Splunk Search

Community Activity

How to join this search with our existing search? Hi, Need help on a Splunk subsearch. Below is our Splunk basic search which gives us few fields if it satisfies the... by splunker9999 Path Finder in Splunk Search 07-12-2016 0 4	0	4
Set a field with a constant value In props.conf, I would like to create a field abc by saying: abc = "xyz". Is there any way to say this so that Splu... by mmather67 Path Finder in Splunk Search 07-12-2016 2 12	2	12
Can the transaction command be used to search the duration a user has been logged in to a PC? I want to see the duration that a user has been logged in to the PC for. Would the transaction command work the best ... by sbattista09 Contributor in Splunk Search 07-12-2016 0 2	0	2
User data collapsed with activity information collected in separate statements My app writes two log statements, audit and activity statement, for each invocation as below: audit: type:audit \| ti... by sureshchinta Explorer in Splunk Search 07-12-2016 0 5	0	5
Sum Duration query: index=ctap source="/charter/apps/gwtrbl/logs/troubleshooting.log" host=sc58laopp0 End of Branch Execution : ... by kmccowen Path Finder in Splunk Search 07-12-2016 0 2	0	2
In a Distributed Search environment, how do I restrict what indexes (or sources) the Search head sees on the Search Peer? I have a main centralized splunk index server with logs for 50+ hosts. I have a secondary Splunk instance for a smal... by warrenpage Explorer in Splunk Search 07-12-2016 1 5	1	5
Programatically setting severity within a search I am writing a search that will track when the firewall sees outbound traffic over non-standard ports. I have a requ... by iisaphd Engager in Splunk Search 07-12-2016 0 2	0	2
How to lookup list of keywords with raw logs which are available in Splunk? Hi, I have a list of executables uploaded as a lookup in Splunk and have proxy logs to compare against it. I need to... by kaskirana01 New Member in Splunk Search 07-12-2016 0 5	0	5
Where can I get the XSD that defines the structure of the XML search output from the REST API? Hi, I have a customer who uses Splunk via the REST API and runs a search to put into another system. Their output i... by a212830 Champion in Splunk Search 07-12-2016 0 8	0	8
How do I take the entire contents of a table and make it one giant event? All, So I have a lookup, of say 10,000 items. I'd like to merge it all as one giant event for a specifical visualiz... by daniel333 Builder in Splunk Search 07-12-2016 0 2	0	2
What is the difference between fieldformat and eval operation time conversion? I am able to see that the following search returns the same result for fieldformat as well as eval time conversion op... by splunkn Communicator in Splunk Search 07-12-2016 1 5	1	5
Transaction duration in Splunk Hi All, Transaction duration based on thread name. I wrote the below search: index="p" sourcetype="x" \| transaction... by saradachelluboy Explorer in Splunk Search 07-12-2016 0 5	0	5
Creating Bar Chart for SSH logs Hi Team, We are trying to create a bar chart from secure log. The ultimate goal is to plot the accounts (top 10) use... by akashjohn Explorer in Splunk Search 07-12-2016 0 4	0	4
How can I get a count of words in an event? All, Weird search. How can I get a count of words in an event? e.g. _raw = "Hello world. Hello state. Hello Franc... by daniel333 Builder in Splunk Search 07-11-2016 0 3	0	3
How to edit my search to chart a trend line over time? I am trying to use the below search and plot a graph for the TPS field. So, if I draw a chart with the TPS values ov... by koushiknandan New Member in Splunk Search 07-11-2016 0 9	0	9
How to find where an extracted field was created that appears in searches? Trying to find where a field was created that appears in a search against our BlueCoat proxy logs. The field is s_... by tlmayes Contributor in Splunk Search 07-11-2016 0 7	0	7
How to extract a substring based on its position within a field? I have a field that is of the form /Code153:4:Item1,Item2,Item3,Item4/Code211:2:Item5,Item6 where I need to extract a... by mcgi906 Explorer in Splunk Search 07-11-2016 0 1	0	1
How to Group Events at Index Time? I want to tie together 2 events at index time the same way I would tie them together at search time using the transac... by skoelpin SplunkTrust in Splunk Search 07-11-2016 0 4	0	4
Search for items not matching values from a lookup I have this search which basically displays if there is a hash (sha256) value in the sourcetype= software field =sha2... by ashishlal82 Explorer in Splunk Search 07-11-2016 0 8	0	8
Can I format the y-axis on a chart to properly display military time? I'm using the following to chart job end times over date: index = ironstream MSGNUM = "IEF404I" ( JOBNAME = TZRPD85 ... by szimmer661 Explorer in Splunk Search 07-11-2016 0 6	0	6
Why am I unable to return any results with the appendcols command? I have a search where I get a value "SplitID" that, along with another ID, gets put into a table. However, I am using... by mcgi906 Explorer in Splunk Search 07-11-2016 0 2	0	2
How to visualize a sum of simultaneous occurring events in a timechart with a start_time and stop_time? Hello, I have a series of events with a JoinTime field and a LeaveTime field. Each of these events essentially repr... by adacpt Explorer in Splunk Search 07-11-2016 0 6	0	6
Why am I unable to get results for the second stats in my search? I have a log file with rows for each transaction in a request sequence, each identified by msg_id. I'm trying to get... by David_Hodgson Engager in Splunk Search 07-11-2016 0 3	0	3
How do I merge data with the same values in a table entry? See the attached picture: I am looking at a count of data for deliveries from 2 months ago and the previous months. ... by voninski New Member in Splunk Search 07-11-2016 0 9	0	9
How to find the origin and regular expression of an extracted field I use in Splunk? We have a field called Response_Size which we cannot find. I looked in the Settings>Fields>Field Extractions and sele... by skoelpin SplunkTrust in Splunk Search 07-11-2016 0 6	0	6