Splunk Search

Community Activity

Feedback on regex on a single string I am trying to regex to get a substring I want substring "addressON" from this string "ThisStreet_addressON_blockb" ... by smhsplunk Communicator in Splunk Search 10-19-2016 0 5	0	5
rex, Extract information between two slashes and blanks Hi, i have information like: "DESCRIPTION EMEA:GERMANY:FRANKFURT / client4711 / down" where DESCRIPTION is a field,... by fklink New Member in Splunk Search 10-19-2016 0 5	0	5
How to create a time chart of HTTP error codes as a percentage of a total using rangemap, excluding httpcode=200 from the chart? I am trying to display the percentage of a rangemap as related to the total events while excluding the httpcode=200 f... by JDukeSplunk Builder in Splunk Search 10-19-2016 0 6	0	6
Correlate multiple log sources I am new to Splunk and would really appreciate some guidance or advice on how to do the following: I have some log f... by ElliottP New Member in Splunk Search 10-19-2016 0 3	0	3
Timechart Count by with Where I'm trying to narrow down a list of spiders whose traffic is inundating our network. So far, I've gathered that the ... by wbordeau Explorer in Splunk Search 10-19-2016 0 4	0	4
Problems with rounding Having difficulty with simple rounding. index=_internal group=per_sourcetype_thruput \| eval gb=round(kb/1048576, ... by rgcox1 Communicator in Splunk Search 10-19-2016 0 5	0	5
How to want to assign a value from the output of a search to a variable that I need to use under JavaScript? I want to assign a value which comes under XML to a variable that I need to use under JavaScript. or to put it bette... by simona2121 Path Finder in Splunk Search 10-19-2016 0 3	0	3
In search, how do you extract key=value pairs from a specific field? I have events that are added to an index using the Splunk Logging Driver for Docker. I would like to extract key-valu... by kjoyner Engager in Splunk Search 10-18-2016 0 1	0	1
Need advice on a complex field extraction I have some data which are of the following format: CommonPrefix.1.name="Field1",CommonPrefix.1.type="STRING",Common... by arkadyz1 Builder in Splunk Search 10-18-2016 0 9	0	9
Is there a function to get the Count of the week in an year ? Could you please help me with the Below I have a requirement to get the week of the year and trigger the Alert only o... by prakashbhanu407 New Member in Splunk Search 10-18-2016 0 3	0	3
Creating a timeline showing when someone log out and login? Hi, I'm quite new to splunk, but I'm able to create the needed fields and make basic reports. Timelines I don't know ... by toaijala Explorer in Splunk Search 10-18-2016 1 17	1	17
what is the best addon / app to use with [iplocation] for a geographical visual dashboard? I am looking to build a map of IP locations for remote vpn logins. Does anyone have any suggestions? by packet_hunter Contributor in Splunk Search 10-18-2016 1 5	1	5
custom command logging error I've followed this tutorial: http://blogs.splunk.com/2014/04/14/building-custom-search-commands-in-python-part-i-a-si... by tombog0 Explorer in Splunk Search 10-18-2016 0 16	0	16
How to edit my rex to receive values for Start Date and End Date? Rex expression used : startDate= (?.) endDate= (?.) Data format : &startDate=10/02/2016&endDate=10/02/2016& Don... by suresh364 New Member in Splunk Search 10-18-2016 0 5	0	5
How to edit my search to calculate the difference between two timestamps in the same event? Hello, I am trying to determine the time difference between the two timeStamp columns in my events. I tried to use t... by pkurt Path Finder in Splunk Search 10-18-2016 0 6	0	6
How to update only the last row of a table lookup dynamically Hello community, I have a lookup cn two fields, _time and count per day. I need to update each time the record of th... by lufermalgo Path Finder in Splunk Search 10-18-2016 0 2	0	2
How to write a search to show events immediately before and after a certain field value changes? Hi, I'm searching through logs and I need to see the events that occur when one field value changes. Example: Http ... by dbcase Motivator in Splunk Search 10-18-2016 0 4	0	4
What alternative can be used for the join command in my search to avoid the subsearch limit? I am basically doing two searches where the results of the 1st search serves as input for the 2nd search. There are ... by christopheryu Communicator in Splunk Search 10-18-2016 1 7	1	7
Help with Regex...? I'm trying to extract the following from this regex...somehow i am not able to get the browser agent and status... s... by prakash007 Builder in Splunk Search 10-18-2016 0 6	0	6
How to create a dashboard search with the condition "If status is not success, show error code, type, and message on the same row"? I want to create a dashboard with a table listing integration name and execution status with the following condition:... by splgeek Explorer in Splunk Search 10-18-2016 0 4	0	4
I would like to use field value * as regex to match all values in my search Hello, I have dashboard with drop-down button. Token for button is named Area. Values are: Name - Value: All Areas ... by TMazurek New Member in Splunk Search 10-18-2016 0 1	0	1
How to remove clients with more than one hits? I have data in this format: client=green value=house client=yellow value=appartement client=black value=bungalow cl... by lakromani Builder in Splunk Search 10-18-2016 0 12	0	12
How to avoid displaying duplicate logs in search results? I am trying to search /var/log/messages log with keywords like shutdown or Error and storing it in message.log and d... by rajgowd1 Communicator in Splunk Search 10-18-2016 0 4	0	4
How to get all possible entries from two lookups? How to get all possible entries from two lookups? For instance, lookup_1 and lookup_2 lookup_1 application ... by splunkrocks2014 Communicator in Splunk Search 10-17-2016 1 3	1	3
How to edit my eventstats search to return a count of failed authentications greater than ten within a ten minute window? Been working on a report to show the best data on authentications failed more than ten times in a time span of 10 min... by jph11 New Member in Splunk Search 10-17-2016 0 3	0	3

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Splunk Search

Feedback on regex on a single string

rex, Extract information between two slashes and blanks

How to create a time chart of HTTP error codes as a percentage of a total using rangemap, excluding httpcode=200 from the chart?

Correlate multiple log sources

Timechart Count by with Where

Problems with rounding

How to want to assign a value from the output of a search to a variable that I need to use under JavaScript?

In search, how do you extract key=value pairs from a specific field?

Need advice on a complex field extraction

Is there a function to get the Count of the week in an year ?

Creating a timeline showing when someone log out and login?

what is the best addon / app to use with [iplocation] for a geographical visual dashboard?

custom command logging error

How to edit my rex to receive values for Start Date and End Date?

How to edit my search to calculate the difference between two timestamps in the same event?

How to update only the last row of a table lookup dynamically

How to write a search to show events immediately before and after a certain field value changes?

What alternative can be used for the join command in my search to avoid the subsearch limit?

Help with Regex...?

How to create a dashboard search with the condition "If status is not success, show error code, type, and message on the same row"?

I would like to use field value * as regex to match all values in my search

How to remove clients with more than one hits?

How to avoid displaying duplicate logs in search results?

How to get all possible entries from two lookups?

How to edit my eventstats search to return a count of failed authentications greater than ten within a ten minute window?

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Event Series: Telemetry Pipeline Management

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation