Splunk Search

Community Activity

rename EventCodes Is there a way to rename EventCodes xxxx field to "description" in timechart? Here is a sample search: Account_Name... by smudge797 Path Finder in Splunk Search 06-21-2016 0 13	0	13
How to track real-time errors from SharePoint ULS logs and configure real-time alerts for this in Splunk? Hi, We are using SharePoint ULS Viewer to watch SharePoint logs which are any errors, warnings, and critical things ... by guruwells Explorer in Splunk Search 06-21-2016 0 5	0	5
Why am I unable to filter out events from payload with my current search? I have an event from which I want to filter this string: \\\"name\\\":\\\"experience\\\",\\\"status\\\":\\\"FAILURE\... by singa095 New Member in Splunk Search 06-21-2016 0 7	0	7
How do I write the regex to identify the sourceip that can be found in different locations in my logs? I have logs like below 1.1.1.1 This is my sourceip 2.2.2.2 My source ip is 1.1.1.2 I have a situation where in som... by splunkn Communicator in Splunk Search 06-21-2016 0 2	0	2
How to restrict a search string to show only one value per day? Hi, I have a SQL query running in Splunk counting the number of documents by data size (below 1MB, 1-5MB, 5-10MB, 10... by mhornste Path Finder in Splunk Search 06-21-2016 0 2	0	2
Subsearch and real-time: How to write a search to get all-time values and display them with real-time values? Below is my simple search. index="ix-lp-tps" \| stats count as CurrentCount \| appendcols [search earliest=-100y inde... by canuzun Explorer in Splunk Search 06-21-2016 0 2	0	2
XML or search examples of swim lane chart Hi All, I am looking for swim lane chart examples. Does swimlane feature of charting only inbuilt with some apps or ... by krish3 Contributor in Splunk Search 06-20-2016 0 6	0	6
How to create a regular expression to extract this string from four types of patterns in my sample data? Hi, I have the following 4 kinds of text in logs in a single file. I want to extract the string - Customer Num (star... by virtualme New Member in Splunk Search 06-20-2016 0 8	0	8
Why is my search returning a log response value that is truncated after the boolean string "true" in my sample response? Hi, I am very new to Splunk and am trying to get all the fields in response. One of the fields is actually a JSON st... by psable Explorer in Splunk Search 06-20-2016 0 7	0	7
What is the most efficient way to extract user name from my sample Message fields? What's the most efficient way to extract the user name from these messages: Message=Self-service Plug-in started (us... by smudge797 Path Finder in Splunk Search 06-20-2016 0 13	0	13
How to edit my dashboard XML with 3 text input forms to submit a search, even if only 1 or 2 text inputs have values? Hi There, I have 3 text boxes. All three may have values and sometimes only one or two text boxes will have values t... by smaran06 Path Finder in Splunk Search 06-20-2016 2 2	2	2
How to create a timechart search to compare the count for the previous 24 hour period from the current time, not day by day? I am trying to create a search to show the previous 24 hour count using timechart so I can show the previous 24 hours... by chrisduimstra Path Finder in Splunk Search 06-20-2016 0 2	0	2
How to calculate the difference between 2 different events with the same field and group them by another field that they have in common? So lets say I have 4 events, name="karina" age="23" name="Karina" age = "67" ... by kar1na New Member in Splunk Search 06-20-2016 0 1	0	1
Simple regex for capturing text between strings with different end anchors I've been battling this, and I'm not sure if it's a bug in Splunk or what. This is for a field extraction. I simply ... by Cuyose Builder in Splunk Search 06-20-2016 0 11	0	11
How to troubleshoot why a Splunk search head is stuck on "Waiting for data" trying to run a search? Hi I have an issue with a Splunk search head unable to return any search results. It is stuck on "waiting for data"... by OMohi Path Finder in Splunk Search 06-20-2016 0 3	0	3
How to write a search to group file versions by parent file? Hello all, I've been trying to do the following for hours and seems like I need some assistance. We have a bunch of ... by splunker1981 Path Finder in Splunk Search 06-20-2016 0 3	0	3
How do I edit my search to convert extracted field value pairs into a string? Hi, I have recently started using json log lines which works great with Splunk. There is one issue, however, which I... by tihhoni New Member in Splunk Search 06-20-2016 0 3	0	3
How to identify unauthorized access to crontab in a Splunk search? Hello (again) I am doing the following Linux command testing who has access to crontab. For a non privileged user, I... by TheJagoff Communicator in Splunk Search 06-20-2016 0 1	0	1
What do the results look like when calling Intersplunk and reading from a table? I am trying to grab the results from the different categories on my table and place them in values in my Python progr... by annalisefolsen Explorer in Splunk Search 06-20-2016 0 1	0	1
How to edit my eval statement to resolve "Error in 'eval' command: Regex: nothing to repeat"? Hello all, I'm trying to filter some event by their Summary. I just want to distinguish when they have the word Main... by marina_rovira Contributor in Splunk Search 06-20-2016 0 2	0	2
Is there an alternative to using regex in my search for better performance? hello, After reading some answers, I see that if I use regex for searching events corresponding to a pattern, it wil... by sieutruc Contributor in Splunk Search 06-20-2016 0 12	0	12
How to search all events and corresponding volume, but display the volume as "0" for missing events? I'm search to fetch the volume against different events in a given time frame. The problem I'm running into is that i... by nasamajh09 New Member in Splunk Search 06-20-2016 0 3	0	3
How to estimate Splunk memory usage? Could please someone tell what is the best value I should set for the "max_mem_usage_mb" and "max_rawsize_perchunk" ?... by mpfsplunk01 Engager in Splunk Search 06-19-2016 4 1	4	1
How to edit my search to prevent my sparkline from displaying as a flat line with zeros for values? Hello, I have the following search: sourcetype=some_data \| stats values(msg_type) first(_time) as start by id_field... by briang67 Communicator in Splunk Search 06-19-2016 0 1	0	1
How to write the regex to extract the IP address and port number from my log files? I have got a field in my log files that is storing failed login IP address "Failed password for invalid user astro fr... by bluesaint New Member in Splunk Search 06-19-2016 0 1	0	1

