Splunk Search

Community Activity

Splunk DB Connect with Microsoft SQL Database: Why do I keep getting error "Connection refused"? I realize this question has already been posted, but none of the answers have helped me. I have followed this documen... by djarmoluk Explorer in Splunk Search 12-14-2015 0 9	0	9
How to configure props and transforms.conf to only index a few fields and ignore the other fields? I tried all the possible things in Splunk, but couldn't index only some part of the file. For example: 2015/11/30 1... by allan_newton Path Finder in Splunk Search 12-14-2015 0 5	0	5
Using inputlookup on a CSV file in searches, why do results only get displayed in the Statistics and Visualization tabs, not the Events tab? I have an excel file (CSV), which I add as a lookup and do searches using inputlookup. The search results only gets d... by pradiptam Explorer in Splunk Search 12-14-2015 0 2	0	2
How to get a variable from first search and pass to subsearch? There are 2 kinds of log: one is error log the other is access log. In error log, there is a field requestUrl. value... by amylala Explorer in Splunk Search 12-13-2015 0 5	0	5
How do I list valid sids for a loadjob command programmatically/by subsearch? \| loadjob <sid> savedsearch="admin:search:test2" sids looks like the epoch time of the job start time. How do I lis... by hylam Contributor in Splunk Search 12-13-2015 0 1	0	1
How do I deal with Linux auth.log "Last Message Repeated" log lines when trying to get a count of identical events over a time period. I'm trying to read in some logs on a Solaris system to check for users failing a login N times over Y seconds. Cur... by ksextonmacb Path Finder in Splunk Search 12-13-2015 1 6	1	6
How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? I'm trying to count the number of occurrences of a field WITH values and the number of the same field WITHOUT values ... by pontorito Explorer in Splunk Search 12-12-2015 0 6	0	6
Does anyone have examples of using RegEx to convert a Syslog event to a delimited string? I would like to convert a syslog event (no delimiters) to a delimited input at the Universal Forwarder. This would al... by fdarrigo Path Finder in Splunk Search 12-12-2015 0 1	0	1
Summary by domains and data size Hello Splunkers, I have this query which looks for HTTPS connections on web proxy layer made by users when there is ... by kestasm Path Finder in Splunk Search 12-12-2015 0 1	0	1
How to write a search which exclude events found in another source based on some string? Hi, I am facing difficulties in forming one search. Details are following. Two different searches, Search1: sour... by vickydada New Member in Splunk Search 12-11-2015 0 2	0	2
Create time range for each customer from adjacent time Hi, Originally I generated a table from a Splunk query in the following form: CustomerID SeenTime 1234 8/5/2015... by xiangtaner Path Finder in Splunk Search 12-11-2015 0 4	0	4
How to use REX to extract the text within brackets prior to a key word? I'd like to be able to extract the text within the brackets that is prior to the text that I'll be filtering on, [Err... by CAB2015 New Member in Splunk Search 12-11-2015 0 2	0	2
Divide Time Chart Results by 2 index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appn... by kmccowen Path Finder in Splunk Search 12-11-2015 0 4	0	4
How to change the order of dynamic columns based on count? There is a requirement to change the order of columns on the basis of count. for eg. A B C D 4 2 1 3 output should ... by splunk24 Path Finder in Splunk Search 12-11-2015 0 1	0	1
Sum up all the values using a delimiter when corresponding keys are different I have Splunk logs as shown in below format from a Kafka server's topic metadata. Topic#No_Partion#No = [F1,F2,F3] ... by vpuneeth007 New Member in Splunk Search 12-11-2015 0 1	0	1
How to assign a range in REGEX for filtering search results? welcome to india : 0 welcome to india : 45 welcome to india : 123 welcome to india : 4999 welcome to india : 5000 wel... by Madhan45 Path Finder in Splunk Search 12-11-2015 0 2	0	2
How can I create a chart using the value for each drive in my sample data? Hello I have the following event. Is there any way to create a chart using the value for each drive? Thank you in a... by andrei1bc Communicator in Splunk Search 12-11-2015 0 1	0	1
How do I search for irregularities in the sequence of events? Hi, I have created a search to get the order of specified Events from hosts. index=*SC "SPK CONLOC SERVER RECEIVED ... by zhonk Explorer in Splunk Search 12-11-2015 0 4	0	4
How do I optimize the performance of this search with appendcols? Hi , Can any one help with fine tuning this search? It's taking a long time to load. index=me sourcetype=access_apa... by vranjith009 New Member in Splunk Search 12-11-2015 0 4	0	4
How to count the status (ERROR or SUCCESS) for the list of clients accessing the application Hi, I am a newbie in Splunk Enterprise. I have to write a splunk query to get the status of the clients accessing the... by AmitKrJash Explorer in Splunk Search 12-11-2015 0 2	0	2
How do real-time searches identify both index and search-time fields if it processes data that hasn't been indexed yet? I have gone through the Splunk Docs. It's saying that real-time search is basically used to search events before they... by splunkn Communicator in Splunk Search 12-11-2015 0 1	0	1
Why is my regex in transforms.conf to filter Windows Events on a heavy forwarder not working? Hi, I'm using the Syslog server to gather all my Windows events. Right now, I'm trying to use a Splunk Heavy forward... by leonheart78 Explorer in Splunk Search 12-10-2015 0 4	0	4
Search for either of two values, given only one value I'm trying to lookup all lines that have EITHER a Matching Name or Phone, when given ONLY the Name to search for. And... by jhumkey Path Finder in Splunk Search 12-10-2015 0 6	0	6
Capturing the final value from the final event in a transaction? I have created a transaction that may contain one or more of these three log level types logLevels i.e. METRIC/INFO/W... by Dark_Ichigo Builder in Splunk Search 12-10-2015 1 5	1	5
After saving a search as an alert and choose "add to triggered alerts", why do I not see anything in triggered alerts? I have been trying to save a search as an alert and make sure I "add to triggered alerts". It appears under settings>... by CREVITCH Path Finder in Splunk Search 12-10-2015 0 1	0	1

Get Updates on the Splunk Community!

Index This | What has goals but no motivation?

June 2026 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

Splunk DB Connect with Microsoft SQL Database: Why do I keep getting error "Connection refused"?

How to configure props and transforms.conf to only index a few fields and ignore the other fields?

Using inputlookup on a CSV file in searches, why do results only get displayed in the Statistics and Visualization tabs, not the Events tab?

How to get a variable from first search and pass to subsearch?

How do I list valid sids for a loadjob command programmatically/by subsearch?

How do I deal with Linux auth.log "Last Message Repeated" log lines when trying to get a count of identical events over a time period.

How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk?

Does anyone have examples of using RegEx to convert a Syslog event to a delimited string?

Summary by domains and data size

How to write a search which exclude events found in another source based on some string?

Create time range for each customer from adjacent time

How to use REX to extract the text within brackets prior to a key word?

Divide Time Chart Results by 2

How to change the order of dynamic columns based on count?

Sum up all the values using a delimiter when corresponding keys are different

How to assign a range in REGEX for filtering search results?

How can I create a chart using the value for each drive in my sample data?

How do I search for irregularities in the sequence of events?

How do I optimize the performance of this search with appendcols?

How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

How do real-time searches identify both index and search-time fields if it processes data that hasn't been indexed yet?

Why is my regex in transforms.conf to filter Windows Events on a heavy forwarder not working?

Search for either of two values, given only one value

Capturing the final value from the final event in a transaction?

After saving a search as an alert and choose "add to triggered alerts", why do I not see anything in triggered alerts?

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation