Splunk Search

Community Activity

How to use the C# SDK to return a large search result set (5,000,000 rows)? Hi I have a "Saved Report" (Named- GetIP), which finds unique IP passed through firewall for th Last 30 days. It rep... by pateld Explorer in Splunk Search 09-16-2016 0 2	0	2
Remove duplicate values from a multivalue field I have an mvfield like contract="C53124 C53124 C67943" and I want to end up with unique values like contract="C53124 ... by systemjack Explorer in Splunk Search 09-16-2016 1 7	1	7
What command should I use to get the average of my entries by hour? Hi I am new to Splunk so this little operation that would be simple in SQL seems to be real puzzling to me. I get c... by nelli_ Engager in Splunk Search 09-16-2016 0 2	0	2
Lookups to files larger than max_memtable_bytes report file only contains a header row With Splunk v5 and v6, I have not been able to get lookups to work with CSV files that are larger than max_memtable_b... by joebensimo Path Finder in Splunk Search 09-16-2016 3 4	3	4
How to display the result in a graph format with timechart as y-axis and field_1, field_2 on x-axis? The following were some events :- [30706/3663031152][Mon Sep 05 2016 03:55:01][CServer.efpp:4719][INFO][sm-Server-34... by pavanae Builder in Splunk Search 09-16-2016 0 2	0	2
Why am I unable to find a summary index in search when using index=summary? I have a saved search in the default summary index and when I use the index=summary in my search box, I cannot find t... by ashishlal82 Explorer in Splunk Search 09-16-2016 0 2	0	2
Why am I getting strange results with the fillnull command when I input a lookup table? I have a search that looks like: multisearch [search a] [search b] \| table field1, field2, field3 \| fillnull value="... by responsys_cm Builder in Splunk Search 09-16-2016 0 1	0	1
How to multiply the x-axis values by the y-axis values and display the result on the y-axis in the chart? I got a project where I have a csv file with one particular field. Each bar ranges from 200-700 in value. I need to... by nitro345 New Member in Splunk Search 09-15-2016 0 9	0	9
Not able to use Fields, Rename, Table command after Fieldformat command Hi, I am trying to convert some values with combination of Alphabets, Special Characters and numbers but still want ... by ashish9433 Communicator in Splunk Search 09-15-2016 0 9	0	9
How do I pass multiple values from a chart as input into another chart? Hi, I have a chart the displays the performance of all servers. When the user clicks two of the servers, I want th... by namritha Path Finder in Splunk Search 09-15-2016 0 10	0	10
How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen? Hi, I want the time span in a search to adjust based upon the time picker value. i.e. time picker is day, then sp... by praspai Path Finder in Splunk Search 09-15-2016 0 8	0	8
How to search the duration between the time a user logged in to a host and the time another user logged in to the same host? I'm having a hard time wrapping my head around this, and after a few false-starts, I'm hoping the community can point... by swannie New Member in Splunk Search 09-15-2016 0 4	0	4
How do I construct a regular expression with wildcard matching? Hi, I have data that looks like this ####<Sep 15, 2016 9:35:27 AM CDT> <Debug> <ucontrol> <betamax-cpe1> <managedSe... by dbcase Motivator in Splunk Search 09-15-2016 0 6	0	6
Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both? When running a search against a weblog, and attempting to "\|timechart span=1h limit=0 count by queryname" for 24hrs, ... by mikelanghorst Motivator in Splunk Search 09-15-2016 1 2	1	2
Why is fieldformat not working if I don't include a certain value in the table? here is my search, I'm trying to create a report that shows the error count, error percentage, and total transaction ... by danoconnl Explorer in Splunk Search 09-15-2016 0 1	0	1
Splunk eval not working with generated column Need some help on some Splunk Search Syntax. \| inputlookup defect__kvs \| search (week_date="") (type="") (sub_type=... by timcolpo Explorer in Splunk Search 09-15-2016 0 2	0	2
Compare two search results' differences over time First timer here - hi all and thanks for this amazing ressource. I am trying to timechart the counts for unique and... by thdose New Member in Splunk Search 09-15-2016 0 6	0	6
How can I show the time of the last event in a stats by count table? I have a table that shows the host name, IP address, Virus Signature, and Total Count of events for a given period of... by draracle Engager in Splunk Search 09-15-2016 0 2	0	2
Using summary index data to compare event count between different days I'm using a cool search I found on Answers to compare the event count from yesterday to the same day last week for ou... by capilarity Path Finder in Splunk Search 09-15-2016 0 2	0	2
What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup? Both list() and values() return distinct values of an MV field. Although list() claims to return the values in the or... by twinspop Influencer in Splunk Search 09-14-2016 0 7	0	7
How do I write a search to find the top 10 max by field? I am attempting to get a listing of the max top 10 by a field. I am able to get the the top 10 by doing this: [sea... by SAPrabhakar Explorer in Splunk Search 09-14-2016 0 3	0	3
How do I construct a search for the average per day of the week, with my day of the week starting on Sunday? I am trying to chart the average per day of the week (mon, tue, wed, etc) but unable to do it with the days arranged... by christopheryu Communicator in Splunk Search 09-14-2016 0 3	0	3
estdc usage I have this snippet of a search query, and I have a question. estdc(Purchase_History.Lavender_Paint) as Project1_cou... by Justin1224 Communicator in Splunk Search 09-14-2016 0 6	0	6
How do I group similar URLs into one event? I am doing a search to get the total count of different URIs and their response times. My result has multiple events ... by deeps1984 New Member in Splunk Search 09-14-2016 0 3	0	3
How do I write a regular expression to extract 2 fields from my sample data? So I have a search that will check if two variables equal a specific number, and then I get the count of these instan... by JoshuaJohn Contributor in Splunk Search 09-14-2016 0 4	0	4

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

How to use the C# SDK to return a large search result set (5,000,000 rows)?

Remove duplicate values from a multivalue field

What command should I use to get the average of my entries by hour?

Lookups to files larger than max_memtable_bytes report file only contains a header row

How to display the result in a graph format with timechart as y-axis and field_1, field_2 on x-axis?

Why am I unable to find a summary index in search when using index=summary?

Why am I getting strange results with the fillnull command when I input a lookup table?

How to multiply the x-axis values by the y-axis values and display the result on the y-axis in the chart?

Not able to use Fields, Rename, Table command after Fieldformat command

How do I pass multiple values from a chart as input into another chart?

How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

How to search the duration between the time a user logged in to a host and the time another user logged in to the same host?

How do I construct a regular expression with wildcard matching?

Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both?

Why is fieldformat not working if I don't include a certain value in the table?

Splunk eval not working with generated column

Compare two search results' differences over time

How can I show the time of the last event in a stats by count table?

Using summary index data to compare event count between different days

What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

How do I write a search to find the top 10 max by field?

How do I construct a search for the average per day of the week, with my day of the week starting on Sunday?

estdc usage

How do I group similar URLs into one event?

How do I write a regular expression to extract 2 fields from my sample data?

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation