Splunk Search

Community Activity

Mapping fields and values using regex and transforms.conf I have a very ugly log file that I need to run a regex against and have it match as many times as possible to map the... by hlarimer Communicator in Splunk Search 01-08-2016 0 9	0	9
Would creating fields at index-time improve search optimization for a 15 month dataset? I've read the docs in the splunk manual on parse-time indexed fields. http://docs.splunk.com/Documentation/Splunk/6.1... by cantgetnosleep Explorer in Splunk Search 01-08-2016 1 8	1	8
How to make a Splunk table visualization more interactive? Hi, We are thinking of using Splunk to display data from many sources in a table view. I searched a lot and didn't ... by omerr Explorer in Splunk Search 01-08-2016 0 4	0	4
How to extract the _time value into a separate field? I have one index of iis logs which extracts the timestamp into a "timestamp" field. I have another index which reads ... by jpanderson Path Finder in Splunk Search 01-08-2016 1 4	1	4
Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment? I have an indexer cluster environment and need to delete the logs completely from the indexer: source=* sourcetype=*... by himapate Explorer in Splunk Search 01-08-2016 0 1	0	1
My eval statement works in the Search App, but why does it not work when it is created via Settings, Fields, Calculated Field or via props.conf? I'm able to create the following calculated field in the Search app. .... \| eval KCQueueDuration = (strptime(KCQStar... by lyanta Explorer in Splunk Search 01-08-2016 0 5	0	5
Has anyone created a scheduled search that notifies you if an app/add-on installed on search peers has an updated version on Splunkbase? Running a distributed environment, and certain servers of mine have internet access, but my deployment server and sea... by banderson7 Communicator in Splunk Search 01-08-2016 2 2	2	2
Search where hosts have an unrelated sourcetype I was refining an existing search/dashboard panel when I discovered that my hosts do not reliably follow a pattern. ... by tk15 Engager in Splunk Search 01-08-2016 0 5	0	5
How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search? chart list(ACCOUNT_ID) by script I am getting a chart with script and list of ACCOUNT_ID. I want only 5 ACCOUNT_I... by ARTHI Engager in Splunk Search 01-08-2016 0 3	0	3
How do I get an automatic lookup to populate a table, even if there are null values in the event logs for the matching field? Hello - This is my first time asking a question here. I receive a lot of answers by reading others' questions (thank ... by cchimento Path Finder in Splunk Search 01-07-2016 0 9	0	9
Is there a way to use a wildcard in field names when running a search? (ex: field*_name=X for field1_name, field2_name, etc) I have csv data indexed in Splunk. The fields are unique, but have some patterns: As an example, the following first... by splunknewbie05 Explorer in Splunk Search 01-07-2016 3 9	3	9
When using the MAP and TAIL commands in my search, why do events not match the statistics table? When I run the MAP search below, the events that I get back do not match the ones used to generate the statistics tab... by motobeats Path Finder in Splunk Search 01-07-2016 0 5	0	5
How do I bring results from my subsearch into my outer search's table? (Subsearch in outer search of join.) Looked at join and append. Tried both, couldn't get them working. I need your eyes to help me here! This is my curre... by thisissplunk Builder in Splunk Search 01-07-2016 1 7	1	7
How to extract the start and end date/time from my sample data, then calculate the duration of a job? Hi I have to extract start date, end date, and the duration of a job based on the following two events: Started: 2... by athorat Communicator in Splunk Search 01-07-2016 0 13	0	13
Splunk forwarder to add custom fields for multiple logs I have to setup Splunk for 100 servers, each server will have 5-10 JVMs, Each JVM generates 3-4 log files. I would li... by z001k6jr New Member in Splunk Search 01-07-2016 0 3	0	3
Why is a field extracted with rex always empty in a table? I have two log statements: daily.cron run at startTime daily.cron complete at endTime. I am trying to extract the S... by deborahdigges New Member in Splunk Search 01-07-2016 0 2	0	2
How to combine my two searches get the duration of completed jobs with start/end events and display a list of incomplete jobs? I have two searches that I am trying to combine into one and keep running into roadblocks. Preferably, I would be abl... by dpoloche Explorer in Splunk Search 01-07-2016 1 6	1	6
How to edit my regex to extract fields from my sample data? Hello, I am trying to build a regex to extract fields from my data below. I am not a programmer so I am not too fam... by fmpa_isaac Path Finder in Splunk Search 01-07-2016 0 5	0	5
How do I add a new row to my table with percentage and total values? Hello This is my data: 2015-07-24 12:18:05 A=10 B=20 C=30 D=15 2015-07-24 12:18:15 A=20 B=210 C=320 D=150 2015-07-2... by govindparashar1 New Member in Splunk Search 01-07-2016 0 2	0	2
How do I write a search to calculate the percentage of each status field in my sample data? Working on some client data, sample data format looks like: Item status -------------------------- AAA success B... by SrinivasaC Path Finder in Splunk Search 01-07-2016 0 3	0	3
How do I write the regex to extract these 3 fields from my sample data? Hi, I have the following sample field in my log. filter=somename89898+20+O I want to ideally extract 3 fields wit... by adicoza786 Explorer in Splunk Search 01-06-2016 0 4	0	4
eval wildcards - using match in a case statement Hi , I used match command in eval wildcards like below: shop_tags have many tags, A and B just two of them to identi... by hqw Path Finder in Splunk Search 01-06-2016 0 4	0	4
DBConnect indexing field with backslash character I'm indexing a field with DBConnect that contains the backslash character, eg \, in order to escape quotation marks a... by mcomfurf Path Finder in Splunk Search 01-06-2016 0 4	0	4
What does the "startup.handoff" value represent in the search job inspector? Apologies if this is blatantly obvious. I have been troubleshooting search performance, and like many others, have g... by t9445 Path Finder in Splunk Search 01-06-2016 1 7	1	7
Search Head Cluster captain election fails with error -NOT_LEADER CURRENT_STATE = FOLLOWER We have 5 Node SHC member on splunk version 6.3. The Captain election is not suceeding. We followed steps and cleare... by sat94541 Communicator in Splunk Search 01-06-2016 0 3	0	3

