Splunk Search

Community Activity

How do I modify my search to output results in certain colors based on different ranges of percentage values? Hi Everyone, I have this query which is running and giving me the difference of errors from yesterday and today base... by tanhadil4vr New Member in Splunk Search 01-11-2016 0 1	0	1
How to show empty bins on my chart? Hello, I have my data between -1 and 1 and I want to show a distribution graph. I would like that the X axis is alwa... by pduflot Path Finder in Splunk Search 01-11-2016 1 10	1	10
How can I do prediction with the different algorithms like clustering, sequence clustering, etc in Splunk? How can I do prediction with the different algorithms like Clustering, Sequence Clustering, etc in Splunk? Splunk use... by Jaravuy New Member in Splunk Search 01-11-2016 0 3	0	3
Is it possible to show values in the column/bar chart? Checked the documentation of latest Splunk, and this function still not available. Anyone managed to get values showi... by Parameshwara Path Finder in Splunk Search 01-11-2016 1 7	1	7
How to write an eval search to fetch the value of field2 corresponding to field1? Hi all, How do I write an eval statement to fetch the value of field2 corresponding to field1? For example, consider... by muthvin New Member in Splunk Search 01-11-2016 0 18	0	18
Why does this python search script run twice? My background. . . (Heavy Unix, Shell, numerous programming languages. But new to Python and Splunk.) The intent ... by dwfarris Explorer in Splunk Search 01-11-2016 1 1	1	1
declare a variable in search string I have a search string (given below). Now I want to declare a variable named Os_Type, which based on the source type,... by Splunk_U Path Finder in Splunk Search 01-10-2016 1 8	1	8
How to perform calculation on a field with a date 3 years ago, but only use the field for the latest date of that month? I need to do calculations on fields where the Date is 3 years ago. However, there is a twist. I need to find this fie... by peterkn Explorer in Splunk Search 01-10-2016 0 2	0	2
How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour? I've scoured the Docs and Answers and haven't had any luck modifying their solutions to fit mine including streamstat... by mbond81 Engager in Splunk Search 01-10-2016 0 1	0	1
Total number of searches in limits.conf and authorize.conf: Which option takes precedence? Hi, System Details: System Type: Virtual Machine Total CPUs: 8 vCPUs (4 cores. 4 * 2 =  Total Users: 1 The overrid... by strive Influencer in Splunk Search 01-09-2016 0 2	0	2
Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode? Hi, In a distributed mode with 1 search head and 4 indexers, when making a search through the search head, 2 of the ... by andrearodrigues Explorer in Splunk Search 01-09-2016 1 2	1	2
How to write a search to find who deleted or modified files on a Windows server for the last 24 hours? I am now very new to Splunk. I have installed a Splunk forwarder to monitor Window Security Logs, but would like also... by mattkun New Member in Splunk Search 01-08-2016 0 2	0	2
How to edit my search to get unique values based on JobName or jobid? Hi I am displaying a table which shows: table JobName, jobid, start, end ,diff using the following search. How ... by athorat Communicator in Splunk Search 01-08-2016 0 2	0	2
How to write a search to track the time when service assignment changes between multiple hosts? We have a system where, when a service name (a unique service name referenced by service=service_N where N=1 to 20) d... by thegeekthedude New Member in Splunk Search 01-08-2016 0 1	0	1
How to add values from search to subsearch results? I am looking for some help with a search. Below is an alert that runs every hour. It looks for some stuff in a index... by Splunkey_ New Member in Splunk Search 01-08-2016 0 10	0	10
Is there a way to find out the location of a given macro in a search head clustering environment? I am new to a search head clustering environment. I found macros being used and I am trying to find out where these ... by Thuan Explorer in Splunk Search 01-08-2016 0 2	0	2
Mapping fields and values using regex and transforms.conf I have a very ugly log file that I need to run a regex against and have it match as many times as possible to map the... by hlarimer Communicator in Splunk Search 01-08-2016 0 9	0	9
Would creating fields at index-time improve search optimization for a 15 month dataset? I've read the docs in the splunk manual on parse-time indexed fields. http://docs.splunk.com/Documentation/Splunk/6.1... by cantgetnosleep Explorer in Splunk Search 01-08-2016 1 8	1	8
How to make a Splunk table visualization more interactive? Hi, We are thinking of using Splunk to display data from many sources in a table view. I searched a lot and didn't ... by omerr Explorer in Splunk Search 01-08-2016 0 4	0	4
How to extract the _time value into a separate field? I have one index of iis logs which extracts the timestamp into a "timestamp" field. I have another index which reads ... by jpanderson Path Finder in Splunk Search 01-08-2016 1 4	1	4
Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment? I have an indexer cluster environment and need to delete the logs completely from the indexer: source=* sourcetype=*... by himapate Explorer in Splunk Search 01-08-2016 0 1	0	1
My eval statement works in the Search App, but why does it not work when it is created via Settings, Fields, Calculated Field or via props.conf? I'm able to create the following calculated field in the Search app. .... \| eval KCQueueDuration = (strptime(KCQStar... by lyanta Explorer in Splunk Search 01-08-2016 0 5	0	5
Has anyone created a scheduled search that notifies you if an app/add-on installed on search peers has an updated version on Splunkbase? Running a distributed environment, and certain servers of mine have internet access, but my deployment server and sea... by banderson7 Communicator in Splunk Search 01-08-2016 2 2	2	2
Search where hosts have an unrelated sourcetype I was refining an existing search/dashboard panel when I discovered that my hosts do not reliably follow a pattern. ... by tk15 Engager in Splunk Search 01-08-2016 0 5	0	5
How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search? chart list(ACCOUNT_ID) by script I am getting a chart with script and list of ACCOUNT_ID. I want only 5 ACCOUNT_I... by ARTHI Engager in Splunk Search 01-08-2016 0 3	0	3

Get Updates on the Splunk Community!

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...

Join the Final Session of the Data Management & Federation Bootcamp Series

Over the past three sessions of the Data Management & Federation Bootcamp Series, we've explored how to build ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Search

How do I modify my search to output results in certain colors based on different ranges of percentage values?

How to show empty bins on my chart?

How can I do prediction with the different algorithms like clustering, sequence clustering, etc in Splunk?

Is it possible to show values in the column/bar chart?

How to write an eval search to fetch the value of field2 corresponding to field1?

Why does this python search script run twice?

declare a variable in search string

How to perform calculation on a field with a date 3 years ago, but only use the field for the latest date of that month?

How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour?

Total number of searches in limits.conf and authorize.conf: Which option takes precedence?

Why are reachable and searchable indexers not showing indexed data when searching in a distributed mode?

How to write a search to find who deleted or modified files on a Windows server for the last 24 hours?

How to edit my search to get unique values based on JobName or jobid?

How to write a search to track the time when service assignment changes between multiple hosts?

How to add values from search to subsearch results?

Is there a way to find out the location of a given macro in a search head clustering environment?

Mapping fields and values using regex and transforms.conf

Would creating fields at index-time improve search optimization for a 15 month dataset?

How to make a Splunk table visualization more interactive?

How to extract the _time value into a separate field?

Is there a search to delete logs completely from an indexer after 3 months in an indexer clustering environment?

My eval statement works in the Search App, but why does it not work when it is created via Settings, Fields, Calculated Field or via props.conf?

Has anyone created a scheduled search that notifies you if an app/add-on installed on search peers has an updated version on Splunkbase?

Search where hosts have an unrelated sourcetype

How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search?

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Final Session of the Data Management & Federation Bootcamp Series

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation