016 0 3	0	3
How to dynamically put formulas in my table column? This is my search: timechart span=mon max(c117492014) as "attached" \| eval lic=180000 \| eval forecast = "" \| eval ... by HattrickNZ Motivator in Splunk Search 12-03-2016 0 2	0	2
How to create a timechart that drills down to a table with relevant data when I click a data point or select a time range in the chart? How to add a click and selection event to a timechart like using Javascript in Web Development? Is there anyone who k... by wencheng199999 Explorer in Splunk Search 12-03-2016 0 7	0	7
How to edit my search to compare and find the difference between EventCode counts? I want to take this search and compare it against a "known good day". index="wineventlog" AND host=$computerMS$ \| to... by tmontney Builder in Splunk Search 12-02-2016 0 10	0	10
Why does the number of user leads not match the download count on my app's page on Splunkbase? I have a list of contacts from the user leads I downloaded for my app. Why does the number of contacts not match the ... by wnguyen Splunk Employee in Splunk Search 12-02-2016 0 1	0	1
How to edit my search to make a table containing content from myField= until end of the line? I have a log file where the last field contains space separated values and I would like to create a table containing ... by viggor Path Finder in Splunk Search 12-02-2016 0 5	0	5
To run Z-score search against email logs, do I need to use summary index or can I get the avg count and then perform a Z-score analysis? I'd like to run some Z-score searches against my email logs, specifically to see outliers that send traffic above the... by jwalzerpitt Influencer in Splunk Search 12-02-2016 0 3	0	3
How to search an index for a hostname using an IP address that was generated from results of a search of a different index? I have a search in index1 that give me ip_addresses but no host name. I want to search another index, index2, for the... by srikrame New Member in Splunk Search 12-02-2016 0 3	0	3
How to edit my search to use a macro to return an integer being fed a single argument being supplied as an eval variable? Tried doing this via the Splunk docs and the macro is not being processed. My example ... My macro is named wordwe... by bensinger New Member in Splunk Search 12-02-2016 0 3	0	3
How to combine my searches to be able to use lookup in an eval statement? I'm having trouble with a search and I'm banging my head against the wall. I feel like I'm on the right track but ju... by arichardson Engager in Splunk Search 12-02-2016 0 2	0	2
How to generate a chart that will display counts of distinct values by build? We are trying to do some charting that requires counts of distinct values per build. input would be build\|result 12... by shawny2005 Path Finder in Splunk Search 12-02-2016 0 4	0	4
How do I extract the string which contains time from my data, convert it to milliseconds, and display in a chart? I have data like below which contains time taken for service call in regular string format. Sample Data : Time Take... by janibhasha New Member in Splunk Search 12-02-2016 0 2	0	2
How to join search results without using join command? I have this situation: Table1 Id Field1 Field2 Field3 Table2 Id FieldA FieldB I need this result: Id Field1 Fiel... by usersplunktest New Member in Splunk Search 12-02-2016 0 2	0	2
Stats as Percentages Of Total Hi, I have a search like this: search... \| fields + user, country\| stats dc(user) AS Users by country \| sort - User... by HeinzWaescher Motivator in Splunk Search 12-02-2016 0 6	0	6
How do I extract the field "NAME" from my data? how do I extract the fourth field (NAME) from the following? I am very new to Splunk and regular expression. Failed... by gurpurspai New Member in Splunk Search 12-02-2016 0 3	0	3
how to filter out columns in a chart after using a lookup and addtotals I lost all my previous text because I accidentally navigated away from the page so I'll be brief here. I'm using 6.4.... by _jgpm_ Communicator in Splunk Search 12-02-2016 0 2	0	2
How to edit my search to find all source_value_id fields where the d value is less than zero? When running this command: "low_seq=" "source_session_id" "-1177" \| stats by _time,source_session_id,low_seq \| delta... by msehic Explorer in Splunk Search 12-02-2016 0 1	0	1
How to set all column names to capital letters Hello dear Splunkers, Any idea how to set column names to uppercase/capital letters? I'm not talking about all the ... by DavidHourani Super Champion in Splunk Search 12-02-2016 0 4	0	4
Is my search syntax for finding top 10 URLs visited by user correct? Hello Everyone, I am running a search to find out the top 10 URLs visited by a single user: index=ciscoasa user=""... by bagarwal Path Finder in Splunk Search 12-02-2016 0 1	0	1
How to write a search to merge and display data from two events in a single line? Hello, I would like to merge two events with a search to display both events' data in single line. Refer the below e... by ravinallaparedd New Member in Splunk Search 12-02-2016 0 2	0	2
How to split a multivalue field for a data model/pivot table to treat each field value separately? I have a field states, which is delimited by \|. For example states=NY\|VA\|MO\|GA I'm able to get it to expand and treat... by spammenot66 Contributor in Splunk Search 12-02-2016 0 1	0	1
Counting multi-value fields from data I have the following data: 10..20.10.100 - - [11Nov/2011:13:21:16 -0500] "GET /portlets/market_info.json?ID_STUFF=32... by tgow Splunk Employee in Splunk Search 12-02-2016 1 4	1	4
Why is there a space added to my field extracted with rex? Hi I have the following rex to test a new field extraction: \|rex "(?s)<Sql_Text>(((?<a_action>.*)))</Sql_Text>" ... by dkeck Influencer in Splunk Search 12-01-2016 0 10	0	10
How to create a field extraction for a field that contains multiple values? Hi I have the following event record. I need to create a field extraction on field called openports that is having ... by mohammed7860 Explorer in Splunk Search 12-01-2016 0 2	0	2

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Search

How do I delete previously loaded data before new data is indexed in Splunk?

Searching and adding values in stats counter

How to dynamically put formulas in my table column?

How to create a timechart that drills down to a table with relevant data when I click a data point or select a time range in the chart?

How to edit my search to compare and find the difference between EventCode counts?

Why does the number of user leads not match the download count on my app's page on Splunkbase?

How to edit my search to make a table containing content from myField= until end of the line?

To run Z-score search against email logs, do I need to use summary index or can I get the avg count and then perform a Z-score analysis?

How to search an index for a hostname using an IP address that was generated from results of a search of a different index?

How to edit my search to use a macro to return an integer being fed a single argument being supplied as an eval variable?

How to combine my searches to be able to use lookup in an eval statement?

How to generate a chart that will display counts of distinct values by build?

How do I extract the string which contains time from my data, convert it to milliseconds, and display in a chart?

How to join search results without using join command?

Stats as Percentages Of Total

How do I extract the field "NAME" from my data?

how to filter out columns in a chart after using a lookup and addtotals

How to edit my search to find all source_value_id fields where the d value is less than zero?

How to set all column names to capital letters

Is my search syntax for finding top 10 URLs visited by user correct?

How to write a search to merge and display data from two events in a single line?

How to split a multivalue field for a data model/pivot table to treat each field value separately?

Counting multi-value fields from data

Why is there a space added to my field extracted with rex?

How to create a field extraction for a field that contains multiple values?

Announcing Modern Navigation: A New Era of Splunk User Experience

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation