Splunk Search

Community Activity

Mapping two searches to the same chart element at different times? Hi, I am on runtime trying to change the search in the same chart element. As in the chart element refers to one sea... by kartik13 Communicator in Splunk Search 10-08-2015 0 4	0	4
Min/Max of Time Axis on Timechart Does Not Always Reflect Query Time Range If you perform a query that returns events that do not hit the left or right "edge" of your specified time range, and... by puladamscom Explorer in Splunk Search 10-08-2015 4 10	4	10
How to edit my search to get an average of the total count for the last X days? I am getting a total count by using index=aap_prod sourcetype="ECS:PROD:CATALINA" (ECSSearchType=autocomplete OR ECS... by athorat Communicator in Splunk Search 10-08-2015 0 4	0	4
How to search for part of a string matching a certain regex for an ID in a text field and replace it with "id"? Hello everyone. I need to substitute text "id" in text fields where I have ids now: like 123123123, 312asda-adas2 an... by 0range Communicator in Splunk Search 10-07-2015 0 6	0	6
default interval for data sending I am using Universal forwarder to send data to main Splunk instance to monitor files/directories. What is default in... by jangid Builder in Splunk Search 10-07-2015 0 5	0	5
How to change the default behavior for checkboxes so it searches with OR for multiple selections, not AND? Hi All, The default behavior when building a dashboard with checkboxes is that the checkboxes equal an AND search. ... by brywilk_umich Path Finder in Splunk Search 10-07-2015 0 1	0	1
Sort based on Specific Value Within Field Hi all My question has to do with sorting , and basically my field looks like this where I want it sorted by the last... by raby1996 Path Finder in Splunk Search 10-07-2015 0 4	0	4
count list host count by sourcetype, sourcetype by index Hi, This seems like it would be simple, but I can't figure it out for the life of me. I really like the stats list l... by proletariat99 Communicator in Splunk Search 10-07-2015 2 7	2	7
How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? I don't understand why this should be so difficult....okay, here is my search: host=* index=_internal OR index=main ... by gsawyer1 Engager in Splunk Search 10-07-2015 0 1	0	1
How to recognize flat patterns in separate time periods? This is a continuation of How to recognize a flat pattern in a given time period which @lguinn solved with a combinat... by yuanliu SplunkTrust in Splunk Search 10-07-2015 0 5	0	5
Removing events with duplicate fields from transaction command Hi all, I am writing a query to detect brute force attempts, where the username is different in each request. index... by dineshp Explorer in Splunk Search 10-07-2015 0 2	0	2
Why are the search and query tags in my dashboard XML failing? Hi, I wonder whether someone may be able to help me please. I've put together the following in the Dashboard XML. ... by IRHM73 Motivator in Splunk Search 10-07-2015 0 7	0	7
Query to get daily amount of data in GB per index I am trying to figure out a search to get the amount of data in GB coming into Splunk per index. When we have huge sp... by bcastine New Member in Splunk Search 10-07-2015 0 1	0	1
How to call an external lookup from the master search head, but execute it in a specific search peer? I have an external lookup that is working fine, but due to firewall restrictions, I need to force the external lookup... by lpolo Motivator in Splunk Search 10-07-2015 0 12	0	12
Bucketing by day for a table of result with eventstats We've got summary index working great, but we need to back fill in some data from before we started the automated rep... by akhanVG Path Finder in Splunk Search 10-07-2015 0 2	0	2
How to combine or join 2 sources (.csv format) with exactly the same extracted fields? How is it possible to combine or join 2 sources (.csv format) with excactly the same extracted fields? source1: colu... by krown Explorer in Splunk Search 10-07-2015 0 2	0	2
Is it possible to do faceted search with Splunk, similarly to what we do with Solr? I'm new to Splunk and I have been searching for a way to do faceted search, similarly to what I have been doing with ... by bemantunes Explorer in Splunk Search 10-07-2015 0 4	0	4
Using a subsearch with inputlookup to filter results returns errors Hi guys, Im trying to filter a list of messages coming from my index by checking the sender for membership in a grou... by pacrip Path Finder in Splunk Search 10-07-2015 0 3	0	3
How do I edit my search to get a total sum of list(count)? I've got this search working to show me allowed (!=blocked) network activity that lists the dest_ip, and dest_port, g... by mikesangray Path Finder in Splunk Search 10-07-2015 0 3	0	3
How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization? I am attempting to overlay last weeks CPU with this weeks CPU utilization, to give a side by side contrast. Current... by tmarlette Motivator in Splunk Search 10-06-2015 1 2	1	2
How do I edit my search to add a second field (value) to my chart? I have this string and want to add second value " accountNumber" to the chart. How I can do that? Current string: \|... by raindrop18 Communicator in Splunk Search 10-06-2015 0 1	0	1
How to pre-calculate a value per day and store it in a lookup to find averages in later searches? Currently we have a search: index="ecom" eventName \| eventstats dc(sessionId) as totalnumberofsessions \| search even... by akhanVG Path Finder in Splunk Search 10-06-2015 0 2	0	2
How to write the regex to extract and list values occurring after a constant string? The following were my search results: processor.ProcSavePriceInfoObjects.writeProperties(ProcSavePriceInfoObjects.ja... by pavanae Builder in Splunk Search 10-06-2015 0 2	0	2
Instead of running ./splunk start or restart out of the /opt/splunk/bin directory, does anyone know how to add an alias in .bashrc? Instead of having to run ./splunk start or ./splunk restart out of the /opt/splunk/bin directory, does anyone have an... by JScordo Path Finder in Splunk Search 10-06-2015 1 1	1	1
How to create a scatter graph of chain stores on the y-axis with a dot over each city a store is located long the x-axis? I have Splunk indexing a file that contains information about the geographical location of stores: city, chain, numS... by lyndac Contributor in Splunk Search 10-06-2015 0 1	0	1

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

Mapping two searches to the same chart element at different times?

Min/Max of Time Axis on Timechart Does Not Always Reflect Query Time Range

How to edit my search to get an average of the total count for the last X days?

How to search for part of a string matching a certain regex for an ID in a text field and replace it with "id"?

default interval for data sending

How to change the default behavior for checkboxes so it searches with OR for multiple selections, not AND?

Sort based on Specific Value Within Field

count list host count by sourcetype, sourcetype by index

How to create a stacked column chart with count(_time) split by index (_internal, main) for each host?

How to recognize flat patterns in separate time periods?

Removing events with duplicate fields from transaction command

Why are the search and query tags in my dashboard XML failing?

Query to get daily amount of data in GB per index

How to call an external lookup from the master search head, but execute it in a specific search peer?

Bucketing by day for a table of result with eventstats

How to combine or join 2 sources (.csv format) with exactly the same extracted fields?

Is it possible to do faceted search with Splunk, similarly to what we do with Solr?

Using a subsearch with inputlookup to filter results returns errors

How do I edit my search to get a total sum of list(count)?

How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization?

How do I edit my search to add a second field (value) to my chart?

How to pre-calculate a value per day and store it in a lookup to find averages in later searches?

How to write the regex to extract and list values occurring after a constant string?

Instead of running ./splunk start or restart out of the /opt/splunk/bin directory, does anyone know how to add an alias in .bashrc?

How to create a scatter graph of chain stores on the y-axis with a dot over each city a store is located long the x-axis?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation