Splunk Search

Community Activity

How do I extract fields from my sample log using regex? I got a log containing "Step" values in order: Step=11001 , Step=11018 , Step=12302 , Step=12319 , Step=12800 , Step... by bravon Communicator in Splunk Search 11-12-2015 0 3	0	3
How can I split a string for a field? How can I split a string from a field? Example: url="https://www.google.de/images/hpp/ic_wahlberg_product_core_48.png... by tonifrommknecht Engager in Splunk Search 11-12-2015 0 1	0	1
How do I convert epoch time to HH:MM:SS? Background So I have two date fields - Date_Created & Acknowledge_Date both in the format YYYY-MM-DD HH:MM:SS. I wis... by mjd555 Path Finder in Splunk Search 11-12-2015 0 7	0	7
How do I edit my search to calculate a percentage using values from a row that have a specific value in a column? Hi, I wonder whether someone may be able to help me please I'm using the search below to produce the screenshot as s... by IRHM73 Motivator in Splunk Search 11-12-2015 0 2	0	2
How can I run, repeat, then search? Splunk Enterprise version: 6.3.1 earliest_time : "-5m", latest_time:"now" exec_mode:"blocking", search : "index= xxx... by ryuch2002 Explorer in Splunk Search 11-11-2015 0 1	0	1
How do I write a search to get only the first 3 events for each Eventcode from Windows event logs? I am running the following search to get events from Windows event logs for the past month. I want to restrict the se... by basanthp Path Finder in Splunk Search 11-11-2015 1 4	1	4
Is there a design pattern for join searches with simple data? Hi, I am trying to write a search that seems a bit more tricky than it first looked like...  We have a scenario w... by andreasknutsso1 Engager in Splunk Search 11-11-2015 1 3	1	3
Why am I unable to multiply two fields fields with my current search syntax? Hi, I wonder whether someone may be able to help me please. I'm trying to put together a piece of a search which mul... by IRHM73 Motivator in Splunk Search 11-11-2015 0 10	0	10
How to compare a field to another field in a CSV file? I need to lookup the IP in a firewall log to a field in an inputcsv. The CSV file holds 50k results, so subsearches ... by wweiland Contributor in Splunk Search 11-11-2015 0 4	0	4
how to deal with NA values in results in splunk? My splunk search is something like this index=pqr host=xyz* NOT TYPE="ABCDE" \| fields X, Y \|timechart limit=0... by m_vivek Path Finder in Splunk Search 11-11-2015 0 3	0	3
What does it mean when there is a dash (blank/null) server ip address for a site? (Ex: "server_ip= - ") What does it mean when there is a dash (blank/null?) server ip address for a site? Seeing this quite often in results... by dasanner New Member in Splunk Search 11-11-2015 0 1	0	1
What is the Search Processing Language (SPL) 's equivalent of this code in R? After a The splunk+R search , index=pqr host=xyz* NOT TYPE="ABCDE" \| fields X, Y \|timechart limit=0 span=10m c... by m_vivek Path Finder in Splunk Search 11-11-2015 0 6	0	6
What needs to be installed and configured to give users access to the Splunk CLI to run searches? We have cluster environment in Splunk. We want to give access to Splunk CLI to users. They should be able to execute... by rrmavani Engager in Splunk Search 11-11-2015 0 1	0	1
How to use delta or another search command to find the difference between the most recent event and the event prior? Hello. I'm trying to find the time delta between the most recent event and the event prior to it. Delta sounds lik... by _dave_b Communicator in Splunk Search 11-11-2015 0 2	0	2
How do I write a search to correlate events between two sourcetypes to see if a user logged in to a certain server during their VPN session? HI, I want to correlate two sourcetypes. The first sourcetype is VPN logged event. For example, userA logged event ... by akdake Explorer in Splunk Search 11-11-2015 0 4	0	4
Why doesn't the reducer get all events from the mapper function in my custom reporting command? I am trying to write a custom reporting command that finds the top words. It seems to work, but I see some data isn't... by dcagatay Explorer in Splunk Search 11-11-2015 0 2	0	2
How do I edit my eval statement to insert a specified number in ColumnB based on specific values found in ColumnA? Hi, I wonder whether someone may be able to help me please. I'm trying to run a search which looks at a value in col... by IRHM73 Motivator in Splunk Search 11-11-2015 1 6	1	6
How to configure Splunk to parse and extract fields from my pseudo-XML sample data? Hi Splunkers, I have a question regarding the input extraction of XML fields (with inputs and transforms). I have t... by DMohn Motivator in Splunk Search 11-11-2015 0 4	0	4
Why am I getting error "Search peer XXX has the following message: received event for unconfigured/disabled/deleted index='YYY'..."? Hi, I wonder if someone may be able to help me please. I'm starting to learn more about the administration aspect of... by IRHM73 Motivator in Splunk Search 11-10-2015 0 2	0	2
If you create a timechart with a span, and then set "earliest" and "latest" parameters, does one overwrite the other? Hi, I wonder if someone could help me please with a search I have and I apologize in advance for the newbie question... by IRHM73 Motivator in Splunk Search 11-10-2015 0 4	0	4
How do I edit my search to create a table or chart of percentages calculated from my data? I have a log that looks like this { api: my_api, message: Events Publish Status event_failed_count: 0 ... by kahlerb Explorer in Splunk Search 11-10-2015 0 1	0	1
How to remove everything after a specific character in a line and group by that value? I'm trying to remove everything after the first colon that appears in a line and group by that value. An example of ... by ruhjuh Explorer in Splunk Search 11-10-2015 0 2	0	2
How do I display ONLY percentages on a timechart? I know how to include percent in timecharts, however, all the answers I see return the other values in the timechart ... by Cuyose Builder in Splunk Search 11-10-2015 0 1	0	1
Rename multiple fields to the same name using a * or a generic character, so it can be done on mass. Rename multiple fields to the same name using a * or a generic character. MY data set is producing a lot of data that... by robertlynch2020 Influencer in Splunk Search 11-10-2015 0 4	0	4
How can I create a Heat Map? I have the following Table I have latitudes and longitudes of every city. How can I create a Heat Map based on valu... by adellaroccasys Engager in Splunk Search 11-10-2015 0 4	0	4

