Splunk Search

Community Activity

Need help with Dedup while extracting fields Base String is ----------------- OfferRedeemedRequest [partnerID=1234, partnerName=MCenter, messagePriority=9, userI... by arunsubram Explorer in Splunk Search 10-01-2016 0 1	0	1
Searching "%" with in a search string My logfile contains a rows like - ...........&pic=pic%231.pdf&description=....... ...........&pic=pic.pdf&descriptio... by runiyal Path Finder in Splunk Search 10-01-2016 0 5	0	5
How to edit my subsearch to look up a predefined field comprised of rex in my main search? My subsearch contains this predefined field, and I'm trying to use it to search my main search that gets the field us... by jjmel Explorer in Splunk Search 09-30-2016 0 2	0	2
How to pull data into Splunk from Simple Event Correlator (SEC)? All, We need to pull data from a platform called "SEC", Simple Event Correlator into Splunk. Any one familiar with... by daniel333 Builder in Splunk Search 09-30-2016 0 1	0	1
Why would data show up in _raw but not in search results after SEDCMD? Hi there, I have several multivalue fields that are sometimes uneven. To make up for this, I'm trying to use SEDCMD t... by danfein New Member in Splunk Search 09-30-2016 0 5	0	5
How to force all x-axis labels to display on a timechart? Hello. I am trying to create a dashboard with a simple timechart showing the number of log entries per day. I am int... by jeffland SplunkTrust in Splunk Search 09-30-2016 1 10	1	10
How to graph a (non-cumulative) total of fields? If I have a number of storage devices, each with a number of volumes, and every hour I am querying the used capacity ... by lee_melvin Path Finder in Splunk Search 09-30-2016 0 4	0	4
Is there a way to extract/show the first and last events in a transaction? I have a transaction query that returns groups of logs that are typically 5-10 events clumped together. The query us... by DEAD_BEEF Builder in Splunk Search 09-30-2016 1 8	1	8
Can I with one search, graph two different time chart spans? I have a simple search only to count the events per timelapse. I am trying to graph that in only one graph with two ... by omarlira Explorer in Splunk Search 09-30-2016 0 5	0	5
eval and coalesce return unicode list. How to separate each item into a new row? So when I run the following search, 'event_name' returns a list of all event_name values which match the coalesce(src... by zhatsispgx Path Finder in Splunk Search 09-30-2016 1 1	1	1
How to match my search with a lookup? Hi I want to match the search with lookup file. I have a lookup with host names. i have to match with windows data ... by kiran331 Builder in Splunk Search 09-30-2016 0 4	0	4
How do I rename and extract multiple data from a search? I have log lines of the form (relevant excerpt only, they contain also hostname, timestamp, etc): data_name: A B C D... by virgilg Explorer in Splunk Search 09-30-2016 0 1	0	1
Join two queries by nearby event times Hi, can't seem to get what I'm looking for working. Here is what I want to do. Issue a main search of events. Find e... by chrisboy68 Contributor in Splunk Search 09-30-2016 1 5	1	5
CSV Lookup not matching double quotes I have created a csv file mapping a field from my raw index to a more readable version. Some of the values for that f... by keerthana_k Communicator in Splunk Search 09-30-2016 1 2	1	2
Regex Help! How can I change the format of the filed values using regex. what it is now: 0xBCDDADAF7BSS What I need: remove 0x ... by kiran331 Builder in Splunk Search 09-30-2016 0 3	0	3
erex command not working for URL fields I am using Splunk 6.4. I am able to extract many fields from my data using erex comand. However, for URL fields, the... by Upas02 Path Finder in Splunk Search 09-30-2016 0 1	0	1
chart time based Hi , I want a chart exactly like the image attached. My data is input lookup csv file . My time filed name is "Ope... by surekhasplunk Communicator in Splunk Search 09-30-2016 1 4	1	4
pie chart color with eval condition Am using query "index=level3 host=Test \| stats count by Age \| sort Age" and visualizing it in a pie chart. Now my r... by surekhasplunk Communicator in Splunk Search 09-30-2016 0 1	0	1
Why was the maximum number of real time concurrent searches not increased? Hi fellow splunkers, I have multiple search heads on which I want to increase the maximum number of (historical and)... by DonaldvdHoogenb Path Finder in Splunk Search 09-30-2016 0 2	0	2
groupby and ends with value andcount I have one field with values xyz_onprem abc_onprem gghf_onprem abc_aws gfd_aws I want to see the count of values end... by chvnc Explorer in Splunk Search 09-30-2016 0 2	0	2
What is the rex command to extract the last value from a source field? Hi .. I need to extract back123 from the source field. pls provide the entire rex command needed to fetch back123 to ... by simona2121 Path Finder in Splunk Search 09-29-2016 0 7	0	7
How to display search DEBUG messages in Job Inspector UI? Looking to how to enable the message block starting with "The following messages were returned by the search subsyste... by tsunamii Path Finder in Splunk Search 09-29-2016 3 4	3	4
How to develop a table based on my CSV log format? I have the following log format and I'm trying to create a table that will have the following format: "Device","Obje... by balleste Engager in Splunk Search 09-29-2016 0 2	0	2
AND \| OR Rex field Hello. I have a few servers: a,b,c and 1,2,3 Servers a,b,c work with this - base search \| rex field=cs_uri_stem "... by patelpin New Member in Splunk Search 09-29-2016 0 6	0	6
Making a where statement that checks run time? I have this query index=nitro_prod earliest=-30d ESK** (job_class=* OR NOT job_class=) compl_code= \| fields app_... by JoshuaJohn Contributor in Splunk Search 09-29-2016 0 1	0	1