Splunk Search

Community Activity

How to count the status (ERROR or SUCCESS) for the list of clients accessing the application Hi, I am a newbie in Splunk Enterprise. I have to write a splunk query to get the status of the clients accessing the... by AmitKrJash Explorer in Splunk Search 12-11-2015 0 2	0	2
How do real-time searches identify both index and search-time fields if it processes data that hasn't been indexed yet? I have gone through the Splunk Docs. It's saying that real-time search is basically used to search events before they... by splunkn Communicator in Splunk Search 12-11-2015 0 1	0	1
Why is my regex in transforms.conf to filter Windows Events on a heavy forwarder not working? Hi, I'm using the Syslog server to gather all my Windows events. Right now, I'm trying to use a Splunk Heavy forward... by leonheart78 Explorer in Splunk Search 12-10-2015 0 4	0	4
Search for either of two values, given only one value I'm trying to lookup all lines that have EITHER a Matching Name or Phone, when given ONLY the Name to search for. And... by jhumkey Path Finder in Splunk Search 12-10-2015 0 6	0	6
Capturing the final value from the final event in a transaction? I have created a transaction that may contain one or more of these three log level types logLevels i.e. METRIC/INFO/W... by Dark_Ichigo Builder in Splunk Search 12-10-2015 1 5	1	5
After saving a search as an alert and choose "add to triggered alerts", why do I not see anything in triggered alerts? I have been trying to save a search as an alert and make sure I "add to triggered alerts". It appears under settings>... by CREVITCH Path Finder in Splunk Search 12-10-2015 0 1	0	1
How to track state changes for RDP sessions and generate a report show durations with start and end times? So I am looking for help, I guess I just found something I can't do with Splunk... and I know I'm wrong, only I can't... by sergiupopescu New Member in Splunk Search 12-10-2015 0 3	0	3
How do I create a faceted, multi-filter search with counting over multiple fields? I'm writing a generic search layer that allows our users to have drilldown, faceted search experience. This means tha... by lisardggy New Member in Splunk Search 12-10-2015 0 1	0	1
How do I extract these two fields from my sample data with regex? Hello, I have this log below and I would like to extract the field Message and Trace. When I use the regex created b... by rafasalo Engager in Splunk Search 12-10-2015 0 1	0	1
Loop through lookuptable to produce averages Hello Splunkers, I have static values (user groups) that I need to loop through to produce the results for each of t... by mikev Path Finder in Splunk Search 12-10-2015 0 6	0	6
How to search for transactions where the first event, A, happens 1 minute after the start of the search time range to deal with time drift? I am running a search for multiple events over a range of time. In that search, I want to only find events of one sp... by erichgess Engager in Splunk Search 12-10-2015 0 5	0	5
How to search a count of events by index-name every day and output a table with certain numeric and case formatting? All I want is a table like this with a little style: _time INDEX1 (events) INDEX2 (events) INDEX3 (eve... by crazyeva Contributor in Splunk Search 12-10-2015 0 4	0	4
Convert bytes to GB Splunk noob here. I've been visting this site for awhile now so i decided to create my own account so I can learn mor... by Eyb New Member in Splunk Search 12-10-2015 0 2	0	2
Why does our heavy forwarder host_regex configuration work for Linux, but not Windows? We are having issues getting Splunk to process log files in windows, The identical configuration works in linux. App... by murikadan Path Finder in Splunk Search 12-09-2015 0 5	0	5
Conditionaly Change form input variable value in the form search query I have a form that is doing SQL seach and Splunk Search using one veriable input text. When I want to use a wild car... by hartfoml Motivator in Splunk Search 12-09-2015 0 1	0	1
How to search for a field name that a value exists for? I've been noodling on a problem that I can't seem to easily solve. We are bringing in JSON documents that describe f... by ltrand Contributor in Splunk Search 12-09-2015 0 5	0	5
How can I add a name from a lookup CSV file to a tstats command data model? Hello Everyone, I want in my reports display the name of the owner instead of the IP address. My report right now s... by cesar_tomas Explorer in Splunk Search 12-09-2015 0 3	0	3
How to get a timechart with a backup source in case the preferred source does not exist? Hi, I have two different sourcetypes that I can graph like this: eventtype=mlc sourcetype=lts_timings host=X \| eva... by johnraftery Communicator in Splunk Search 12-09-2015 0 3	0	3
Can I use a search head in a search head pool to search both clustered and non-clustered indexers? Hi, I am running Splunk 6.1, using Search Head Pooling. Our search heads currently search indexers that are cluster... by a212830 Champion in Splunk Search 12-09-2015 0 1	0	1
How can I see my newly created field alias in a search? I added an alias field named event_type from the Splunk settings page, but I cannot find the new alias field in the s... by chimmi04 Explorer in Splunk Search 12-09-2015 0 2	0	2
Why would Search return results from old logfiles when newer ones exist. I want to search all the logs for my Device, they're txt files and the directory structure is like this: c:\program f... by _dave_b Communicator in Splunk Search 12-09-2015 0 4	0	4
How to combine two consecutive events into one based on the content of the first event? Hello, I would like to combine 2 events into one based on the content of the first one. So every time I find an ev... by DavidHourani Super Champion in Splunk Search 12-09-2015 2 10	2	10
How do we display percentage on a pie chart? I get below Pie chart for my SPL query . It is interactive shows the percentage when I place a mouse on the pie, ho... by praneethkodali Explorer in Splunk Search 12-09-2015 0 2	0	2
How can I create a chart for each column? I have 10 columns with the name of a server, and each server has its average per day. How can I create a panel for ea... by madisonAvalos Engager in Splunk Search 12-09-2015 0 5	0	5
Can search deal with bracket expansions? I'm using splunk in HPC use cases that can span hundreds or even thousands of machines contiguously or potentially in... by mjones414 Contributor in Splunk Search 12-09-2015 0 2	0	2

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community, What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Splunk Search

How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

How do real-time searches identify both index and search-time fields if it processes data that hasn't been indexed yet?

Why is my regex in transforms.conf to filter Windows Events on a heavy forwarder not working?

Search for either of two values, given only one value

Capturing the final value from the final event in a transaction?

After saving a search as an alert and choose "add to triggered alerts", why do I not see anything in triggered alerts?

How to track state changes for RDP sessions and generate a report show durations with start and end times?

How do I create a faceted, multi-filter search with counting over multiple fields?

How do I extract these two fields from my sample data with regex?

Loop through lookuptable to produce averages

How to search for transactions where the first event, A, happens 1 minute after the start of the search time range to deal with time drift?

How to search a count of events by index-name every day and output a table with certain numeric and case formatting?

Convert bytes to GB

Why does our heavy forwarder host_regex configuration work for Linux, but not Windows?

Conditionaly Change form input variable value in the form search query

How to search for a field name that a value exists for?

How can I add a name from a lookup CSV file to a tstats command data model?

How to get a timechart with a backup source in case the preferred source does not exist?

Can I use a search head in a search head pool to search both clustered and non-clustered indexers?

How can I see my newly created field alias in a search?

Why would Search return results from old logfiles when newer ones exist.

How to combine two consecutive events into one based on the content of the first event?

How do we display percentage on a pie chart?

How can I create a chart for each column?

Can search deal with bracket expansions?

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers

Some AD groups are not displaying when setting up ...

How to process BOTS data?

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

Splunk Search

Are you a member of the Splunk Community?