Splunk Search

Community Activity

Combine two searches using Eval with Case statement. Combine two searches using Eval with Case statement. by abdimustafa12 New Member in Splunk Search 03-09-2016 0 3	0	3
Search to find missing data using lookup table with multiple fields Hello, I am trying to find missing data in Splunk from a lookup table using inputlookup. My lookup table is: netdev... by GersonGarcia Path Finder in Splunk Search 03-09-2016 0 3	0	3
How to show text values in a timechart? I have the following information extracted from the log file: 03.03.2016 04:46:23 : Execution time in minutes: 4,370... by edwinmae Path Finder in Splunk Search 03-08-2016 0 7	0	7
Why does a new field extraction not work on the search head just I created it on, but works immediately on other members in the search head cluster? Running the latest Splunk 6.2.2 with search head clustering. I found that when I create a new search field extraction... by BP9906 Builder in Splunk Search 03-08-2016 0 2	0	2
mvexpand truncate result because of exceed 500MB memory usage Dears, i have splunk 6.3.3 and i am using query that have command mvexpand but mvexpand truncate result because of e... by ahmedhassanean Explorer in Splunk Search 03-08-2016 0 4	0	4
charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue? Dear community, We have several dashboards where we need to display more than the default 100 results in a visualiza... by glentes Path Finder in Splunk Search 03-08-2016 0 3	0	3
How to set up a search head connection to an index cluster via a Network Address Translation (NAT) device? Hi, I'm designing a deployment where there will be a search head on the other side of a NAT boundary to an index clu... by acidkewpie Path Finder in Splunk Search 03-08-2016 0 1	0	1
Using preloaded sourcetypes I am having difficulty setting up my forwarder with a preloaded source type. I have identified the source type as "ac... by pkaushik1 New Member in Splunk Search 03-08-2016 0 4	0	4
filter out top 10% of the results sorted in desc order Hi all, i am trying the below query.. i need result for only top 10% of the total result. the query i am using is .... by tanujsaxena New Member in Splunk Search 03-08-2016 0 5	0	5
How can we make a null value as a success? Hello all, I ran the below query ...\|stats count by message_type I got the below result message_type ... by vrmandadi Builder in Splunk Search 03-08-2016 0 4	0	4
What are these time modifiers doing? I have a search where I want the first search to search the previous week (Sunday to Sunday) and then use the same se... by splunkfuinator New Member in Splunk Search 03-08-2016 0 4	0	4
Reg Expression to find middle charatcter Hi , I am new in splunk, i need to find some letter from text using Reg: ex. how i can do. i have to find text afte... by ashokapex Explorer in Splunk Search 03-08-2016 0 2	0	2
How to compare fields across multiple sourcetypes Hi all, Im working on a search that essentially would take the field results from one search where I'm looking for a ... by raby1996 Path Finder in Splunk Search 03-08-2016 0 4	0	4
How to pass a multiselect parameter to a search? I have a multiselect on session_id and created a search to generate session_id's for a particular user. I created a ... by M_Chong Engager in Splunk Search 03-08-2016 1 3	1	3
How to use the new scheduler most efficently? Hi, I've got hundreds of searches that are scheduled ervry night from 00:00 to 6:00. It does not matter when they wi... by HeinzWaescher Motivator in Splunk Search 03-08-2016 0 2	0	2
Has anyone integrated Splunk with Informatica and how was your experience? Has anybody integrated Splunk with Informatica in any way? Bad/Good experiences? by muebel SplunkTrust in Splunk Search 03-08-2016 1 4	1	4
Time is not getting extracted properly ? Hi All, I am not able to extract time format from events like below 07/03/2016 Mon Mar 7 10:42:25 2016 ... by lohitkidu Path Finder in Splunk Search 03-07-2016 0 3	0	3
Why am I getting different results based on the time modifiers used to control the dates within a search? Has anyone had any experience, getting different results depending on the date modifiers used to control the dates? ... by HattrickNZ Motivator in Splunk Search 03-07-2016 0 2	0	2
How to count the number of opened and closed incidents using opened_at and closed_at date/time fields in each event? Hi, I've searched throughout Answers for some time now and didn't find any, unfortunately. Got in my Splunk environ... by romaindelmotte Explorer in Splunk Search 03-07-2016 0 6	0	6
Compare indexed file with lookup table where lookup table field is substring of indexed file field I want to compare an indexed file with lookup table, where lookup table field is substring of indexed file field Sam... by rajchi Explorer in Splunk Search 03-07-2016 0 6	0	6
Sum of count conditionally within a query I have incoming calls and I'm trying to get total number of calls followed by sum of calls where the field "result" e... by dcavag001c New Member in Splunk Search 03-07-2016 0 4	0	4
How to write a search for a dashboard to display all the users (based on uid) who entered the invalid credentials? I need some help writing a search for a dashboard to display all the users (based on uid) who entered the invalid cre... by krishnacasso Path Finder in Splunk Search 03-07-2016 0 3	0	3
Is there a way to add results to dbquery search when none are returned? Similar to 'fillnull' but for 'no results'. I am using DBquery to access a DB that has our monitoring configuration. I am trying to determine ratio of monitors m... by ericrobinson Path Finder in Splunk Search 03-07-2016 0 4	0	4
Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? I have a large number of reports to produce according to a data hierarchy. These are to be provided to the client as... by Redman11 Explorer in Splunk Search 03-07-2016 2 4	2	4
How to find the length of the string using len(string) function Hi, I am trying to extract a corId from the log and find the length of the corId. when searching am able to successf... by splunk_jerome Engager in Splunk Search 03-07-2016 1 3	1	3

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Splunk Search

Combine two searches using Eval with Case statement.

Search to find missing data using lookup table with multiple fields

How to show text values in a timechart?

Why does a new field extraction not work on the search head just I created it on, but works immediately on other members in the search head cluster?

mvexpand truncate result because of exceed 500MB memory usage

charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue?

How to set up a search head connection to an index cluster via a Network Address Translation (NAT) device?

Using preloaded sourcetypes

filter out top 10% of the results sorted in desc order

How can we make a null value as a success?

What are these time modifiers doing?

Reg Expression to find middle charatcter

How to compare fields across multiple sourcetypes

How to pass a multiselect parameter to a search?

How to use the new scheduler most efficently?

Has anyone integrated Splunk with Informatica and how was your experience?

Time is not getting extracted properly ?

Why am I getting different results based on the time modifiers used to control the dates within a search?

How to count the number of opened and closed incidents using opened_at and closed_at date/time fields in each event?

Compare indexed file with lookup table where lookup table field is substring of indexed file field

Sum of count conditionally within a query

How to write a search for a dashboard to display all the users (based on uid) who entered the invalid credentials?

Is there a way to add results to dbquery search when none are returned? Similar to 'fillnull' but for 'no results'.

Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK?

How to find the length of the string using len(string) function

Announcing Modern Navigation: A New Era of Splunk User Experience

Best Practices: Splunk auto adjust pipeline queue

Request for Professional Development: Attending .conf26

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation