Splunk Search

Community Activity

Incorrect Regex Hi, I wonder whether someone may be able to help me please. I've created this regex \"Surname\\":\\"(?<SName>[... by IRHM73 Motivator in Splunk Search 11-25-2015 0 4	0	4
How do I use the eval "lower" function to make a field lowercase? Hi, I wonder whether someone may be able to help me please. I'm trying to make changes to the partial script below t... by IRHM73 Motivator in Splunk Search 11-25-2015 1 5	1	5
How to write a search to organize data from a CSV file into a table format? I am trying to arrange some information received in a CSV file in a table format (as per example) The two searches I... by denisevw Path Finder in Splunk Search 11-25-2015 0 3	0	3
Indexed Real Time Search Some questions about indexed rt (http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Aboutrealtimesearches#Index... by bwalden_splunk Splunk Employee in Splunk Search 11-25-2015 1 4	1	4
How to get BIOS information like temp and power consumption? I need to know how to get temperature and power consumption of my linux pc. How can I do it? Thanks in advance. by josefa123 Explorer in Splunk Search 11-25-2015 0 3	0	3
Why would the lookup definition for kvstore type be missing in a Splunk 6.2.x search head clustering environment? Just finished setting up a kvstore collection within the collections.conf and pushed it out through the deployer to o... by amirofmn Explorer in Splunk Search 11-24-2015 0 1	0	1
How to search for overlapping events that occurred on the same host? Given the Splunk result set in the attached screenshot, I'd like to formulate a search that finds all overlapping eve... by mitchabaza Explorer in Splunk Search 11-24-2015 0 3	0	3
Why am I getting error "kv store disabled in this splunk distribution" running "\|inputlookup kvstore_lookup" in Splunk Free version 6.3? I'm getting this error while executing \|inputlookup kvstore_lookup kv store disabled in this splunk distribution i... by splunk24 Path Finder in Splunk Search 11-24-2015 0 1	0	1
How to determine the delta between events based on a shared field value? I've got ifconfing reporting dropped packets every 10 minutes. Because that value never rolls over until the NIC goes... by thisissplunk Builder in Splunk Search 11-24-2015 1 5	1	5
How to search the difference between two values that share the same field name from two different sourcetypes? I'm trying to get the difference between two values that share the same field name from two different sourcetypes tha... by jp28 New Member in Splunk Search 11-24-2015 0 1	0	1
search the latest event by key I have these events 2013-10-13T12:00:25+0000 {"id":1, "meta":["a", "b"]} 2013-10-13T12:10:11+0000 {"id":1, "meta":["... by wood1986 Explorer in Splunk Search 11-24-2015 0 3	0	3
How to add a Date Field into my search and dashboard in Splunk Light? Hi, I'm completely new to Splunk and using Light version for evaluation. How can I add a date field into my search a... by dvadithala New Member in Splunk Search 11-24-2015 0 3	0	3
How do I write the regex to capture the database name and major version from my sample data? I am struggling with the regex match on the below pattern. I need to capture major version name from below ( DB2 9.7,... by vinay4444 Explorer in Splunk Search 11-24-2015 0 7	0	7
Search field names with spaces in map command inner search I have data from a sourcetype that I am searching with a map command like so: source=outersearch \| map search="sear... by ErikaE Communicator in Splunk Search 11-24-2015 0 2	0	2
How can i use stats in below mentioned Query? Find below mentioned data Applicationname \|Partners \| Servicename \| status DEE \| WEEEEE \|Money Transfer\|Suc... by shankaranantht New Member in Splunk Search 11-24-2015 0 6	0	6
Enrich event with number of business days till end of the month I would like to include an evaluated field to the events returned in the search containing the number of business day... by SP987541 Explorer in Splunk Search 11-24-2015 1 4	1	4
How could I dynamically exclude events from search results? Hello All, I'm working on a new query for one of our SIP (VoIP) dashboards. In the SIP world, each call has a unique... by bpitts2 Path Finder in Splunk Search 11-23-2015 0 1	0	1
How do I edit my search with appendpipe and subsearch to append subtotals under each individual user, not at the end? Here is my search: sourcetype="xyz" [search sourcetype="abc" "Threshold exceeded"\| top user limit=3 \| fields user] ... by GirolamoBo Explorer in Splunk Search 11-23-2015 0 4	0	4
How to set a Static threshold value on Line chart Here is my search for transaction response times on web logs: index=bridger sourcetype=bridger_wbs_txns User_ID=rtm_... by Anne_Landry Explorer in Splunk Search 11-23-2015 0 1	0	1
Hunk: setting vix.nfs.dump.dir when jobs fail due to no space left on device We are running Hunk/Splunk 6.3.1 with Hive. We saw some tasks for Hunk jobs failing due to no space left on device e... by burwell SplunkTrust in Splunk Search 11-23-2015 0 1	0	1
Matching an IP address across two sourcetypes I am trying to get matching IP address's from my asset list and another device. My source1 does not have a username a... by santorof Communicator in Splunk Search 11-23-2015 0 2	0	2
foreach for mv fields? I've got a search which uses a transaction command to combine a few log events together. As a result, I have a field... by smisplunk Path Finder in Splunk Search 11-23-2015 1 5	1	5
datamodel not able to plot timechart I have simple datamodel, which I am using as query and want to plot time chart series. Now I am not able to plot anyt... by sumitnagal Path Finder in Splunk Search 11-23-2015 2 12	2	12
How do I edit my search to output unique values per host? Any help would be much appreciated here.. Here's my search: index=main host=host1* source=server.log "exception"... by prakash007 Builder in Splunk Search 11-23-2015 0 3	0	3
not able to extract fields using TRANSFORMS.conf Files at C:\Program Files\Splunk\etc\system\local transforms.conf [function_coverage] REGEX =(fn).(name)(=)\".*?\"... by rbsplunktest New Member in Splunk Search 11-22-2015 0 8	0	8