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

Splunk Search

Mapping fields and values using regex and transforms.conf

Would creating fields at index-time improve search optimization for a 15 month dataset?

How to make a Splunk table visualization more interactive?

How to extract the _time value into a separate field?

Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment?

My eval statement works in the Search App, but why does it not work when it is created via Settings, Fields, Calculated Field or via props.conf?

Has anyone created a scheduled search that notifies you if an app/add-on installed on search peers has an updated version on Splunkbase?

Search where hosts have an unrelated sourcetype

How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search?

How do I get an automatic lookup to populate a table, even if there are null values in the event logs for the matching field?

Is there a way to use a wildcard in field names when running a search? (ex: field*_name=X for field1_name, field2_name, etc)

When using the MAP and TAIL commands in my search, why do events not match the statistics table?

How do I bring results from my subsearch into my outer search's table? (Subsearch in outer search of join.)

How to extract the start and end date/time from my sample data, then calculate the duration of a job?

Splunk forwarder to add custom fields for multiple logs

Why is a field extracted with rex always empty in a table?

How to combine my two searches get the duration of completed jobs with start/end events and display a list of incomplete jobs?

How to edit my regex to extract fields from my sample data?

How do I add a new row to my table with percentage and total values?

How do I write a search to calculate the percentage of each status field in my sample data?

How do I write the regex to extract these 3 fields from my sample data?

eval wildcards - using match in a case statement

DBConnect indexing field with backslash character

What does the "startup.handoff" value represent in the search job inspector?

Search Head Cluster captain election fails with error -NOT_LEADER CURRENT_STATE = FOLLOWER

Splunk Observability for AI

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Splunk Observability as Code: From Zero to Dashboard

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

MLTKC how should i check jupyter notebook func in ...

ITSI thresholds: adaptive vs static

Using Machine Learning Toolkit to detect auth abus...

Splunk Search

Are you a member of the Splunk Community?