Splunk Search

Community Activity

How to refer to a post-process base search from append subsearch queries in a dashboard? I have a base search in my dashboard that refers to a scheduled search: <search id="Base_Search" ref="Scheduled_Repo... by ishaanshekhar Communicator in Splunk Search 06-14-2016 0 3	0	3
How to expand 500 limits event for Transaction command? When I run transaction command, some transaction may be more than 500 events but splunk split it to a set of 500 even... by TheGU Path Finder in Splunk Search 06-14-2016 2 4	2	4
Why am I unable to make a dashboard from the "Search" App global with error "Could not find writer for : /nobody/search/views/ [0] [E:\Splunk\etc]"? New to Splunk. Created a custom dashboard using Search App, but it is private. When I am trying to make it Global, I ... by jcpsupport New Member in Splunk Search 06-13-2016 0 1	0	1
Count the movement (add remove) of hosts If I add 1 host and remove another host in a month, the stats will be the same and the delta zero but we had movement... by smudge797 Path Finder in Splunk Search 06-13-2016 0 3	0	3
How to exclude certain fields from search results? I would like to exclude certain fields from search results and keep the rest of the information (not discarding the e... by Yaichael Communicator in Splunk Search 06-13-2016 0 2	0	2
Assign a string to a Variable in Search Bar I would like to assign a string to a variable, like valid ="error" then use the variable with the stats or timechart ... by vkakani60 Path Finder in Splunk Search 06-13-2016 0 5	0	5
How to get average event size... Is there a quick way (metadata? tstats?) to get the average event size for my events? Querying every event would tak... by a212830 Champion in Splunk Search 06-13-2016 0 6	0	6
Using If then in combination with case I would like to create a new tag field based on multiple conditions. I think I have figured out how to specify my con... by kennyja Explorer in Splunk Search 06-13-2016 0 4	0	4
Can I determine the size of a source without reading the entire source? Hi, I'd like to determine the size of certain sources, but don't want the overhead of reading the entire file. Is t... by a212830 Champion in Splunk Search 06-13-2016 0 3	0	3
Correlation between two different sources - Splunk 6.4.1 Hi I am very new to Splunk and I am hoping that I can get a little help with my current problem I have two sources ... by cmac2001 New Member in Splunk Search 06-13-2016 0 3	0	3
How to match a fieldA from an index to fieldA in a CSV lookup file and output the corresponding fieldB? Hi guys, Wondering if anyone can help me and if this can be done. I have a CSV file with two columns. CSV file loo... by abbam Explorer in Splunk Search 06-13-2016 0 8	0	8
How to write an efficient search to compare new IPs against the previous 30 days? Disclaimer: I know the search below is ugly, its based on several examples including the exploring splunk book. I was... by dpoloche Explorer in Splunk Search 06-13-2016 0 4	0	4
How to add an escape \ to a value? Greetings, I am using a form and the dynamic inputs is a table of usernames. The search results in Domain\username.... by ccsfdave Builder in Splunk Search 06-13-2016 0 3	0	3
How to write the regex to extract this string between the 3rd and 6th underscores in my sample data? Hi, I would like to extract the strings between multiple delimiters as below. INPUT : src=`D:\GENEOS Program Files\... by deenadp Explorer in Splunk Search 06-13-2016 1 5	1	5
How do you search by specific alert type? Hey, I was looking run a historical search for a specific alert over a period of time. What search can I run in ord... by wzgoda Explorer in Splunk Search 06-13-2016 0 1	0	1
Exacting Account_Name from security logs Your rex command does nothing at all so we can remove it. You also are not using Region so it can go. The dedup com... by smudge797 Path Finder in Splunk Search 06-13-2016 0 1	0	1
How to pass eval statements with quotes through the Splunk Python SDK command line? The following search works just fine in the search bar in Splunk: index=stuff earliest=-1d \| eval newtime = strptime... by reswob4 Builder in Splunk Search 06-13-2016 0 4	0	4
How would I add in a column to list the average duration of an event? For this query: index=4_ip_sql source=CNVIP101 Priority=4 Quality=192 (Message="jam" OR Message="stop" OR Message="... by blues1990 Explorer in Splunk Search 06-13-2016 0 1	0	1
Count and display the TOP10 words occurrences from an event? Hello everyone, I'm trying to count every occurrences words from all events and get a TOP 10. Each sentences is an ... by sousouheyl Engager in Splunk Search 06-13-2016 0 4	0	4
How do I locate the latest event and have all the fields in that event available to me? I am using the following query to locate the latest event with the field EVENTREF = 50184 or 50185. I believe the co... by smaloney99 New Member in Splunk Search 06-13-2016 0 3	0	3
How to add a field being a sum of previous rows? Hello, i am looking to solve following problem. How to calculate the fields summary_worked and summary_requested? ... by tomaszwrona Explorer in Splunk Search 06-13-2016 0 2	0	2
signature not searchable I have an odd problem. I just set up a splunk instance and its only monitoring local linux logs at the moment. The ... by trevlix New Member in Splunk Search 06-13-2016 0 1	0	1
毎月最終日のデータのみカウントしたい毎日取得しているデータがあり、そのうちその月の最終日のデータのみカウントしたいと考えております。指定月の最終日のみでしたら方法がわかったのですが、月別に取得する方法がわかりません。どうかご教授お願いいたします。 by haruka_saito Explorer in Splunk Search 06-12-2016 0 6	0	6
Transaction command not working with events spanning more than 2 days Hi, We have data coming from database showing the status of Orchestrator tasks. Every tasks starts with "In Progres... by nabeel652 Builder in Splunk Search 06-12-2016 0 5	0	5
Is there a way to simplify my search or another approach instead of using mvindex multiple times to get the expected values? Hi Fellow Splunkers, I need to create a report for this event codes. 4720 A user account was created. 4722 ... by xavierpaul New Member in Splunk Search 06-12-2016 0 4	0	4

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Splunk Search

How to refer to a post-process base search from append subsearch queries in a dashboard?

How to expand 500 limits event for Transaction command?

Why am I unable to make a dashboard from the "Search" App global with error "Could not find writer for : /nobody/search/views/ [0] [E:\Splunk\etc]"?

Count the movement (add remove) of hosts

How to exclude certain fields from search results?

Assign a string to a Variable in Search Bar

How to get average event size...

Using If then in combination with case

Can I determine the size of a source without reading the entire source?

Correlation between two different sources - Splunk 6.4.1

How to match a fieldA from an index to fieldA in a CSV lookup file and output the corresponding fieldB?

How to write an efficient search to compare new IPs against the previous 30 days?

How to add an escape \ to a value?

How to write the regex to extract this string between the 3rd and 6th underscores in my sample data?

How do you search by specific alert type?

Exacting Account_Name from security logs

How to pass eval statements with quotes through the Splunk Python SDK command line?

How would I add in a column to list the average duration of an event?

Count and display the TOP10 words occurrences from an event?

How do I locate the latest event and have all the fields in that event available to me?

How to add a field being a sum of previous rows?

signature not searchable

毎月最終日のデータのみカウントしたい

Transaction command not working with events spanning more than 2 days

Is there a way to simplify my search or another approach instead of using mvindex multiple times to get the expected values?

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Event Series: Telemetry Pipeline Management

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation