Splunk Search

Community Activity

How to count the number of events by unique value by sourcetype? I'm new to Splunk and am not quite sure how to approach this. I have several different automated jobs such as generat... by corlettb Engager in Splunk Search 05-09-2016 0 1	0	1
How to edit my search to filter out all but 1 concurrent event? In my current run, if two estops / jams are active at the same time, it will count count every minute they are both i... by t9jdc Engager in Splunk Search 05-09-2016 0 7	0	7
REGEX Help to extract USERID I'm trying to extract the userid field but am not able to get a clean extraction. I've tried several combinations al... by kmccowen Path Finder in Splunk Search 05-09-2016 0 8	0	8
How to edit my join search to display all values of a field? Hi All, I'm trying to join two searches. Search A has user and signature. Search B has user and user details. Now I... by kranthi851 New Member in Splunk Search 05-09-2016 0 1	0	1
How to sort database field name results in the Events tab in descending order? Hi, I am having Splunk Light installed in server1 and Splunk forwarder installed in server2. I just want to track th... by Monica7 New Member in Splunk Search 05-09-2016 0 11	0	11
how to store search output to Database i wrote a splunk query which manipulate data and display result.now i want to store that result into database is it... by tp92222 Explorer in Splunk Search 05-09-2016 0 2	0	2
How to apply two different searches based on the date of the event? I have a situation where information about a certain event is logged concurrently to two different files. The inform... by marcxbrl Explorer in Splunk Search 05-09-2016 0 3	0	3
Converting Military time to Standard time Hello, I am trying to convert my _time field from Military time to Standard time. Example:L 2016-04-21 21:47:38. So ... by fmpa_isaac Path Finder in Splunk Search 05-09-2016 0 3	0	3
i have a search that i need to modify the field A based on results of field B i have an index with field (Value) that brings in results as bytes or percentage according to what the (counter) fiel... by rwiley Explorer in Splunk Search 05-09-2016 0 5	0	5
How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields? I want to find out the count of events that have field with "ctx.props.Name" has either string syniverse/openmarket ... by murthychitturi New Member in Splunk Search 05-09-2016 0 4	0	4
Why old search jobs that should expire are not being removed from jobs directory? Hi, Currently, our jobs directory is more than full. To fix this, we wanted to change the expiry time of jobs so the... by anthony_copus Explorer in Splunk Search 05-09-2016 0 2	0	2
How to extract a timestamp from several fields of a raw record after some time offset calculation? I got a CSV log, and typical record inside is as below: Header1, Header 2, Header 3, Header 4, 20150703, value1, va... by MaxxY New Member in Splunk Search 05-09-2016 0 2	0	2
How to add a decimal to an extracted value (order value recorded as int in logs) I have a log with "fcTotal":"3989", that represents an order of $39.89. I'd like to extract it as a field with a va... by ra01 Path Finder in Splunk Search 05-09-2016 0 6	0	6
Different average with Realtime Alert when viewing events I'm having difficulty with my realtime alert. When the alert is triggered, it gives an average of 109, but when I vi... by zeophlite New Member in Splunk Search 05-09-2016 0 1	0	1
How to display more than 5 questions per page on Answers? In the last few days this site has changed to display only 5 questions per page. It's hideous. I'd rather scroll th... by richgalloway SplunkTrust in Splunk Search 05-09-2016 1 8	1	8
Combine results from subsearches Hello all, I'm a newbie to Splunk so I'm hoping someone can assist me figuring out how to accomplish the following. ... by ronaldsc New Member in Splunk Search 05-09-2016 0 10	0	10
How to extract multiple fields from one regex I try to extract several fields from my log but for some reason it does not work  Here is my props: [ev_event] EXTR... by efedoseeva Engager in Splunk Search 05-09-2016 0 2	0	2
Transaction endswith field breaks when I remove field from search, why? When I run this search, Splunk returns one item for the "transaction" eventtype=pageactions tag=external_traffic id=... by ra01 Path Finder in Splunk Search 05-09-2016 1 12	1	12
Field extractions: How to use same fieldname multiple times in a one long regular expression? There is a regular expression which is extracting a user field ( Field Extractor). This is basically a combination of... by saxenaamit New Member in Splunk Search 05-09-2016 0 4	0	4
Splunk 640: How to eval the difference between events' values Hello Everybody, I've a table (w/o the yellow column), as shown below. I want to eval another field (in yellow). It s... by htkwan Path Finder in Splunk Search 05-09-2016 0 4	0	4
How to check if data exist in coldidx or hotidx? hi say we have an index called as "my_network". the rollover period is 1 month to cold index. This needs to be teste... by koshyk Super Champion in Splunk Search 05-09-2016 0 3	0	3
How do I read all searches with a specific action in savedsearches.conf? I have created an alert with user name password fields such that the alert in savedsearches.conf has action.creds_tra... by GauriSplunk Path Finder in Splunk Search 05-09-2016 0 8	0	8
hide column where value = 0 Hello everyone ! I've two panels depending on time (timechart) : 1) index=XXX sourcetype="XXXXX" Severity="*" \|ti... by BaptVe Path Finder in Splunk Search 05-09-2016 0 2	0	2
Add results depending on different fields Hello, I'm looking to add the results of a count from different fields in one for a table: index=XXXX sourcetype=... by BaptVe Path Finder in Splunk Search 05-09-2016 0 7	0	7
How can I Rex to match until a string Hi folks, I'm new to regex and am struggling to extract a number from a field. I basically need the amount extracted... by mattodo Explorer in Splunk Search 05-08-2016 0 5	0	5