Splunk Search

Community Activity

How to write a search to find the count of parameters in a POST over a period of time? Hi, We were asked to analyze the parameter usage. It is a POST with JSON body. The target is a set of 30 parameters.... by lstruman New Member in Splunk Search 01-27-2016 0 1	0	1
Extracting some Values that Match RegEx on the Fly I have data that includes computer names in my environment, the computer names follow a certain pattern which is usua... by Makinde New Member in Splunk Search 01-27-2016 0 12	0	12
Detecting Simultaneous Sessions I have an inhouse written app that outputs an audit log in the form of: DateTime,Username,Activity,SessionID So I'l... by Warme1980 Engager in Splunk Search 01-27-2016 1 2	1	2
automatic lookups Hi, I configured a lookup that works fine, if I explicitly use the lookup statement in my search, but I want the fie... by a212830 Champion in Splunk Search 01-27-2016 0 4	0	4
Streamed search execute failed because: Error in 'surrounding': Too many events (> 10000) in a single second. Even though I have overwritten what I believe is this limit in limits.conf, btool is showing, [show_source] max_coun... by splunk_zen Builder in Splunk Search 01-27-2016 0 4	0	4
How do I rename fields in my Splunk search result set? index=xxx earliest=-7d@d latest=@d ( sourcetype="FirstSourceType" ResponsePayLoad="xxx" ActivityStep="rs" (Response... by pawnalmighty Engager in Splunk Search 01-27-2016 0 2	0	2
Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? This search works fine: "DBOMA" "SELECT "Time" , "Virtual_Machine" , "ready" FROM DBSTDBO.CPUBYVM where "Virtual_Mac... by mark_chuman Path Finder in Splunk Search 01-27-2016 0 4	0	4
Help with trimming characters Hi, Having some issues here. I have the following values in a field named populace The values are encased in a < a... by TheJagoff Communicator in Splunk Search 01-27-2016 0 7	0	7
Why am I getting inconsistent search results? I have configured Kepware IDF for Splunk and am ingesting data over TCP:51112. The source_type I have set ('opc') is... by cmisztur Explorer in Splunk Search 01-26-2016 0 3	0	3
How do I add fields to output from predict I need to locate and alert on counts that are not within predicted bounds. It seems simple enough using predict, but... by chengka Explorer in Splunk Search 01-26-2016 0 2	0	2
Is it possible to search cold bucket data only for a given index? Hello, I modified my cold bucket location, and I want to perform some test queries for data residing in cold buckets ... by mendesjo Path Finder in Splunk Search 01-26-2016 0 5	0	5
Time and Date in two different places within my events Here is part of what my events that are in xml format look like: Blockquote``_id="1767282" _uuid="0D981036-9B9C-484... by jpelletier_splu Splunk Employee in Splunk Search 01-26-2016 0 2	0	2
Creating new fields and setting values for fields retrieved on search. I put the key value pairs of the log message into the content body whenever i create new events throught the splunk's... by misteryuku Communicator in Splunk Search 01-26-2016 0 2	0	2
How to put a function on the lookup field from a lookup table? Hi, My event results have a field "name" and it has lower case values (e.g. 'mike_lee'). But in my lookup table, th... by xiangtaner Path Finder in Splunk Search 01-26-2016 0 4	0	4
How to easily replace a character in a token value ? Hello, I have a token "user" representing the name of a user. This name can contain "(" or ")". When I am using this... by ctaf Contributor in Splunk Search 01-26-2016 0 15	0	15
Subtracting value if another field value matches Hi all, Im running two searches one returns a number called "difference" and a field called "code2", the other searc... by raby1996 Path Finder in Splunk Search 01-26-2016 0 3	0	3
Help grouping results best command to use I'm pretty new to Splunk and trying to wrap my head around how to pull data out of Splunk and display it. I have a s... by ronaldsc New Member in Splunk Search 01-26-2016 0 4	0	4
How can I create a report giving a number of counts per categories per week ? I am struggling to create a report that would give number of counts per categories per week. Something that could be ... by stenou New Member in Splunk Search 01-26-2016 0 3	0	3
Accessing fields from specific events in a transaction I have logs which contain a value, time_taken. I want to work out the latency of entire transactions by summing the t... by jpanderson Path Finder in Splunk Search 01-26-2016 0 6	0	6
Why is my search not pulling all results from a log in JSON format? I need some help writing a search that can do the following things: The log file below needs to be interrogated and ... by janis_berzins Engager in Splunk Search 01-26-2016 0 2	0	2
How to access Date Partitioned files in HDFS dynamically using virtual index Hi, I have hdfs folders as below. /bla/bla/bla/20160121 /bla/bla/bla/20160122 /bla/bla/bla/20160123 How to acces... by sdaruna Explorer in Splunk Search 01-25-2016 0 1	0	1
Using eval for a search. Drilldown XML ignores my lookup link and just re-uses the original search query, but with it narrowed down to the cell selection? Sorry for the mouthful in the title. I'm using a drilldown in the XML for a component in a dashboard which worked fi... by spike021 Explorer in Splunk Search 01-25-2016 0 3	0	3
useage of query result hello , i am new to splunk and i have a bit of a problem with using the results from the query, <condition match=" '... by ronenp New Member in Splunk Search 01-25-2016 0 4	0	4
Field Extraction question - Capturing GUID I'm still quite new to Splunk so my wording may be a little off. I am running into an issue when trying to create a f... by rewritex Contributor in Splunk Search 01-25-2016 0 2	0	2
Search for user day 1 retention I'm taking a shot at providing metrics on day 1 retention numbers of users in our system (Create a profile and the ne... by arnol229 Explorer in Splunk Search 01-25-2016 0 4	0	4