Splunk Search

Community Activity

How to search the count of all values for a field, and also display all the values in the results? I want to count all the values of a field, and display all the values as well. How do I write a search in Splunk to a... by nasamajh09 New Member in Splunk Search 10-27-2016 0 1	0	1
How to count number of events that occurred near different events Hi, I am a begginner and can't find solution for my problem. I have 3 fields: 2 from one source Characteristic ( ha... by xfiles80 New Member in Splunk Search 10-27-2016 0 7	0	7
After installing Splunk and indexing logs, we updated configurations. How do we handle field extractions before and after the update? So we got Splunk installed and started indexing our logs before changes were put in place to better integrate with Sp... by danoconnl Explorer in Splunk Search 10-27-2016 0 3	0	3
How to subtract dates from two events to find the duration? Hello Everyone, I have two events which I have uploaded in CSV format and the events will be consistent as below: ... by aamirs291 Path Finder in Splunk Search 10-27-2016 0 7	0	7
Multi-user thresholding with compared time ranges I have a group of users to monitor. They create actions on a fairly regular basis, but they do not all follow the sam... by joshualarkins Explorer in Splunk Search 10-26-2016 0 4	0	4
How to pass fields as tokens from one panel to other panels on the same dashboard? Not finding any examples so far, but not sure if it's possible. Wanting to have one dashboard panel that has a resu... by clintla Contributor in Splunk Search 10-26-2016 2 4	2	4
How to write a regular expression to match all patterns of these dynamic URLs? I have front-end events with several dynamic uri patterns. I am trying to generate a report to summarize the average,... by jagadeeshm Contributor in Splunk Search 10-26-2016 0 2	0	2
How to add a horizontal threshold line overlay in column chart? I have created a savedsearch which displays the Current license usage indexer wise. ("\|rest" query) x- axis : Indexe... by splunker12er Motivator in Splunk Search 10-26-2016 0 7	0	7
How do I extract this field from my sample data? I want to extract the PHP Message as a field so I can have all the various php error messages: 2016/10/20 21:23:18 [... by splgeek Explorer in Splunk Search 10-26-2016 0 3	0	3
How to modify my search to add the count of a particular field next to its field? I have a search as follows My search \| bin span=1h _time \| stats values(field_1) as Field_1 by _time Field_2 Which... by pavanae Builder in Splunk Search 10-26-2016 0 1	0	1
How to loop through results of a main inputlookup and combine with a child inputlookup? hi, i have a main search- \|inputlookup wlaa_hosts.csv \| eval Host=split(HostList,",") \| stats count by Host that ... by erwin_pader_1dc New Member in Splunk Search 10-26-2016 0 2	0	2
What privileges are needed to use tstats summariesonly=t? We have accelerations turned on and at 100% for a number of our datamodels. I like the speed obtained by using \|tstat... by reed_kelly Contributor in Splunk Search 10-26-2016 1 3	1	3
dbinspect fields names and format changed in 6.* I was using dbinpect to calculates the first and last events in my buckets. In splunk 4.* and 5.*, it was returning 2... by mataharry Communicator in Splunk Search 10-26-2016 1 3	1	3
Why is the metadata command showing the wrong firstTime? \| metadata type=sourcetypes index=* My time range picker is set to today (Today is July 30, 2015). I analyzed my da... by david_halbeisen New Member in Splunk Search 10-26-2016 0 2	0	2
how to write _time function to take the data for all 7 days ( i mean in between days too ) Hi, I have scenario like having timechart to show spikes for different dates(ex for 7 days).But now it shows same va... by umsundar2015 Path Finder in Splunk Search 10-26-2016 0 5	0	5
How to edit my regular expression to extract the last IP from my sample string using rex? Hey Guys, I have the following output: Server: abc-ij-qwerty88.asdf.xyz.com Address: 10.10.254.97 DNS request timed... by bakalon Explorer in Splunk Search 10-26-2016 0 9	0	9
Few parts of JSON logs as separate fields and remaining as events Hi All, I have JSON Logs like below: SAMPLE EVENT: { [-] line: 2016-10-21 19:16:00 INFO [CollectorAccess] Updat... by sarnagar Contributor in Splunk Search 10-26-2016 0 3	0	3
the function sum(count) by xx field is not working For me the below stats sum(count) by Asset_status provies no results . eval Asset_status= if(Asset_Class=Server OR A... by umsundar2015 Path Finder in Splunk Search 10-26-2016 0 3	0	3
How to remove real-time searches from Search and Home Page UI? I would like to remove real time searches from the Home Page and Search Panel on Splunk UI. I came across someone's o... by OMohi Path Finder in Splunk Search 10-26-2016 1 3	1	3
multivalued OUTPUT field for my automatic lookup Is it possible to configure an automatic lookup to use a multivalued OUTPUT field? I should add that the lookups mat... by carmackd Communicator in Splunk Search 10-26-2016 2 7	2	7
field fillnull with values from correlated events by fedyshynyuriy New Member in Splunk Search 10-25-2016 0 3	0	3
Is sparkline adding any new information to my search results? Is sparkline adding any new information to the results of this search, or is it just presenting the same information ... by Justin1224 Communicator in Splunk Search 10-25-2016 0 3	0	3
transforms with SOURCE_KEY using FIELDS Dataset 10.24.11.102 - user1 [10/Sep/2016:02:46:12 -0400] "GET http://www.foo.org:80/lib/stone/csrf/token.json HTTP/... by willamwar Path Finder in Splunk Search 10-25-2016 0 1	0	1
How to edit my search to combine multiple rows into one output row in my results? I am taking numerous log entries and trying to produce an output report that shows the earliest logon time and the la... by szimmer661 Explorer in Splunk Search 10-25-2016 0 6	0	6
Regex Source and Destination files with path, filename, extension I need some help with this one since it is beyond my regex skills which are not the best. I would have used the fiel... by kent_farries Path Finder in Splunk Search 10-25-2016 0 6	0	6

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

How to search the count of all values for a field, and also display all the values in the results?

How to count number of events that occurred near different events

After installing Splunk and indexing logs, we updated configurations. How do we handle field extractions before and after the update?

How to subtract dates from two events to find the duration?

Multi-user thresholding with compared time ranges

How to pass fields as tokens from one panel to other panels on the same dashboard?

How to write a regular expression to match all patterns of these dynamic URLs?

How to add a horizontal threshold line overlay in column chart?

How do I extract this field from my sample data?

How to modify my search to add the count of a particular field next to its field?

How to loop through results of a main inputlookup and combine with a child inputlookup?

What privileges are needed to use tstats summariesonly=t?

dbinspect fields names and format changed in 6.*

Why is the metadata command showing the wrong firstTime?

how to write _time function to take the data for all 7 days ( i mean in between days too )

How to edit my regular expression to extract the last IP from my sample string using rex?

Few parts of JSON logs as separate fields and remaining as events

the function sum(count) by xx field is not working

How to remove real-time searches from Search and Home Page UI?

multivalued OUTPUT field for my automatic lookup

field fillnull with values from correlated events

Is sparkline adding any new information to my search results?

transforms with SOURCE_KEY using FIELDS

How to edit my search to combine multiple rows into one output row in my results?

Regex Source and Destination files with path, filename, extension

Splunk Auto Ingestion Parallel Pipeline Scaling

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation