Splunk Search

Community Activity

How do I use results from a search in my custom command? I'm trying to use data from a search in a custom command. source \| scrapy url=uri This gives me the following erro... by sjoerdcopier Explorer in Splunk Search 08-04-2016 1 4	1	4
How do I write a search to filter out certain values for a field? Hey Fellow Splunkers I have an issue when searching for similar events that are only unique by one character. Exam... by asarran Path Finder in Splunk Search 08-04-2016 0 3	0	3
Using "stats count by" after "case eval", why am I not getting any results? Hello, I'm trying to change a value of a field using eval case then do a stats count based on that field. I'm getti... by tungntran Explorer in Splunk Search 08-04-2016 0 2	0	2
How to create an alert to trigger based on a current value, and if that value increases over a threshold within a set time? I want to alert based off a current value and if that value increases over a threshold within a set time. I want to ... by sbattista09 Contributor in Splunk Search 08-04-2016 0 4	0	4
How to rename a field name with curly braces to compare it to a field in a lookup? How can I rename a field name with curly braces attached to it e.g. cxy{} and then compare to a field within a looku... by ashishlal82 Explorer in Splunk Search 08-04-2016 0 1	0	1
How to search and trigger an alert if the same value repeats more than once in a certain field for that particular event? For example: :Report=99,10,99 In this case value 99 occurred twice in this field, so I need to pick this event and... by duraij Explorer in Splunk Search 08-04-2016 0 2	0	2
How to find events which have a certain field which occurs more than once? I have some events which have a field which is named variable. So the event will be like.. field1="a" field2="b" var... by jesabs Engager in Splunk Search 08-04-2016 0 2	0	2
How to edit my regular expression to extract values from a logfile that begin with "FNR" and are 10 alphanumeric characters long? I'm trying to use a regular expression to grab words out of a logfile that begin with "FNR" and are exactly 10 alphan... by Lucas_Henry_ New Member in Splunk Search 08-04-2016 0 2	0	2
How to have lookup iplocation fields added to all events at index time? I would like to have iplocation fields added to all events when they're ingested and have verified the lookup works i... by dmcbray New Member in Splunk Search 08-04-2016 0 3	0	3
How to convert epoch timestamp to readable date format? Hi, I am browsing information on one of our ticketing server databases, however, when I try to show table contents, ... by tattoostreet Engager in Splunk Search 08-04-2016 1 5	1	5
Converting String to date I am trying to convert the string "08/04/16 09:40:41.690" to a date in splunk. I think that I am supposed to use some... by SAPrabhakar Explorer in Splunk Search 08-04-2016 0 2	0	2
How to retain a column after an append Hi guys, I'm really new to Splunk, and probably have no idea what's actually going on with my search, so please bear... by mjbaig New Member in Splunk Search 08-04-2016 0 5	0	5
How do I edit my XML to drill down from a table to a timechart? Hi, First time doing drill downs, so pardon the newbie question. I'm having a tough time grasping the drilldown c... by dbcase Motivator in Splunk Search 08-04-2016 0 14	0	14
How do I extract a number from the raw message How do I extract the following which always occurs as the last part of the raw text in message e.g "Took 13983.1468ms... by JeffCr Explorer in Splunk Search 08-04-2016 0 11	0	11
Disable drilldown to search window / Stopping a user from using the Splunk Query window In previous version of the Splunk one could goto the Edit Icon in each page and could Disable/Enable the drilldown ... by smhsplunk Communicator in Splunk Search 08-04-2016 0 2	0	2
Help debugging job inspector data When i run search: index=my_summary sourcetype=stash ip=13.13.137.13 \| head 5 Job inspector's "normalizedSearch" as ... by gesman Communicator in Splunk Search 08-04-2016 0 1	0	1
How to optimize a search for a non-prefixed wildcard (field=*suffix)? I have data which contain a field with a lot of values and has duplicates on almost every one - a barcode, scanned in... by arkadyz1 Builder in Splunk Search 08-04-2016 0 7	0	7
Why is my search not producing an average in the resulting stats table? Hello Splunk Ninjas I'm trying to create a SPL query that displays the avg and max response time. When I run my sea... by dcascione Explorer in Splunk Search 08-04-2016 0 7	0	7
How can I use iplocation to include the IP in my alert search results for account lockouts? I have a search to alert on account lockouts: index=winsec EventCodeDescription="A user account was locked out"\|dedu... by Gayathirik Path Finder in Splunk Search 08-04-2016 1 4	1	4
How can I make use of a search string and token to display text in panels? I am developing a dashboard to analyze users logs from an email application. The dashboard has a Time (Time Picker) a... by niftynicholas New Member in Splunk Search 08-04-2016 0 4	0	4
i am looking for a particular string match in a log file. whenever it sees the String it should alert me with an email. Kindly help me with crontab schedule and Trigger Conditions. Am confused in that part. If string matches what should ... by priyankamundarg Explorer in Splunk Search 08-04-2016 0 2	0	2
Filter logs by thread name and display in table Hi, I am new to splunk and know the basics of search. Below is how my logs looks like. 2016-08-03 23:51:00,607 INFO ... by splunksridhar New Member in Splunk Search 08-04-2016 0 2	0	2
Simple eval + stats count by 2 fields not working What am I doing wrong? I've tried several iterations of the following all which return 2 columns with a count of 0: ... by the_wolverine Champion in Splunk Search 08-04-2016 2 4	2	4
Rex for a field with varying number of values I have some values in a fied which are email addresses. eg: Values of F may be "[""email_type2@gmail.com""]" "[""ema... by BinnyK Explorer in Splunk Search 08-04-2016 0 5	0	5
Why is my current stats search not producing any results? Hi, Can anyone tell me why this comment is not working? I have all the mentioned fields in my data, but when I add s... by syed_star357 New Member in Splunk Search 08-04-2016 0 4	0	4

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...

Splunk Search

How do I use results from a search in my custom command?

How do I write a search to filter out certain values for a field?

Using "stats count by" after "case eval", why am I not getting any results?

How to create an alert to trigger based on a current value, and if that value increases over a threshold within a set time?

How to rename a field name with curly braces to compare it to a field in a lookup?

How to search and trigger an alert if the same value repeats more than once in a certain field for that particular event?

How to find events which have a certain field which occurs more than once?

How to edit my regular expression to extract values from a logfile that begin with "FNR" and are 10 alphanumeric characters long?

How to have lookup iplocation fields added to all events at index time?

How to convert epoch timestamp to readable date format?

Converting String to date

How to retain a column after an append

How do I edit my XML to drill down from a table to a timechart?

How do I extract a number from the raw message

Disable drilldown to search window / Stopping a user from using the Splunk Query window

Help debugging job inspector data

How to optimize a search for a non-prefixed wildcard (field=*suffix)?

Why is my search not producing an average in the resulting stats table?

How can I use iplocation to include the IP in my alert search results for account lockouts?

How can I make use of a search string and token to display text in panels?

i am looking for a particular string match in a log file. whenever it sees the String it should alert me with an email.

Filter logs by thread name and display in table

Simple eval + stats count by 2 fields not working

Rex for a field with varying number of values

Why is my current stats search not producing any results?

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

What’s New in Splunk AI: Volume 02

Value Insights: Now Generally Available in the CMC

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation