Splunk Search

Community Activity

How to write a search to display the count when two fields have unique values? Hi, I would like to create a statistics table where the end result shows the count of product that has gotten the m... by kjamsheed New Member in Splunk Search 11-09-2015 0 3	0	3
Does splunk store data in ansi.? I.E. is len(_raw) an indicator of bytes stored? Hi! I am trying to determine how much certain events affect our license and storage. I am a user of my system and n... by wkupersa Path Finder in Splunk Search 11-09-2015 0 3	0	3
How do I write a search to combine information from two events to get an accurate count? I am splunk noob trying to write a search for a couple of hours, but not successful so far. I want to count the numbe... by comatose_11 New Member in Splunk Search 11-09-2015 0 1	0	1
Splunk Search return no output on GUI and the 'Loading...' status icon is continue to display on screen Inside the customer network, Splunk 4.2 has been installed and deployed since early 2011. Recently, when the GUI sea... by hcwong Engager in Splunk Search 11-09-2015 1 3	1	3
How to edit my search to find old vs new errors with counts? Folks I am new in splunk so pardon the basic question here. I am trying to find in my application what are the new e... by akasio1972 New Member in Splunk Search 11-09-2015 0 2	0	2
How to find the difference between columns headers (new column headers one month that don't exist in the previous month)? Hello I am trying to find a differecne between column headers (month to another month). Meaning, if in the new mont... by akawacz Path Finder in Splunk Search 11-09-2015 0 2	0	2
Convert a table to a percent table Hello, I have a table that looks like this : And I wish to convert all the values in the table to percent of the ... by DavidHourani Super Champion in Splunk Search 11-09-2015 0 11	0	11
How can I tag selected sets of log records/events with a "xxx=yyy" field during indexing? Our situation: We have several complex conditions classifying groups of records, and we want to tag them with a new a... by DrFedtke Explorer in Splunk Search 11-08-2015 0 2	0	2
How to parse and extract multiple hosts in one file so I can search based on hostname and per field? I have a source file which looks like the following: <MOBILE hostname="test1"> a = 2 b = 3 c = 4 ... </MOBILE> <CENT... by nirt Path Finder in Splunk Search 11-08-2015 0 2	0	2
How do I break multiple events by Regex into single event objects I would like to break this into individual events before the ",{type" : { "type": "FeatureCollection", "features": [... by BrandSentiment Explorer in Splunk Search 11-08-2015 0 1	0	1
Removing a line from a timechart? Within our application we are tracking a "Pings" metric, and in our query we are showing pings over time along with a... by thefosk Engager in Splunk Search 11-07-2015 0 1	0	1
Count by values for two fields like a table I have events coming with two distinct key say "Key1" and "Key2". Expected value for these keys are 1 to 3. I want... by nkotha New Member in Splunk Search 11-07-2015 0 2	0	2
Timechart comparing values from now and 7 days ago Hello, I'm trying to show trends using a single value dashboard to compare a count from now and 7 days ago. It seem... by jawebb Explorer in Splunk Search 11-07-2015 0 2	0	2
Need Regex Help - Works Inline Search, Doesn't Work On Field Extractor. I have this simple data: Wich will be cut by fixed positions. 201508150015002060HHTTP090E0000000085CHAN5050 I need... by vtsguerrero Contributor in Splunk Search 11-07-2015 0 12	0	12
How to enable iplocation How do I "enable" iplocation in Splunk Ent. 6.2.2. I thought it might be just an automatic function now that the dat... by mbohlsen Engager in Splunk Search 11-06-2015 0 1	0	1
Efficient way to get high-level messaging stats I'm looking at behavior of a service which consumes messages about products, the unifying factor being a field called... by mcomfurf Path Finder in Splunk Search 11-06-2015 0 1	0	1
How to find elapsed time between now() and event? Hello. I am trying to find the amount time that has passed from the time and event occurred to the present (now()). ... by _dave_b Communicator in Splunk Search 11-06-2015 1 5	1	5
Unable to blacklist Windows events with regex on universal forwarder Hi All, We have an remote DC, to save bandwidth and Splunk license we like to filter out computer account logon mess... by Derksr Explorer in Splunk Search 11-06-2015 1 5	1	5
How can I average a dynamic column created using eval {Field}=Value I would like to display some data that has columns based on dynamic data from the search results. e.g. Assuming I hav... by chustar Path Finder in Splunk Search 11-06-2015 0 6	0	6
Count by group subgroup and use subgroup as column I had a query like this .... \| eval group_name = case ( match ( field , "value1" ) , "g1" , match ( field ... by splunknewbieste New Member in Splunk Search 11-06-2015 0 4	0	4
Using Chart over two fields grouped by time Hi Guys, I am trying to pull up a table containing Time, Channel & Popularity as fields. I am using : chart useothe... by kabiraj Path Finder in Splunk Search 11-06-2015 0 5	0	5
Real Time searches not all running Two of our users reported that they have not been getting any alerts from their real time searches over the past week... by gn694 Communicator in Splunk Search 11-06-2015 0 2	0	2
Extracting country codes from phone numbers Lets see how many of you are up early this Easter Sunday - bonus point on offer  I have a lookup with a list of pho... by himynamesdave Contributor in Splunk Search 11-06-2015 0 13	0	13
Join between 2 source type with a lot of data I everybody. I have a problem on splunk. I have a sourcetype with my orders and a sourcetype with my customers. I ... by jbechchar New Member in Splunk Search 11-06-2015 0 4	0	4
Showing filed only once per unique occurrence Hello, I am having problems with Splunk queries were a single unique instance of a field is repeated over other fiel... by gleandro Engager in Splunk Search 11-06-2015 0 1	0	1