Splunk Search

Community Activity

How to write a search to get a list of all the source files that were indexed today? Hi Team, I have a forwarder installed and configured to forward logs that it is receiving daily. The timestamp in th... by rakesh_498115 Motivator in Splunk Search 12-21-2015 0 5	0	5
Splunk _time is not working with Inner join We have an inner join on two indexes. When we are querying with time controller its not showing data properly with To... by sarfarajsayyad New Member in Splunk Search 12-21-2015 0 8	0	8
How do get the combined search result? I want to get the combined result of two events. E.g The first event have reference ID, Name & IP and the second even... by kamaleshwar Explorer in Splunk Search 12-20-2015 0 1	0	1
How to run Splunk searches in a custom REST endpoint? I have implemented a custom rest end point and it's working. Now I have another requirement to run Splunk searches in... by i2sheri Communicator in Splunk Search 12-20-2015 0 3	0	3
After deploying a new app to our search head cluster, why am I getting search error "Search process did not exit cleanly, exit_code=255"? Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for... by i2sheri Communicator in Splunk Search 12-20-2015 0 10	0	10
unable to process binary log file i have splunkforwarder running but once a while we run into issue with the following error about file being binary - ... by clearslide_cwon New Member in Splunk Search 12-19-2015 0 5	0	5
Why am I unable to match two fields from two sourcetypes using mode=sed with rex? I have two sourcetypes that have URL fields. I am attempting to remove the . so that both fields are just letters an... by jbarto New Member in Splunk Search 12-19-2015 0 7	0	7
Splunk Api query returns inconsistent results Hello, I am getting inconsistent results from splunk for below queries. query1: search index=index01 AND status=su... by cse9423 Explorer in Splunk Search 12-19-2015 0 2	0	2
How to edit my current search to convert table data into a timechart or chart? Hello - I am currently looking to create a timechart or chart (line or bar graph) to display table data I have creat... by fisuser1 Contributor in Splunk Search 12-19-2015 0 5	0	5
Difference of fields with the same name in a transaction Given data of the form: [OPEN PLAN START] Guid=358846c0a0e9, AvailRAM=4555 ... [OPEN PLAN END] Guid=358846c0a0e9, Ava... by RVDowning Contributor in Splunk Search 12-19-2015 2 3	2	3
How can I use the output from a previous search to use as a time range on my next search? I have a filter that extracts the date and time just like below. index=_server _raw="completed" \| head 1 \| eval en... by norbertkiammacl Explorer in Splunk Search 12-19-2015 0 3	0	3
How to use eval with the asterisk wildcard character as the default value for my token? I am trying to format a token in my form and then apply the token value to my search. This works just fine when I use... by vijvenug Explorer in Splunk Search 12-18-2015 0 4	0	4
How to sum a field and group by another - but remove first entry per group? I have a search that sorts events by a field (SYMBOL) . My issue is that I want to sum the duration between events by... by GK1982 New Member in Splunk Search 12-18-2015 0 2	0	2
How to write my token for a drop-down list search on my dashboard? Hi all, I wanted to know if someone can help me figure out how to write my token for the following drop-down list s... by fmpa_isaac Path Finder in Splunk Search 12-18-2015 0 2	0	2
How to count the number of recipients getting an email from a specific domain. I have my search currently showing a count of one email to each user when I send a test email. I want to be able to t... by Mitchellsch Explorer in Splunk Search 12-18-2015 0 4	0	4
Lost SDEE connection to Cisco IPS after upgrading from 6.2 to 6.3. The SDEE Troubleshooting search shows a successful connection to the IPS but errors on an unexpected keyword argument... by kevinsplunkdotc Explorer in Splunk Search 12-18-2015 1 17	1	17
What are OTHER and VALUE data generated by doing a geostats count by Region on Splunk maps? I'm doing a geostats count by Region (after doing an iplocation on my customer's ip): 1) if data is put into "OTHER",... by halkelley Path Finder in Splunk Search 12-18-2015 0 5	0	5
Usinig Windows Storage Server 2012 as the Event collector and Splunk forwarder. Hi all, Is it available using Windows Storage Server 2012 as the Event collector and Splunk forwarder which gather ... by yn03594042 New Member in Splunk Search 12-18-2015 0 1	0	1
How do I extract these fields from Avaya CDR logs that are currently missing from search results? Hello, We have avaya phones in our environment and logs are being populated to Splunk. We need to get some basic rep... by kgangulw Engager in Splunk Search 12-17-2015 0 2	0	2
How to create a search to find user ID's that are fraudulently using rewards for a retail business based on multiple uses of the same reward? Hi Business - Retailer Requirement - I need to know how to create a search for rewards announcements in a retail bus... by Rias New Member in Splunk Search 12-17-2015 0 5	0	5
Regex help Hello, Would anyone know the regex value for the final numeric value after the last comma in the following log entr... by agoktas Communicator in Splunk Search 12-17-2015 0 7	0	7
Divide a severity count by host count in a timechart Hi folks, I guess what I am trying to do is create a timechart based on a scan events severity rating(low, med, high... by jravida Communicator in Splunk Search 12-17-2015 0 2	0	2
If I have a process id that fails to log in to Splunk, how can I find out what the failure was? I ran this search: index=_audit action=failure \| stats count by _time,user,action which returned a desired result ... by MikeBertelsen Communicator in Splunk Search 12-17-2015 0 2	0	2
How to define a data filter in order to apply different fields extractions for 2 different events from the same source? Hello, I am new to Splunk Enterprise Here is my problem: I have a data source in the form of text files which cont... by dhantran New Member in Splunk Search 12-17-2015 0 1	0	1
Why am I unable to extract fields from multiline events with my current props.conf configuration? Hi All, I am trying to extract fields from multiline events which were injected from our server to Splunk. We have ... by kiranamex New Member in Splunk Search 12-17-2015 0 2	0	2

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...

Splunk Search

How to write a search to get a list of all the source files that were indexed today?

Splunk _time is not working with Inner join

How do get the combined search result?

How to run Splunk searches in a custom REST endpoint?

After deploying a new app to our search head cluster, why am I getting search error "Search process did not exit cleanly, exit_code=255"?

unable to process binary log file

Why am I unable to match two fields from two sourcetypes using mode=sed with rex?

Splunk Api query returns inconsistent results

How to edit my current search to convert table data into a timechart or chart?

Difference of fields with the same name in a transaction

How can I use the output from a previous search to use as a time range on my next search?

How to use eval with the asterisk wildcard character as the default value for my token?

How to sum a field and group by another - but remove first entry per group?

How to write my token for a drop-down list search on my dashboard?

How to count the number of recipients getting an email from a specific domain.

Lost SDEE connection to Cisco IPS after upgrading from 6.2 to 6.3.

What are OTHER and VALUE data generated by doing a geostats count by Region on Splunk maps?

Usinig Windows Storage Server 2012 as the Event collector and Splunk forwarder.

How do I extract these fields from Avaya CDR logs that are currently missing from search results?

How to create a search to find user ID's that are fraudulently using rewards for a retail business based on multiple uses of the same reward?

Regex help

Divide a severity count by host count in a timechart

If I have a process id that fails to log in to Splunk, how can I find out what the failure was?

How to define a data filter in order to apply different fields extractions for 2 different events from the same source?

Why am I unable to extract fields from multiline events with my current props.conf configuration?

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation