Splunk Search

Community Activity

Difficulty sorting a field by another field I previously had a query on grouping results from a search and I received a great deal of help in shaping this query.... by aputz Path Finder in Splunk Search 11-13-2015 2 1	2	1
Why am I getting inconsistent event counts when using wildcard characters to match event field values? For example, I have indexed the following six events and splunk has successfully extracted the fields quite nicely: ... by splunkIT Splunk Employee in Splunk Search 11-13-2015 3 4	3	4
Why does increasing the time range for a search on 2 indexes give incorrect results in a timechart? Maybe I'm not understanding the way this works, but I have other searches that use it just fine. The only difference... by jawebb Explorer in Splunk Search 11-13-2015 0 5	0	5
Can I add a field to an event based on data in a separate event? I have one sourcetype that contains an event for each request to my site. One of the fields (we'll call it 'api') in ... by aneaston New Member in Splunk Search 11-13-2015 0 4	0	4
How can I get top x results and then do stats on top x I have web page logs that have several fields. The important ones for this are CDN locations x_edge_location and the ... by ashabc Contributor in Splunk Search 11-13-2015 0 3	0	3
How do I sum the counts of all the similar values in a field to show as a single item? Below search command is giving the results as below source="report1447097285313.csv" host="ca2indslogprd02" index="p... by praneethkodali Explorer in Splunk Search 11-13-2015 0 6	0	6
How to set the maximum number of displayed values in a chart in Splunk 6.3? Hi, The following dashboard contains a search that returns more than 1000 values (3600). I want to visualize all of ... by gschr Path Finder in Splunk Search 11-13-2015 3 9	3	9
How to extract this value from pipe delimited fields in Splunk? Hi All My search results from Splunk look like below 2015-11-13 06:32:33,949\|a.abcd\|DAS\|callabcd():getTime\|0.296\|SU... by prategup1 New Member in Splunk Search 11-13-2015 0 1	0	1
How to use eval function in search in CLI Hi all, I'm currently trying to run a search within the CLI (which works perfectly on Splunk Web). The search is th... by ciir Explorer in Splunk Search 11-13-2015 0 1	0	1
How to create bins for _time that start and end on specific hours of the day? I am attempting to summarize data by a 12 hour reporting period. The reporting periods start/end at 8. My search l... by ErikaE Communicator in Splunk Search 11-13-2015 0 1	0	1
How to write the regex to extract a field for offset columns? Hello, I am trying to extract a field that is offset by one column: Event 1: [DT_2.0_REAL][0x80c00002] Event 2: [0x... by jlim2003 New Member in Splunk Search 11-13-2015 0 2	0	2
How to extract a field name and add it to a fixed string? Hi How can I extract these fieldnames and values from this event? Step: 0345 Result: Valid Step: 3345 Result: Valid... by edrivera3 Builder in Splunk Search 11-13-2015 0 10	0	10
Coalesce Function Hi, I wonder whether someone may be able to help me please. I've been reading the Splunk documentation on the 'coale... by IRHM73 Motivator in Splunk Search 11-13-2015 1 4	1	4
Is it possible to resolve an IP Address from a URL in the Search & Reporting app? How do I get the IP from a URL? by tonifrommknecht Engager in Splunk Search 11-13-2015 0 3	0	3
How do I edit my stats search with the proper conditions to return the expected result? Hello All, Quite new to Splunk and hoping someone can help point me in the right direction. I've being trying to fig... by ronaldsc New Member in Splunk Search 11-13-2015 0 2	0	2
Timechart over one Month 01.-31. I want to design a new timechart dashboard panel based on a specific search over exact 1 Month (or 30 days) My search... by cschmit1 Explorer in Splunk Search 11-13-2015 0 7	0	7
Display Only the Total Row Hi, I wonder whether someone may be able to help me please. With some help along the way I've written the query belo... by IRHM73 Motivator in Splunk Search 11-12-2015 1 4	1	4
How to search the percentage change between multiple dates? So I loaded some old stock market data into Splunk and now I'm trying to make a big table that shows the percentage c... by jihape Path Finder in Splunk Search 11-12-2015 0 2	0	2
How would I use multiple values from a subsearch as input to the main search? I have two sourcetypes "clients" and "potential_clients" and each sourcetype contains address information. I want t... by digital_alchemy Path Finder in Splunk Search 11-12-2015 0 4	0	4
How to write a search to do multiple aggregations grouped by different fields? Hello, I am trying to do multiple aggregations on data each time grouped by different fields. I have the following da... by fernanmosi New Member in Splunk Search 11-12-2015 0 2	0	2
How to join two searches that have two common fields and put a condition on one of the common fields? I want to do a join of two searches that have a common field ID and time, but I want to have a condition on time when... by GauriSplunk Path Finder in Splunk Search 11-12-2015 0 15	0	15
BUG: tstats not displaying latest time modifier correctly It appears that tstats will not honor my latest value. Instead is silently uses "now" \| tstats count where index=ma... by the_wolverine Champion in Splunk Search 11-12-2015 0 5	0	5
How to trigger a search to run on clicking the strip in a Sankey Diagram? Whenever the strip between 2 nodes is clicked, a search should run and the output should be generated in a table (bel... by apurvsrivastav Engager in Splunk Search 11-12-2015 0 1	0	1
How do you search for the string "error" after a particular string appears? Hi, I would like to check for the string "ERROR" after the application is in a stable state. The application logs t... by jagr New Member in Splunk Search 11-12-2015 0 1	0	1
Filter out "everything but..." from certain source with heavy forwarder? I want to filter out everything in my massive firewall logs except those events with event codes for a few important ... by km_sec New Member in Splunk Search 11-12-2015 0 2	0	2