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Splunk Search

How do I extract fields from my sample log using regex?

How can I split a string for a field?

How do I convert epoch time to HH:MM:SS?

How do I edit my search to calculate a percentage using values from a row that have a specific value in a column?

How can I run, repeat, then search?

How do I write a search to get only the first 3 events for each Eventcode from Windows event logs?

Is there a design pattern for join searches with simple data?

Why am I unable to multiply two fields fields with my current search syntax?

How to compare a field to another field in a CSV file?

how to deal with NA values in results in splunk?

What does it mean when there is a dash (blank/null) server ip address for a site? (Ex: "server_ip= - ")

What is the Search Processing Language (SPL) 's equivalent of this code in R?

What needs to be installed and configured to give users access to the Splunk CLI to run searches?

How to use delta or another search command to find the difference between the most recent event and the event prior?

How do I write a search to correlate events between two sourcetypes to see if a user logged in to a certain server during their VPN session?

Why doesn't the reducer get all events from the mapper function in my custom reporting command?

How do I edit my eval statement to insert a specified number in ColumnB based on specific values found in ColumnA?

How to configure Splunk to parse and extract fields from my pseudo-XML sample data?

Why am I getting error "Search peer XXX has the following message: received event for unconfigured/disabled/deleted index='YYY'..."?

If you create a timechart with a span, and then set "earliest" and "latest" parameters, does one overwrite the other?

How do I edit my search to create a table or chart of percentages calculated from my data?

How to remove everything after a specific character in a line and group by that value?

How do I display ONLY percentages on a timechart?

Rename multiple fields to the same name using a * or a generic character, so it can be done on mass.

How can I create a Heat Map?

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Quick connection discovery mode for forwarders

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation