Splunk Search

Community Activity

How to develop one search that will obtain results from logs from different sourcetypes? I have Ex: Search query 1: I have one type of log, it contains Roll Number, Date of Joining, Class and etc Search ... by venkateshc Engager in Splunk Search 11-27-2016 0 2	0	2
Is it possible to create a multivalue visualization for each value of a grouped field? Hello, I am trying to create a variable sized visualization based on the value of a field grouped by another field. ... by andrewtrobec Motivator in Splunk Search 11-27-2016 0 6	0	6
How do I display negative values through geostats? Hello, I'm busy mapping temperatures for locations around the world and in some cases the value is negative. Unfort... by andrewtrobec Motivator in Splunk Search 11-27-2016 0 9	0	9
How to have my summary index only index on the calculated value? I have a sourcetype that has a tremendous amount of data - we use this data to calculate an overall number of calls p... by burras Communicator in Splunk Search 11-27-2016 0 6	0	6
Want latest weeks data in every month in a monthly chart Below is my requirement. I have weekly data for 24 weeks ( 6 months) , I want to get data of last month in every we... by prathikpisplunk Explorer in Splunk Search 11-26-2016 0 2	0	2
How do I extract numerical value from within a string using rex command? Hello, I've been reading up on the rex command and using it to split strings, but I cannot for the life of me get it... by andrewtrobec Motivator in Splunk Search 11-26-2016 0 2	0	2
How can I get the latest event by a specific field? Hello, I have the following event data: City,Date,Temp,Sky New York,2016-11-10,20,Clear New York,2016-11-10-19,Clou... by andrewtrobec Motivator in Splunk Search 11-26-2016 5 9	5	9
How to build a search that shows the uptime of Splunk and the host reporting to Splunk? I am required to build a search which will show the uptime of all my Splunk components over a period of one month. Al... by himapate Explorer in Splunk Search 11-26-2016 0 1	0	1
Is there any way to do stats count over multiple time frames? Is there any way to do stats count over multiple time frames? I am trying to replace something written in perl and o... by peiffer Path Finder in Splunk Search 11-26-2016 0 5	0	5
How to extract multiple sets of fields from one sourcetype I'm currently forwarding data from a pfSense Firewall in our Splunk Light instance. This works pretty well and I defi... by davidb89 Engager in Splunk Search 11-26-2016 0 1	0	1
How to trim off the last 7 characters from a field? Hi, I have a field with fields as below: name -------- abcd - xyz cdef - xyz adfeq - xyz I want to trim "- xyz" f... by surekhasplunk Communicator in Splunk Search 11-25-2016 0 3	0	3
How to retrieve information behind java.lang using rex? Hi, I am trying to retrieve the information behind the value "at java.lang. ..." I tried the following command but ... by SebBNP Engager in Splunk Search 11-25-2016 0 3	0	3
How to limit the number of result lines from stats Hi! I have some data from which I would like a summary report with only the most active clients in the list. The sea... by kaurinko Communicator in Splunk Search 11-25-2016 1 2	1	2
How many custom shapes does choropleth map support? http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/ Use Custom Polygons in Choropleth Map... by hylam Contributor in Splunk Search 11-25-2016 0 10	0	10
Analysis on splunk users Analysis on splunk users, for this i need to display _time host user total_run_time searchQueryUsed Ur... by sravankaripe Communicator in Splunk Search 11-25-2016 0 7	0	7
How to edit my search to calculate values inside JsonArray Hi *, I have some trouble with Splunk stats functions :). I have a JSONArray event like this and I need to sum all c... by georg_koch Engager in Splunk Search 11-25-2016 0 1	0	1
How can I optimize my search? This search is taking too much time to execute, around 20 mins. Is it because of the lookup? index="access_log_index... by Deepali529 Explorer in Splunk Search 11-25-2016 0 4	0	4
Search Job inspector - dispatch.fetch slow - why? I'm working on tracking down some slowness in searches of all types that I am doing. Looking at the search inspector... by cpenkert Path Finder in Splunk Search 11-25-2016 5 4	5	4
Calculate Difference between two time fields in single event Hi All, Am trying to calculate difference between starttime and endtime for tasksession, both start and end time are... by kpavan Path Finder in Splunk Search 11-25-2016 0 3	0	3
How can i display dates between two dates? I have a log that has Start date=23/nov/2016 enddate=23/dec/2016.now i need to display the dates between the dates . by ajayabburi508 Path Finder in Splunk Search 11-24-2016 1 6	1	6
distinct count using stats and eval I am slowly going insane trying to figure out how to remove duplicates from an eval statement. where acc="Inc" AND S... by ahogbin Communicator in Splunk Search 11-24-2016 0 5	0	5
If you're running 6.5.0, you should disable search_optimization::predicate_merge In 6.5.0 Splunk added a bunch of search optimizations, see http://conf.splunk.com/files/2016/recordings/optimized-sea... by martin_mueller SplunkTrust in Splunk Search 11-24-2016 15 5	15	5
How to edit my search to calculate the average duration for last 7 days from the average duration of yesterday and display both? I have my following search: My Search earliest=-1d@d latest=@d \| convert ctime(_time) as Date_and_Time \| convert... by pavanae Builder in Splunk Search 11-24-2016 0 3	0	3
Modify search term before search I would like to modify my search term before I actually search for it. Background: I want to see how the MX for a cer... by Isaac_Hailperin Explorer in Splunk Search 11-24-2016 0 1	0	1
eval if clarification I have a document field that opens a document if available and it displays "no document found" if there is no documen... by bonnlbbelandres Path Finder in Splunk Search 11-24-2016 0 1	0	1