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

rename EventCodes

How to track real-time errors from SharePoint ULS logs and configure real-time alerts for this in Splunk?

Why am I unable to filter out events from payload with my current search?

How do I write the regex to identify the sourceip that can be found in different locations in my logs?

How to restrict a search string to show only one value per day?

Subsearch and real-time: How to write a search to get all-time values and display them with real-time values?

XML or search examples of swim lane chart

How to create a regular expression to extract this string from four types of patterns in my sample data?

Why is my search returning a log response value that is truncated after the boolean string "true" in my sample response?

What is the most efficient way to extract user name from my sample Message fields?

How to edit my dashboard XML with 3 text input forms to submit a search, even if only 1 or 2 text inputs have values?

How to create a timechart search to compare the count for the previous 24 hour period from the current time, not day by day?

How to calculate the difference between 2 different events with the same field and group them by another field that they have in common?

Simple regex for capturing text between strings with different end anchors

How to troubleshoot why a Splunk search head is stuck on "Waiting for data" trying to run a search?

How to write a search to group file versions by parent file?

How do I edit my search to convert extracted field value pairs into a string?

How to identify unauthorized access to crontab in a Splunk search?

What do the results look like when calling Intersplunk and reading from a table?

How to edit my eval statement to resolve "Error in 'eval' command: Regex: nothing to repeat"?

Is there an alternative to using regex in my search for better performance?

How to search all events and corresponding volume, but display the volume as "0" for missing events?

How to estimate Splunk memory usage?

How to edit my search to prevent my sparkline from displaying as a flat line with zeros for values?

How to write the regex to extract the IP address and port number from my log files?

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation