Splunk Search

Community Activity

How to separate fields into events based on value Hi all I've been trying to separate the values of a stats table that looks similar to what i have below. I've used d... by raby1996 Path Finder in Splunk Search 10-21-2015 0 2	0	2
How do I join these two searches to get OS type? Hi, When I run the searches below separately, they give me exact result, but when I tried joining them, it was not ... by Sampathu Explorer in Splunk Search 10-21-2015 0 1	0	1
How to write the regex to extract data inside square brackets? How to write a regular expression for capturing elapsed time of requests, with a log in this format. .......status=[... by balach New Member in Splunk Search 10-21-2015 0 4	0	4
Where does 'Search Assistant' get the user search-history from? Where do we actually get user ended search history from to fill the Search Assistant “My Search History”? (4.1) See ... by mctester Communicator in Splunk Search 10-21-2015 1 2	1	2
How do I sum values inside a multivalue row? Hi all, I'm trying to create a sum of fields inside a row, but I can't figure how to do it. This is my scenario: I ... by clopes Engager in Splunk Search 10-21-2015 0 2	0	2
How do I edit my search to get this field into my chart? Dear All, I am using the Splunk App for Windows and I am trying to get a chart out looking something like: Computer... by BlueSocket Contributor in Splunk Search 10-21-2015 0 1	0	1
How to search for ValueA, look ahead to the following 20 events, and return results if there is no corresponding ValueB? This is probably a very basic Splunk question, but as I move beyond basic searches, these are the kinds of use cases ... by amljohnson Explorer in Splunk Search 10-21-2015 0 4	0	4
Pass a field from main search into subsearch for each record I have a sourcetype that represents transactions. On the sourcetype are 3 fields of importance to this question,:an ... by joxley Path Finder in Splunk Search 10-21-2015 0 2	0	2
Getting information adjacent to a match. Hello Data example: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS) I have to int... by jsven7 Communicator in Splunk Search 10-21-2015 0 4	0	4
Why does search typeahead no longer show "matching terms" after I upgraded to Splunk 6.3? I upgraded to Splunk 6.3 and it's working beautifully, however, I no longer get "matching terms" as I type in the sea... by rroberts Splunk Employee in Splunk Search 10-21-2015 0 3	0	3
Pass one field from multiple fields returned by subsearch Hi All, I have a search query like below. [search A \| fields B,C] \| search (D OR E) \| fields F \| table, B,C,F. Sea... by Murali2888 Communicator in Splunk Search 10-21-2015 0 3	0	3
Why does searching by source not work sometimes? This command does not work. index=grb_test sourcetype=QServiceManagerFormat \| source="\\\\netapp4\\Quants\\ST\logs\... by gbronner_rbc Explorer in Splunk Search 10-21-2015 0 2	0	2
How to search the difference between the values of two fields between separate searches? I have a field of names from two indexes and wish to find the unique values between them. I thought I should have to ... by jawebb Explorer in Splunk Search 10-21-2015 0 6	0	6
How to graph the number of active sessions over time? The data that I would like to graph consists of start events and stop events. Sessions consist of one start event and... by lquinn Contributor in Splunk Search 10-21-2015 1 2	1	2
Help with regular expression I wish to extract any number between "cmdbRequest" & "- Transaction" . For Example from below string ERROR 21 C... by indianhans Engager in Splunk Search 10-21-2015 0 2	0	2
Is there any guide out there that would help in successfully configuring the Sophos Add-on for Splunk? I have successfully downloaded and installed the Sophos Add-on for Splunk. Now I am attempting to configure it and a... by thomas_forbes Communicator in Splunk Search 10-20-2015 0 4	0	4
How to extract everything after a carriage return? Is it possible to get everything after a carriage return? Example Bills to pay: Car House Boat etc I tried to use... by ruhjuh Explorer in Splunk Search 10-20-2015 2 4	2	4
How can I escape the 50K subsearch limit while linking commands (joining datasets) together? Does anybody have any creative ways to join search outputs together and avoid subsearch limits? by woodcock Esteemed Legend in Splunk Search 10-20-2015 1 5	1	5
How do I search wineventlog security logs in an inputlookup table? I have a list of privileged users from my inputlookup table and I want to know their dest ip. This is why I want to s... by Mitchellsch Explorer in Splunk Search 10-20-2015 0 4	0	4
Is there a way to report on the devices depositing syslogs on my heavy forwarders? I need to write a search to report on what devices are sending logs to my heavy forwarders using syslog-ng to the /va... by mflippin New Member in Splunk Search 10-20-2015 0 1	0	1
Group and count totals on 3 or more levels Hello fellow Splunkers! I'm trying to recreate an existing report for my firewall guy within Splunk with hopes of re... by dustinhartje Explorer in Splunk Search 10-20-2015 2 5	2	5
is_pid_valid I am seeing this error, causing splunk to not start, how can I resolve it? Operation "is_pid_valid" failed in /opt/s... by thiru25 Explorer in Splunk Search 10-20-2015 5 4	5	4
Is it possible to modify a form token's value after it is selected? HI currently i am calling a splunk report with a parameter like below. Host is like ServerName.DatabaseName <a href=... by vinay4444 Explorer in Splunk Search 10-20-2015 0 9	0	9
How to edit my search to get the output to show on a radial gauge? I am trying to show the total amount of space we are using in a box right now for a dashboard. Here is my following ... by TJ0214 New Member in Splunk Search 10-20-2015 0 5	0	5
Replacing multiple values in events with data from a lookup table. I am fairly new to Splunk so forgive me if this is a simple question. I have a lookup table with the following data: ... by cevans99 New Member in Splunk Search 10-20-2015 0 2	0	2