Splunk Search

Community Activity

How to search over a field when it's JSON and has many different top level fields? Stars in field names? Aliases or spath? I have events that come in as JSON. That works fine, but I'm having trouble searching for a value in a field that has... by thisissplunk Builder in Splunk Search 01-11-2016 1 3	1	3
What is the best way to correlate events (from same source type) that share a common field value? I am new to splunk so I don't know all the syntax or the most efficient way to construct searches. My goal is to cor... by packet_hunter Contributor in Splunk Search 01-11-2016 0 11	0	11
How to extract and apply header information to every log line? Hello Splunk Guru's, The file below contains a header of 7 lines followed by an undetermined number of log lines. I... by RReichel Explorer in Splunk Search 01-11-2016 0 6	0	6
Group field value and count rather than overall count eventtype="product-view"\|stats count list(productname) as Products by username firmname The above is the search stri... by emamedov Explorer in Splunk Search 01-11-2016 0 4	0	4
How do I modify my search to output results in certain colors based on different ranges of percentage values? Hi Everyone, I have this query which is running and giving me the difference of errors from yesterday and today base... by tanhadil4vr New Member in Splunk Search 01-11-2016 0 1	0	1
How to show empty bins on my chart? Hello, I have my data between -1 and 1 and I want to show a distribution graph. I would like that the X axis is alwa... by pduflot Path Finder in Splunk Search 01-11-2016 1 10	1	10
How can I do prediction with the different algorithms like clustering, sequence clustering, etc in Splunk? How can I do prediction with the different algorithms like Clustering, Sequence Clustering, etc in Splunk? Splunk use... by Jaravuy New Member in Splunk Search 01-11-2016 0 3	0	3
Is it possible to show values in the column/bar chart? Checked the documentation of latest Splunk, and this function still not available. Anyone managed to get values showi... by Parameshwara Path Finder in Splunk Search 01-11-2016 1 7	1	7
How to write an eval search to fetch the value of field2 corresponding to field1? Hi all, How do I write an eval statement to fetch the value of field2 corresponding to field1? For example, consider... by muthvin New Member in Splunk Search 01-11-2016 0 18	0	18
Why does this python search script run twice? My background. . . (Heavy Unix, Shell, numerous programming languages. But new to Python and Splunk.) The intent ... by dwfarris Explorer in Splunk Search 01-11-2016 1 1	1	1
declare a variable in search string I have a search string (given below). Now I want to declare a variable named Os_Type, which based on the source type,... by Splunk_U Path Finder in Splunk Search 01-10-2016 1 8	1	8
How to perform calculation on a field with a date 3 years ago, but only use the field for the latest date of that month? I need to do calculations on fields where the Date is 3 years ago. However, there is a twist. I need to find this fie... by peterkn Explorer in Splunk Search 01-10-2016 0 2	0	2
How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour? I've scoured the Docs and Answers and haven't had any luck modifying their solutions to fit mine including streamstat... by mbond81 Engager in Splunk Search 01-10-2016 0 1	0	1
Total number of searches in limits.conf and authorize.conf: Which option takes precedence? Hi, System Details: System Type: Virtual Machine Total CPUs: 8 vCPUs (4 cores. 4 * 2 =  Total Users: 1 The overrid... by strive Influencer in Splunk Search 01-09-2016 0 2	0	2
Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode? Hi, In a distributed mode with 1 search head and 4 indexers, when making a search through the search head, 2 of the ... by andrearodrigues Explorer in Splunk Search 01-09-2016 1 2	1	2
How to write a search to find who deleted or modified files on a Windows server for the last 24 hours? I am now very new to Splunk. I have installed a Splunk forwarder to monitor Window Security Logs, but would like also... by mattkun New Member in Splunk Search 01-08-2016 0 2	0	2
How to edit my search to get unique values based on JobName or jobid? Hi I am displaying a table which shows: table JobName, jobid, start, end ,diff using the following search. How ... by athorat Communicator in Splunk Search 01-08-2016 0 2	0	2
How to write a search to track the time when service assignment changes between multiple hosts? We have a system where, when a service name (a unique service name referenced by service=service_N where N=1 to 20) d... by thegeekthedude New Member in Splunk Search 01-08-2016 0 1	0	1
How to add values from search to subsearch results? I am looking for some help with a search. Below is an alert that runs every hour. It looks for some stuff in a index... by Splunkey_ New Member in Splunk Search 01-08-2016 0 10	0	10
Is there a way to find out the location of a given macro in a search head clustering environment? I am new to a search head clustering environment. I found macros being used and I am trying to find out where these ... by Thuan Explorer in Splunk Search 01-08-2016 0 2	0	2
Mapping fields and values using regex and transforms.conf I have a very ugly log file that I need to run a regex against and have it match as many times as possible to map the... by hlarimer Communicator in Splunk Search 01-08-2016 0 9	0	9
Would creating fields at index-time improve search optimization for a 15 month dataset? I've read the docs in the splunk manual on parse-time indexed fields. http://docs.splunk.com/Documentation/Splunk/6.1... by cantgetnosleep Explorer in Splunk Search 01-08-2016 1 8	1	8
How to make a Splunk table visualization more interactive? Hi, We are thinking of using Splunk to display data from many sources in a table view. I searched a lot and didn't ... by omerr Explorer in Splunk Search 01-08-2016 0 4	0	4
How to extract the _time value into a separate field? I have one index of iis logs which extracts the timestamp into a "timestamp" field. I have another index which reads ... by jpanderson Path Finder in Splunk Search 01-08-2016 1 4	1	4
Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment? I have an indexer cluster environment and need to delete the logs completely from the indexer: source=* sourcetype=*... by himapate Explorer in Splunk Search 01-08-2016 0 1	0	1

Get Updates on the Splunk Community!

test 2

test 222222

test

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Splunk Search

How to search over a field when it's JSON and has many different top level fields? Stars in field names? Aliases or spath?

What is the best way to correlate events (from same source type) that share a common field value?

How to extract and apply header information to every log line?

Group field value and count rather than overall count

How do I modify my search to output results in certain colors based on different ranges of percentage values?

How to show empty bins on my chart?

How can I do prediction with the different algorithms like clustering, sequence clustering, etc in Splunk?

Is it possible to show values in the column/bar chart?

How to write an eval search to fetch the value of field2 corresponding to field1?

Why does this python search script run twice?

declare a variable in search string

How to perform calculation on a field with a date 3 years ago, but only use the field for the latest date of that month?

How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour?

Total number of searches in limits.conf and authorize.conf: Which option takes precedence?

Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode?

How to write a search to find who deleted or modified files on a Windows server for the last 24 hours?

How to edit my search to get unique values based on JobName or jobid?

How to write a search to track the time when service assignment changes between multiple hosts?

How to add values from search to subsearch results?

Is there a way to find out the location of a given macro in a search head clustering environment?

Mapping fields and values using regex and transforms.conf

Would creating fields at index-time improve search optimization for a 15 month dataset?

How to make a Splunk table visualization more interactive?

How to extract the _time value into a separate field?

Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment?

test 2

test

Join the Hackathon at .conf26 and build a No-Code AI agent

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation