Splunk Search

Community Activity

	Map command returning limited results I am running a query that uses the map command to take the values of one search for use in another (in my case Policy... by ahogbin Communicator in Splunk Search 09-01-2016 0 8	0	8
	I have a folder with 301 .log files, but why are 303 files shown when I add it, and searching the index only shows 27 files as events? I have a folder with 301 .log files. 1) When I add this folder, the number of files shown is 303. Why? 2) When I se... by ybiyani New Member in Splunk Search 09-01-2016 0 16	0	16
	How to write a regular expression to extract this 3 digit number from my sample events? I have these statements I am trying to extract the "200" from, but this number could be any three digit number though... by JoshuaJohn Contributor in Splunk Search 09-01-2016 0 3	0	3
	Why is the map command in my search no longer returning results? Hi, I would like to get the values of an event that matches a median value of that event. My search is something li... by kallisrayar1986 Path Finder in Splunk Search 09-01-2016 0 2	0	2
	How to use the "Pattern" tab in Splunk? Hi All, I want to do text analytics in my data and I am thinking of using the "Pattern" tab for that. Actually, I ha... by pgadhari Builder in Splunk Search 09-01-2016 0 2	0	2
	Why is my search producing error "The eval expression has no fields: 'round(on/total*100)'"? Hey people, I have a simple search I can't get to work. I've tried to look up solutions, but couldn't find anything ... by singhh4 Path Finder in Splunk Search 09-01-2016 0 2	0	2
	How to create a drilldown on a timechart that, when clicked, opens another tab in the browser to view event details? Hi, I have a table that displays various data. If I click on a field in that table, it displays a panel that has a ... by dbcase Motivator in Splunk Search 09-01-2016 0 4	0	4
	How to edit my search to reformat columns to rows and rows to columns for my resulting table? Hi, I have this search below, which produces results, but need to format these in a report. index=imdc_w sourcetyp... by splunker9999 Path Finder in Splunk Search 09-01-2016 0 4	0	4
	How to edit my search to sort by date, time, and user? Hi Splunk Answers! I'm new to Splunk. I am trying to create a statistics table that shows our VPN users, their faile... by HCadmins Communicator in Splunk Search 09-01-2016 0 9	0	9
	Replaceing NULL string for null() Hi, I'm trying to reuse an old app for a new environment and, of course, data and fields similar but different, so a... by jdanij Path Finder in Splunk Search 09-01-2016 0 11	0	11
	How to extract a URL from a text string and assign it to a variable in Splunk? I cannot find a working example of this anywhere. I can find examples a mile long on google, but am having trouble a... by Cuyose Builder in Splunk Search 09-01-2016 0 4	0	4
	How to capture the date from my sample inputlookup CSV file? I have a CSV that has the setup as shown below. Date \|Score 1/1/2016 \| 4.3 2/1/2016 \| 5.7 I need to extract t... by trevorQmulos New Member in Splunk Search 09-01-2016 0 2	0	2
	Backfill without app name Hi, Is it possible to use a backfill script without the need of pointing to an app name? EG - ./splunk cmd python f... by mwdbhyat Builder in Splunk Search 09-01-2016 0 1	0	1
	Extreme search In extreme search, i would like to know what this statement means and how it is derived by Splunk "xwhere count from... by Meena_0627 New Member in Splunk Search 09-01-2016 0 1	0	1
	How to chart the count of requests to a website with the website's shannon value (ut_shannon)? Dear Team, I am trying to build a chart like this: - x-axis is the website name - y-axis is the number of request... by phudinhha Explorer in Splunk Search 09-01-2016 0 3	0	3
	I need to write a query to find the sum of same field in same index but with different condition. I have tried the below query,it works fine,but its complicated, Can anyone suggest a better way to write the same que... by nivethainspire_ Explorer in Splunk Search 09-01-2016 0 1	0	1
	Why am I getting "No results found." for any search, even if the events counter increases? Hello, I'm getting "No results found." whenever I search for any term in splunk. I have 29,123,099 Events INDEXED a... by mabdelfattah New Member in Splunk Search 09-01-2016 0 18	0	18
	RegEx - When find a match get full line. So when I get an error with the message "(Failed)" i want the line to be added to an extracted field as a value. 9:0... by arrowecssupport Communicator in Splunk Search 09-01-2016 0 21	0	21
	How to write a search to identify periods with no events in historical data? Hi, Splunkers! I have log where some different events (event A, event B, event C...) are expected to be generated pe... by evelenke Contributor in Splunk Search 09-01-2016 0 2	0	2
	Remove duplicate values with same data I am attempting to remove duplicate occurrences from a results table. What I have ID 1 NewBusiness $123 ID 1 NewBusi... by ahogbin Communicator in Splunk Search 08-31-2016 0 4	0	4
	How to compare last value with the second last value? Say I have a column with 5 records in it 88 22 67 44 55 I want to compare the last record 55 with that of second las... by ariyazudeen New Member in Splunk Search 08-31-2016 0 4	0	4
	regex to avoid the 2016-MM-DD events in a splunk search? The following were some of the events html tags 2016-04-21 09:42:38,574 DEBUG lksjfd laskdfj lskfj alsdkfj htmlta... by pavanae Builder in Splunk Search 08-31-2016 0 10	0	10
	Why is clustered indexers duplicating non-load balanced data? When I run a simple query "index=syslog update sourcetype=fgt_event devname=xxxxx", it returns duplicate (2) events... by scottrunyon Contributor in Splunk Search 08-31-2016 0 5	0	5
	Why are 0 and null values specifically accounted for by the search macro dmc_licensing_base_usage ? The macro consists of this code: index=_internal source=*license_usage.log type="Usage" \| eval h=if(len(h)=0 OR isnu... by lycollicott Motivator in Splunk Search 08-31-2016 0 1	0	1
	How to extract multivalue field values without using the mvexpand command? I would like to extract the key=value pairs found in a multivalue field, but without doing mvexpand mvfield. Note: t... by lpolo Motivator in Splunk Search 08-31-2016 0 3	0	3

Get Updates on the Splunk Community!

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

Splunk Search

Map command returning limited results

I have a folder with 301 .log files, but why are 303 files shown when I add it, and searching the index only shows 27 files as events?

How to write a regular expression to extract this 3 digit number from my sample events?

Why is the map command in my search no longer returning results?

How to use the "Pattern" tab in Splunk?

Why is my search producing error "The eval expression has no fields: 'round(on/total*100)'"?

How to create a drilldown on a timechart that, when clicked, opens another tab in the browser to view event details?

How to edit my search to reformat columns to rows and rows to columns for my resulting table?

How to edit my search to sort by date, time, and user?

Replaceing NULL string for null()

How to extract a URL from a text string and assign it to a variable in Splunk?

How to capture the date from my sample inputlookup CSV file?

Backfill without app name

Extreme search

How to chart the count of requests to a website with the website's shannon value (ut_shannon)?

I need to write a query to find the sum of same field in same index but with different condition.

Why am I getting "No results found." for any search, even if the events counter increases?

RegEx - When find a match get full line.

How to write a search to identify periods with no events in historical data?

Remove duplicate values with same data

How to compare last value with the second last value?

regex to avoid the 2016-MM-DD events in a splunk search?

Why is clustered indexers duplicating non-load balanced data?

Why are 0 and null values specifically accounted for by the search macro dmc_licensing_base_usage ?

How to extract multivalue field values without using the mvexpand command?

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

Monitoring AI Agents with Splunk Observability Cloud

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation