Splunk Search

Community Activity

I see the wineventlog index growing after universal forwarder installation on Windows, but why are there no Windows events in the Search app Data Summary? Greetings all! I haven't worked with Splunk in about a year so I'm a little rusty. Anyhow, I have Linux systems log... by sdorsey15 New Member in Splunk Search 12-07-2015 0 3	0	3
Why is the stats command wiping out a custom extracted field from my search results? Hello. if I run a search like this: "..." \| dedup 2 correlationId \| eval EpochTime = _time \| eval nowTimeEpoch=tim... by _dave_b Communicator in Splunk Search 12-07-2015 0 3	0	3
How to search the count of emails sent between two addresses using mailto and mailfrom fields? Hello, I would like to count the number of emails by couples. For example: A sent 2 emails to B B sent 1 email to A ... by ctaf Contributor in Splunk Search 12-07-2015 0 6	0	6
How do I remove unique IDs from error logs and stacktraces in a search in order to group and count similar errors? Hi all, I want to count similar errors and stacktraces in order to prioritize them. I have a search that works in ... by adseros Engager in Splunk Search 12-07-2015 0 2	0	2
Metadata Management My companies Splunk data set is getting large. (Although I know some people would consider the numbers I'm talking ab... by jplumsdaine22 Influencer in Splunk Search 12-07-2015 0 4	0	4
「属性の追加」で自動検出されないデータの取込み後、「属性の追加」で自動検出されません。 V.６．０を使用し、ソースタイプをCSVにした場合は検出されます。データフォーマット個別にソースタイプを作成することが良いと認識していますが、原因と対応方法をご教示ください。 by masagara8823 Explorer in Splunk Search 12-06-2015 0 4	0	4
Using stats with a by on 2 fields works, but how can I do this with timechart? Using stats with a by on 2 fields works: ...\| stats max(kpi1) as "kpi1" max(kpi2) as "kpi2" by field1 field2 but c... by HattrickNZ Motivator in Splunk Search 12-06-2015 0 3	0	3
How do redirect my web page to the Splunk search page? Getting "Invalid earliest_time" i want to redirect my web page to splunk search page I'm using this URL: http://x.x.x.x:xxxx/en-US/app/xxxx/search?... by snabel Path Finder in Splunk Search 12-06-2015 0 1	0	1
JOINのON句について１．source="date1"\| JOIN type=inner join col1[ SEARCH source="data1" ]で抽出件数が絞られまん。また、２．source="date1"\| JOIN type=in... by masagara8823 Explorer in Splunk Search 12-05-2015 0 4	0	4
How to write a search to display a bar graph with span=1d? I have a search looking for 7 days of data and one field below. STATUS="Delivered","created","released","Awaiting Del... by thippeshaj Explorer in Splunk Search 12-05-2015 0 5	0	5
How to compare results of same search for two different time ranges without using timechart? I have logs which tell me the service name, time and domain name where this service was called. I have a query to ch... by ashbhaic Explorer in Splunk Search 12-05-2015 1 2	1	2
subtraction doesn't work for multiple values in one field I managed to create a table that somewhat looks like this: However, when I tried to append a new column with the di... by almond14 Engager in Splunk Search 12-05-2015 0 2	0	2
Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6) I have a need to accept data from multiple servers. WIll something like this work? [tcp://192.168.1.0\/24:9999] I... by the_wolverine Champion in Splunk Search 12-05-2015 0 4	0	4
How do I match a field to a variable? I've got a query that will have a string passed into it. In this case, it's "2-Low". I need to parse out the number a... by kkatzgraukeyw Explorer in Splunk Search 12-05-2015 0 5	0	5
After upgrade to a Splunk 6.2 indexer cluster, why do searches hang with high memory consumption and we're forced to restart? Hi, We've recently upgraded to a Splunk 6.2 indexer cluster, but we're finding that searches will hang and the syste... by rchan11 Explorer in Splunk Search 12-05-2015 0 3	0	3
How to parse a json tree into a table? the following seach string basically pulls out the JSON puts it in a variable called data and then runs it through sp... by bradyguy Engager in Splunk Search 12-04-2015 0 4	0	4
Returning results only if field has more than one unique name I am looking to create a unique alert that would look at virus activity. The idea is to get a real time alert in a 60... by santorof Communicator in Splunk Search 12-04-2015 0 9	0	9
How to apply a rangemap to string values? Hi Splunkers! I am running the following search to try and apply a "low" rangemap value if a string matches "up", an... by butzowj Path Finder in Splunk Search 12-04-2015 0 2	0	2
How do I add my company Entitlement to my user ID in order to open support cases with Splunk? Hello, I am trying to add my company Entitlement to my user ID in order to have the possibility to open Support Cas... by djmcint Explorer in Splunk Search 12-04-2015 0 4	0	4
Trying to get difference between _time and _indextime in secs format Tried using below search, but can't get result. I get null values in diff: XXX\| eval indextime=strftime(_indextime,"... by vinay4444 Explorer in Splunk Search 12-04-2015 0 5	0	5
Is it possible to use a field's value as a field name for the join command? I've got an index full of events that have hostname, and some have macaddr. I'm trying to join it to another set of e... by ITSX Explorer in Splunk Search 12-04-2015 0 3	0	3
How do I extract this date and time from a string in the format YYYYMMDDHHMMSS, and output it as DD:MM:YYYY HH:MM:SS AM? Hi, I have a search that gives me the following output: /u01/splunk/etc/apps/sampleApp/data/order-20151203120002.lo... by nilotpaldutta Explorer in Splunk Search 12-03-2015 0 3	0	3
ミリセカンドの表示方法について tableコマンドで _timeフィールドを表示するとミリセカンドが表示されません。ミリセカンドまで表示させるにはどうすればいいでしょうか？ by Shisa Explorer in Splunk Search 12-03-2015 0 1	0	1
Python alert script to show the search result values Can someone please help me with a python script to display the values of search results. i have been trying but not a... by harish_ka Communicator in Splunk Search 12-03-2015 0 7	0	7
How to combine multiple complicated searches? Hi everyone, I have these 3 searches, and they are all complicated as it looks. Any idea on how to combine them? I... by s0rbeto Explorer in Splunk Search 12-03-2015 0 1	0	1

Get Updates on the Splunk Community!

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026 | 10:00AM PT / ...

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

Inside Splunk Agent Observability:Understanding Agent Behavior, Tokens & Costs Thursday, August 06, ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Search

I see the wineventlog index growing after universal forwarder installation on Windows, but why are there no Windows events in the Search app Data Summary?

Why is the stats command wiping out a custom extracted field from my search results?

How to search the count of emails sent between two addresses using mailto and mailfrom fields?

How do I remove unique IDs from error logs and stacktraces in a search in order to group and count similar errors?

Metadata Management

「属性の追加」で自動検出されない

Using stats with a by on 2 fields works, but how can I do this with timechart?

How do redirect my web page to the Splunk search page? Getting "Invalid earliest_time"

JOINのON句について

How to write a search to display a bar graph with span=1d?

How to compare results of same search for two different time ranges without using timechart?

subtraction doesn't work for multiple values in one field

Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

How do I match a field to a variable?

After upgrade to a Splunk 6.2 indexer cluster, why do searches hang with high memory consumption and we're forced to restart?

How to parse a json tree into a table?

Returning results only if field has more than one unique name

How to apply a rangemap to string values?

How do I add my company Entitlement to my user ID in order to open support cases with Splunk?

Trying to get difference between _time and _indextime in secs format

Is it possible to use a field's value as a field name for the join command?

How do I extract this date and time from a string in the format YYYYMMDDHHMMSS, and output it as DD:MM:YYYY HH:MM:SS AM?

ミリセカンドの表示方法について

Python alert script to show the search result values

How to combine multiple complicated searches?

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation