Splunk Search

Community Activity

Comparing login events from multiple applications I would like to construct a bar graph comparing login events between two applications however I'm having trouble join... by rjm101 New Member in Splunk Search 11-28-2015 0 3	0	3
need help with a query to get count and avg(count) per day I have given this query and it's just giving me avg(count) in the output, i'm looking for both count and avg(count) p... by prakash007 Builder in Splunk Search 11-28-2015 0 1	0	1
Why am I getting error "In handler 'props-extract': Data could not be written:" after configuring extractions for custom fields? Hello, I had created some custom fields in my original Splunk Install, then I installed on a new server. I'm tryin... by _dave_b Communicator in Splunk Search 11-27-2015 1 4	1	4
Joining 3 sets of results from 2 indexes to graph Say in table A I have just 1 column result: Animal: Chicken Chicken Cow Cat Cow Cow Dog My query of "stats count ... by peterkn Explorer in Splunk Search 11-27-2015 0 2	0	2
How can I break this two events? Hello!!! Can you help me to break this two events, they must separated with this expression WORD WORD WORD We ha... by prianticoy Explorer in Splunk Search 11-27-2015 0 2	0	2
How do I create an alert when Splunk sees a transaction that is missing a certain log event, but avoid false positives? Hi, I have something like the following, where I have a message producer and consumer. I am using ActiveMQ for mess... by servlette Engager in Splunk Search 11-27-2015 0 4	0	4
How do I write a search to extract key/value pairs from this Windows Event Log? Hi, I am looking for a search to extract the name/value pair from the below Windows Event logs and in Splunk, the b... by Thyagarajan New Member in Splunk Search 11-27-2015 0 3	0	3
Extract date and time in a specific format Hi, I'm trying to figure out how to extract date and time in a specific format. The date in the logs are in this fo... by horsefez Motivator in Splunk Search 11-26-2015 0 2	0	2
Is it possible to use the transaction command to create several transactions in parallel based on distinct fields in the same search using e.g. XOR? Hi everyone! To save resources, I want to combine several scheduled alerts into one. Each of the alerts is running a... by hettervik Builder in Splunk Search 11-26-2015 0 8	0	8
How to search the count of keywords for each individual event, not for all events? How do I count the number of times keywords such as DROP, SELECT, FROM and WHERE appear for each event I have indexed... by adaam94 Explorer in Splunk Search 11-26-2015 0 3	0	3
What does 'ERROR IndexProcessor - caught exception for index=os during initialzation: 'Splunk has detected that a directory has been manually copied into its database, causing id conflicts" mean? I had to migrate a some indexes over from one instance to another. All worked but the 'os' index, and I'm seeing this... by mctester Communicator in Splunk Search 11-25-2015 2 2	2	2
How to write the regex to split a single event to multiple events after a particular number of characters in a string? Hi, I am trying to split an event to multiple events. I want to split after 12th character. The string contains spac... by jyothishtj New Member in Splunk Search 11-25-2015 0 6	0	6
How do I edit my search to get both subtotals and the grand total? hi, Is it possible to get subtotals? I have attached a file of how my output looks like. I want subtotals by Cluste... by Laya123 Communicator in Splunk Search 11-25-2015 0 11	0	11
Why am I getting different results for essentially the same search? Hi All; Here's my issue. I'm trying to search data where a single event appears as below. When I use the search: in... by tdiestel Path Finder in Splunk Search 11-25-2015 1 8	1	8
What regular expression can be used to extract literals between slashes? Ex: /nfs/tibcosoftware/splunk/impactAnalysis/freight/ConwayServicesOMSEvents/1.01-49/AESchemas /nfs/tibcosoftware/s... by raghunand Explorer in Splunk Search 11-25-2015 0 7	0	7
How do I search for and combine Windows event pairs (4663 and 4660) that are generated when a file is deleted? I want to find exact events that point to a delete file event in Windows share. There are two events generated at th... by DimkoBilanko Explorer in Splunk Search 11-25-2015 0 4	0	4
How do I merge these search results into one line? Is there a way to combine the following the following result into one line? Current Result: q2.example.com 26,575.... by leochan Explorer in Splunk Search 11-25-2015 0 4	0	4
Joining 2 Indexes by JSESSION I have 2 indexes which both have a common filed (JSESSIONID).. One index has an IndexOutOfBoundsException and another... by skoelpin SplunkTrust in Splunk Search 11-25-2015 0 7	0	7
How do I join data between an index and lookup table or two indexes? Hi there! I have an issue. On one hand, I have an index with a lot of information and duplicated values. And on the... by marina_rovira Contributor in Splunk Search 11-25-2015 1 2	1	2
How do I create the regex to extract this field from my sample data? I have a events like below in my servers so I want write a search to extract tps(cur) value in a table format with _... by Splunk_rocks Path Finder in Splunk Search 11-25-2015 0 2	0	2
Incorrect Regex Hi, I wonder whether someone may be able to help me please. I've created this regex \"Surname\\":\\"(?<SName>[... by IRHM73 Motivator in Splunk Search 11-25-2015 0 4	0	4
How do I use the eval "lower" function to make a field lowercase? Hi, I wonder whether someone may be able to help me please. I'm trying to make changes to the partial script below t... by IRHM73 Motivator in Splunk Search 11-25-2015 1 5	1	5
How to write a search to organize data from a CSV file into a table format? I am trying to arrange some information received in a CSV file in a table format (as per example) The two searches I... by denisevw Path Finder in Splunk Search 11-25-2015 0 3	0	3
Indexed Real Time Search Some questions about indexed rt (http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Aboutrealtimesearches#Index... by bwalden_splunk Splunk Employee in Splunk Search 11-25-2015 1 4	1	4
How to get BIOS information like temp and power consumption? I need to know how to get temperature and power consumption of my linux pc. How can I do it? Thanks in advance. by josefa123 Explorer in Splunk Search 11-25-2015 0 3	0	3

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

Comparing login events from multiple applications

need help with a query to get count and avg(count) per day

Why am I getting error "In handler 'props-extract': Data could not be written:" after configuring extractions for custom fields?

Joining 3 sets of results from 2 indexes to graph

How can I break this two events?

How do I create an alert when Splunk sees a transaction that is missing a certain log event, but avoid false positives?

How do I write a search to extract key/value pairs from this Windows Event Log?

Extract date and time in a specific format

Is it possible to use the transaction command to create several transactions in parallel based on distinct fields in the same search using e.g. XOR?

How to search the count of keywords for each individual event, not for all events?

What does 'ERROR IndexProcessor - caught exception for index=os during initialzation: 'Splunk has detected that a directory has been manually copied into its database, causing id conflicts" mean?

How to write the regex to split a single event to multiple events after a particular number of characters in a string?

How do I edit my search to get both subtotals and the grand total?

Why am I getting different results for essentially the same search?

What regular expression can be used to extract literals between slashes?

How do I search for and combine Windows event pairs (4663 and 4660) that are generated when a file is deleted?

How do I merge these search results into one line?

Joining 2 Indexes by JSESSION

How do I join data between an index and lookup table or two indexes?

How do I create the regex to extract this field from my sample data?

Incorrect Regex

How do I use the eval "lower" function to make a field lowercase?

How to write a search to organize data from a CSV file into a table format?

Indexed Real Time Search

How to get BIOS information like temp and power consumption?

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation