Splunk Search

Community Activity

How can I do prediction with the different algorithms like clustering, sequence clustering, etc in Splunk? How can I do prediction with the different algorithms like Clustering, Sequence Clustering, etc in Splunk? Splunk use... by Jaravuy New Member in Splunk Search 01-11-2016 0 3	0	3
Is it possible to show values in the column/bar chart? Checked the documentation of latest Splunk, and this function still not available. Anyone managed to get values showi... by Parameshwara Path Finder in Splunk Search 01-11-2016 1 7	1	7
How to write an eval search to fetch the value of field2 corresponding to field1? Hi all, How do I write an eval statement to fetch the value of field2 corresponding to field1? For example, consider... by muthvin New Member in Splunk Search 01-11-2016 0 18	0	18
Why does this python search script run twice? My background. . . (Heavy Unix, Shell, numerous programming languages. But new to Python and Splunk.) The intent ... by dwfarris Explorer in Splunk Search 01-11-2016 1 1	1	1
declare a variable in search string I have a search string (given below). Now I want to declare a variable named Os_Type, which based on the source type,... by Splunk_U Path Finder in Splunk Search 01-10-2016 1 8	1	8
How to perform calculation on a field with a date 3 years ago, but only use the field for the latest date of that month? I need to do calculations on fields where the Date is 3 years ago. However, there is a twist. I need to find this fie... by peterkn Explorer in Splunk Search 01-10-2016 0 2	0	2
How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour? I've scoured the Docs and Answers and haven't had any luck modifying their solutions to fit mine including streamstat... by mbond81 Engager in Splunk Search 01-10-2016 0 1	0	1
Total number of searches in limits.conf and authorize.conf: Which option takes precedence? Hi, System Details: System Type: Virtual Machine Total CPUs: 8 vCPUs (4 cores. 4 * 2 =  Total Users: 1 The overrid... by strive Influencer in Splunk Search 01-09-2016 0 2	0	2
Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode? Hi, In a distributed mode with 1 search head and 4 indexers, when making a search through the search head, 2 of the ... by andrearodrigues Explorer in Splunk Search 01-09-2016 1 2	1	2
How to write a search to find who deleted or modified files on a Windows server for the last 24 hours? I am now very new to Splunk. I have installed a Splunk forwarder to monitor Window Security Logs, but would like also... by mattkun New Member in Splunk Search 01-08-2016 0 2	0	2
How to edit my search to get unique values based on JobName or jobid? Hi I am displaying a table which shows: table JobName, jobid, start, end ,diff using the following search. How ... by athorat Communicator in Splunk Search 01-08-2016 0 2	0	2
How to write a search to track the time when service assignment changes between multiple hosts? We have a system where, when a service name (a unique service name referenced by service=service_N where N=1 to 20) d... by thegeekthedude New Member in Splunk Search 01-08-2016 0 1	0	1
How to add values from search to subsearch results? I am looking for some help with a search. Below is an alert that runs every hour. It looks for some stuff in a index... by Splunkey_ New Member in Splunk Search 01-08-2016 0 10	0	10
Is there a way to find out the location of a given macro in a search head clustering environment? I am new to a search head clustering environment. I found macros being used and I am trying to find out where these ... by Thuan Explorer in Splunk Search 01-08-2016 0 2	0	2
Mapping fields and values using regex and transforms.conf I have a very ugly log file that I need to run a regex against and have it match as many times as possible to map the... by hlarimer Communicator in Splunk Search 01-08-2016 0 9	0	9
Would creating fields at index-time improve search optimization for a 15 month dataset? I've read the docs in the splunk manual on parse-time indexed fields. http://docs.splunk.com/Documentation/Splunk/6.1... by cantgetnosleep Explorer in Splunk Search 01-08-2016 1 8	1	8
How to make a Splunk table visualization more interactive? Hi, We are thinking of using Splunk to display data from many sources in a table view. I searched a lot and didn't ... by omerr Explorer in Splunk Search 01-08-2016 0 4	0	4
How to extract the _time value into a separate field? I have one index of iis logs which extracts the timestamp into a "timestamp" field. I have another index which reads ... by jpanderson Path Finder in Splunk Search 01-08-2016 1 4	1	4
Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment? I have an indexer cluster environment and need to delete the logs completely from the indexer: source=* sourcetype=*... by himapate Explorer in Splunk Search 01-08-2016 0 1	0	1
My eval statement works in the Search App, but why does it not work when it is created via Settings, Fields, Calculated Field or via props.conf? I'm able to create the following calculated field in the Search app. .... \| eval KCQueueDuration = (strptime(KCQStar... by lyanta Explorer in Splunk Search 01-08-2016 0 5	0	5
Has anyone created a scheduled search that notifies you if an app/add-on installed on search peers has an updated version on Splunkbase? Running a distributed environment, and certain servers of mine have internet access, but my deployment server and sea... by banderson7 Communicator in Splunk Search 01-08-2016 2 2	2	2
Search where hosts have an unrelated sourcetype I was refining an existing search/dashboard panel when I discovered that my hosts do not reliably follow a pattern. ... by tk15 Engager in Splunk Search 01-08-2016 0 5	0	5
How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search? chart list(ACCOUNT_ID) by script I am getting a chart with script and list of ACCOUNT_ID. I want only 5 ACCOUNT_I... by ARTHI Engager in Splunk Search 01-08-2016 0 3	0	3
How do I get an automatic lookup to populate a table, even if there are null values in the event logs for the matching field? Hello - This is my first time asking a question here. I receive a lot of answers by reading others' questions (thank ... by cchimento Path Finder in Splunk Search 01-07-2016 0 9	0	9
Is there a way to use a wildcard in field names when running a search? (ex: field*_name=X for field1_name, field2_name, etc) I have csv data indexed in Splunk. The fields are unique, but have some patterns: As an example, the following first... by splunknewbie05 Explorer in Splunk Search 01-07-2016 3 9	3	9

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

How can I do prediction with the different algorithms like clustering, sequence clustering, etc in Splunk?

Is it possible to show values in the column/bar chart?

How to write an eval search to fetch the value of field2 corresponding to field1?

Why does this python search script run twice?

declare a variable in search string

How to perform calculation on a field with a date 3 years ago, but only use the field for the latest date of that month?

How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour?

Total number of searches in limits.conf and authorize.conf: Which option takes precedence?

Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode?

How to write a search to find who deleted or modified files on a Windows server for the last 24 hours?

How to edit my search to get unique values based on JobName or jobid?

How to write a search to track the time when service assignment changes between multiple hosts?

How to add values from search to subsearch results?

Is there a way to find out the location of a given macro in a search head clustering environment?

Mapping fields and values using regex and transforms.conf

Would creating fields at index-time improve search optimization for a 15 month dataset?

How to make a Splunk table visualization more interactive?

How to extract the _time value into a separate field?

Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment?

My eval statement works in the Search App, but why does it not work when it is created via Settings, Fields, Calculated Field or via props.conf?

Has anyone created a scheduled search that notifies you if an app/add-on installed on search peers has an updated version on Splunkbase?

Search where hosts have an unrelated sourcetype

How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search?

How do I get an automatic lookup to populate a table, even if there are null values in the event logs for the matching field?

Is there a way to use a wildcard in field names when running a search? (ex: field*_name=X for field1_name, field2_name, etc)

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation