Splunk Search

Community Activity

Communication Ports to be opened from Amazon EC2 Instance to Splunk Cloud What are the ports to be opened inboud/outbound from Amazon EC2 instances to Splunk cloud. by ranamam New Member in Splunk Search 10-08-2015 0 1	0	1
Splunk sizing: where is the search concurrency information? I've been reviewing the information around sizing Splunk installations and it seems to distill--at its simplest--to t... by cmeo Contributor in Splunk Search 10-08-2015 1 5	1	5
Unable to start splunk, failed with crash report [build aa7d4b1ccb80] 2015-09-26 11:27:52 Received fatal signal 6 (Aborted). Cause: Signal sent by PID 1039871 run... by jitsinha Path Finder in Splunk Search 10-08-2015 0 2	0	2
Mapping two searches to the same chart element at different times? Hi, I am on runtime trying to change the search in the same chart element. As in the chart element refers to one sea... by kartik13 Communicator in Splunk Search 10-08-2015 0 4	0	4
Min/Max of Time Axis on Timechart Does Not Always Reflect Query Time Range If you perform a query that returns events that do not hit the left or right "edge" of your specified time range, and... by puladamscom Explorer in Splunk Search 10-08-2015 4 10	4	10
How to edit my search to get an average of the total count for the last X days? I am getting a total count by using index=aap_prod sourcetype="ECS:PROD:CATALINA" (ECSSearchType=autocomplete OR ECS... by athorat Communicator in Splunk Search 10-08-2015 0 4	0	4
How to search for part of a string matching a certain regex for an ID in a text field and replace it with "id"? Hello everyone. I need to substitute text "id" in text fields where I have ids now: like 123123123, 312asda-adas2 an... by 0range Communicator in Splunk Search 10-07-2015 0 6	0	6
default interval for data sending I am using Universal forwarder to send data to main Splunk instance to monitor files/directories. What is default in... by jangid Builder in Splunk Search 10-07-2015 0 5	0	5
How to change the default behavior for checkboxes so it searches with OR for multiple selections, not AND? Hi All, The default behavior when building a dashboard with checkboxes is that the checkboxes equal an AND search. ... by brywilk_umich Path Finder in Splunk Search 10-07-2015 0 1	0	1
Sort based on Specific Value Within Field Hi all My question has to do with sorting , and basically my field looks like this where I want it sorted by the last... by raby1996 Path Finder in Splunk Search 10-07-2015 0 4	0	4
count list host count by sourcetype, sourcetype by index Hi, This seems like it would be simple, but I can't figure it out for the life of me. I really like the stats list l... by proletariat99 Communicator in Splunk Search 10-07-2015 2 7	2	7
How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? I don't understand why this should be so difficult....okay, here is my search: host=* index=_internal OR index=main ... by gsawyer1 Engager in Splunk Search 10-07-2015 0 1	0	1
How to recognize flat patterns in separate time periods? This is a continuation of How to recognize a flat pattern in a given time period which @lguinn solved with a combinat... by yuanliu SplunkTrust in Splunk Search 10-07-2015 0 5	0	5
Removing events with duplicate fields from transaction command Hi all, I am writing a query to detect brute force attempts, where the username is different in each request. index... by dineshp Explorer in Splunk Search 10-07-2015 0 2	0	2
Why are the search and query tags in my dashboard XML failing? Hi, I wonder whether someone may be able to help me please. I've put together the following in the Dashboard XML. ... by IRHM73 Motivator in Splunk Search 10-07-2015 0 7	0	7
Query to get daily amount of data in GB per index I am trying to figure out a search to get the amount of data in GB coming into Splunk per index. When we have huge sp... by bcastine New Member in Splunk Search 10-07-2015 0 1	0	1
How to call an external lookup from the master search head, but execute it in a specific search peer? I have an external lookup that is working fine, but due to firewall restrictions, I need to force the external lookup... by lpolo Motivator in Splunk Search 10-07-2015 0 12	0	12
Bucketing by day for a table of result with eventstats We've got summary index working great, but we need to back fill in some data from before we started the automated rep... by akhanVG Path Finder in Splunk Search 10-07-2015 0 2	0	2
How to combine or join 2 sources (.csv format) with exactly the same extracted fields? How is it possible to combine or join 2 sources (.csv format) with excactly the same extracted fields? source1: colu... by krown Explorer in Splunk Search 10-07-2015 0 2	0	2
Is it possible to do faceted search with Splunk, similarly to what we do with Solr? I'm new to Splunk and I have been searching for a way to do faceted search, similarly to what I have been doing with ... by bemantunes Explorer in Splunk Search 10-07-2015 0 4	0	4
Using a subsearch with inputlookup to filter results returns errors Hi guys, Im trying to filter a list of messages coming from my index by checking the sender for membership in a grou... by pacrip Path Finder in Splunk Search 10-07-2015 0 3	0	3
How do I edit my search to get a total sum of list(count)? I've got this search working to show me allowed (!=blocked) network activity that lists the dest_ip, and dest_port, g... by mikesangray Path Finder in Splunk Search 10-07-2015 0 3	0	3
How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization? I am attempting to overlay last weeks CPU with this weeks CPU utilization, to give a side by side contrast. Current... by tmarlette Motivator in Splunk Search 10-06-2015 1 2	1	2
How do I edit my search to add a second field (value) to my chart? I have this string and want to add second value " accountNumber" to the chart. How I can do that? Current string: \|... by raindrop18 Communicator in Splunk Search 10-06-2015 0 1	0	1
How to pre-calculate a value per day and store it in a lookup to find averages in later searches? Currently we have a search: index="ecom" eventName \| eventstats dc(sessionId) as totalnumberofsessions \| search even... by akhanVG Path Finder in Splunk Search 10-06-2015 0 2	0	2

Get Updates on the Splunk Community!

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Splunk is excited to announce the General Availability (GA) of Federated Search for ...

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust ...

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...

Splunk Search

Communication Ports to be opened from Amazon EC2 Instance to Splunk Cloud

Splunk sizing: where is the search concurrency information?

Unable to start splunk, failed with crash report

Mapping two searches to the same chart element at different times?

Min/Max of Time Axis on Timechart Does Not Always Reflect Query Time Range

How to edit my search to get an average of the total count for the last X days?

How to search for part of a string matching a certain regex for an ID in a text field and replace it with "id"?

default interval for data sending

How to change the default behavior for checkboxes so it searches with OR for multiple selections, not AND?

Sort based on Specific Value Within Field

count list host count by sourcetype, sourcetype by index

How to create a stacked column chart with count(_time) split by index (_internal, main) for each host?

How to recognize flat patterns in separate time periods?

Removing events with duplicate fields from transaction command

Why are the search and query tags in my dashboard XML failing?

Query to get daily amount of data in GB per index

How to call an external lookup from the master search head, but execute it in a specific search peer?

Bucketing by day for a table of result with eventstats

How to combine or join 2 sources (.csv format) with exactly the same extracted fields?

Is it possible to do faceted search with Splunk, similarly to what we do with Solr?

Using a subsearch with inputlookup to filter results returns errors

How do I edit my search to get a total sum of list(count)?

How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization?

How do I edit my search to add a second field (value) to my chart?

How to pre-calculate a value per day and store it in a lookup to find averages in later searches?

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation