Splunk Search

Community Activity

How to extract a multiline "User-Agent" field from my data? S,login.test.com,HTTPS,,2016-07-27T06:41:43.000Z,,iPad,0,,login.test.com,,1469601703,NA,PROD-150607-to-as-edgenode-3,... by dongeui_hong New Member in Splunk Search 07-27-2016 0 2	0	2
inputlookup returning 0 fields Hello all, I've done this a million times, but for some reason, it's not working for me today, and I suspect it's so... by j4adam Communicator in Splunk Search 07-27-2016 0 6	0	6
How to edit my search to display a percentage in my table? What am I missing here? We have JVMs logging out to file every time there is a Garbage Collect, I'm trying to do a si... by iatwal Path Finder in Splunk Search 07-27-2016 0 5	0	5
How would I exclude events that normally occur after a restart of a server? On our Linux servers, we see that audit policies are re-applied to the audit service whenever the service is restarte... by jmaple Communicator in Splunk Search 07-27-2016 0 10	0	10
How do I get the percentage of events in a logging file Hello - I have a log file were ALL responses contain [Thread-645990] (note, the number changes for each response). ... by cj039165 New Member in Splunk Search 07-27-2016 0 8	0	8
How to search the most frequently indexed lines in Splunk? Hi, I would like to know how can we get top 10 or 20 lines which get indexed in Splunk from our log files. This is t... by raghavarora12 New Member in Splunk Search 07-27-2016 0 2	0	2
How to write a search to calculate a ratio using my sample data? Hi I'm trying to calculate the conversion rate of people going from a product page to a payment page. ie given the ... by stephenmoorhous Path Finder in Splunk Search 07-27-2016 0 4	0	4
How to extract fields from a field? Hi, I have a field defined as message_text and it has entries like the below. It also has other entries that diff... by dbcase Motivator in Splunk Search 07-27-2016 1 9	1	9
date related issue Hi, I am facing date related issue in my some of the splunk logs. Today is 26 July but it is showing timing somethin... by sunnyparmar Communicator in Splunk Search 07-27-2016 0 5	0	5
How to parse proxy information to create a list of rootlevel domains and tld? Scenario: I am trying to create a list of all the unique domains (from web requests) from the proxy. Currently I am... by packet_hunter Contributor in Splunk Search 07-27-2016 0 3	0	3
How do I show the source file and host for a search result in email alerts? I have an alert set up that will send an email to a group of individuals when we get responses from a payer with AAA*... by cj039165 New Member in Splunk Search 07-27-2016 0 2	0	2
Sum the results of searches from separate panels Hi there, I'd like to create a dashboard with 3 panels, each one containing a separate search that produces a table.... by ojasklowski Explorer in Splunk Search 07-27-2016 0 4	0	4
How do I convert this search into a tstats search leveraging the web datamodel? Here's the search: index=proxysg sourcetype=proxysg \| replace pandora with www.pandora.com in url \| replace *faceb... by jaywilwk Engager in Splunk Search 07-27-2016 0 3	0	3
X-Axis duration in hours, not seconds I am using the following search to get a total VPN connection time for users: index=pan_logs eventtype=pan_system lo... by pashtet13 New Member in Splunk Search 07-27-2016 0 7	0	7
Multiple summary indexes Hi, I need to schedule daily jobs for summary indexing.. There are 6 of the same jobs (licence usage over a month(3)... by mansel_scheffel Explorer in Splunk Search 07-27-2016 0 1	0	1
How can I highlight more than 1 string without getting this error message: "The extraction failed. If you are extracting multiple fields, try removing one or more fields"? I'm trying to extract Signature Algorithm, but Splunk only recognizes the exact string(sha256WithRSAEncryption) in sa... by jenniferleenyc Engager in Splunk Search 07-27-2016 0 4	0	4
How to edit my search to compare software version numbers to find the latest version? HI, I have a field called AppVersion. The field value represents the version of a piece of software. Example AppV... by Aaron_Fogarty Path Finder in Splunk Search 07-27-2016 0 8	0	8
How to pull a value from one column based on condition on another column? I am trying to run an equivalent of the below query in splunk search, please help. SELECT CONCAT(run, '.', tag) as f... by infoneo New Member in Splunk Search 07-27-2016 0 1	0	1
How to edit my rex search to extract two different or duplicate IP addresses at the same time? Current search: search "xxx" \| rex field=_raw "api:(?\s\d+.\d+.\d+.\d+)" I'm using the rex command, but it does no... by cyberportnoc Explorer in Splunk Search 07-27-2016 0 2	0	2
how to use search result and search again for each grouped value ("conn=" AND "IP=") \| rex field=_raw "conn=(?\d+)" \| join connum [search "err=49" AND "conn" \| rex field=_raw "conn=(... by cyberportnoc Explorer in Splunk Search 07-27-2016 0 1	0	1
How to show a timeline of concurrent transactions Hi, I'm trying to create a chart showing batch jobs on a timeline, in the manner of an evolutionary or geological ti... by joelbyrnes Engager in Splunk Search 07-27-2016 1 1	1	1
Improve Search Performance Hi, Ive constructed the below 5 searches to populate a dashboard, once they go onto our live systems they are going ... by mwdbhyat Builder in Splunk Search 07-27-2016 0 3	0	3
tstats with timchart Hi, If I use tstats and timechart will the timechart slow down my search drastically(There is a ton of data so tryin... by mansel_scheffel Explorer in Splunk Search 07-27-2016 0 1	0	1
How to resize the width of a single value field Hi, Want to reduce the width size of single value field. I want first 2 fields to be closer and then some space a... by payal23 Path Finder in Splunk Search 07-26-2016 0 1	0	1
Why are the emailed results of my search not formatted the same as results in Splunk Web? I have a real time search that sends an email if there are any results. In Splunk, the search is formatted as I would... by mdufrasne Explorer in Splunk Search 07-26-2016 0 3	0	3