Splunk Search

Community Activity

Is it possible to do faceted search with Splunk, similarly to what we do with Solr? I'm new to Splunk and I have been searching for a way to do faceted search, similarly to what I have been doing with ... by bemantunes Explorer in Splunk Search 10-07-2015 0 4	0	4
Using a subsearch with inputlookup to filter results returns errors Hi guys, Im trying to filter a list of messages coming from my index by checking the sender for membership in a grou... by pacrip Path Finder in Splunk Search 10-07-2015 0 3	0	3
How do I edit my search to get a total sum of list(count)? I've got this search working to show me allowed (!=blocked) network activity that lists the dest_ip, and dest_port, g... by mikesangray Path Finder in Splunk Search 10-07-2015 0 3	0	3
How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization? I am attempting to overlay last weeks CPU with this weeks CPU utilization, to give a side by side contrast. Current... by tmarlette Motivator in Splunk Search 10-06-2015 1 2	1	2
How do I edit my search to add a second field (value) to my chart? I have this string and want to add second value " accountNumber" to the chart. How I can do that? Current string: \|... by raindrop18 Communicator in Splunk Search 10-06-2015 0 1	0	1
How to pre-calculate a value per day and store it in a lookup to find averages in later searches? Currently we have a search: index="ecom" eventName \| eventstats dc(sessionId) as totalnumberofsessions \| search even... by akhanVG Path Finder in Splunk Search 10-06-2015 0 2	0	2
How to write the regex to extract and list values occurring after a constant string? The following were my search results: processor.ProcSavePriceInfoObjects.writeProperties(ProcSavePriceInfoObjects.ja... by pavanae Builder in Splunk Search 10-06-2015 0 2	0	2
Instead of running ./splunk start or restart out of the /opt/splunk/bin directory, does anyone know how to add an alias in .bashrc? Instead of having to run ./splunk start or ./splunk restart out of the /opt/splunk/bin directory, does anyone have an... by JScordo Path Finder in Splunk Search 10-06-2015 1 1	1	1
How to create a scatter graph of chain stores on the y-axis with a dot over each city a store is located long the x-axis? I have Splunk indexing a file that contains information about the geographical location of stores: city, chain, numS... by lyndac Contributor in Splunk Search 10-06-2015 0 1	0	1
How to write a search to ignore a matching line, but not other lines in event to filter out false positives for an alert? I'm logging Rails requests and have taught Splunk about our logging format. When there's a new release of our app, I ... by gaqzi Explorer in Splunk Search 10-06-2015 0 4	0	4
Why is my rex command after upgrade to 6.3 not working Hello I'm using this Regex command: rex max_match=25 "\s+(?P<UserName>[^ ]+\s\w)\s+(?P<Status>[Allow\|Deny]+)\s+(?... by PPape Contributor in Splunk Search 10-06-2015 0 3	0	3
Why are my json fields extracted twice? (redux) I came across http://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html which seemed to de... by jamescrowley New Member in Splunk Search 10-06-2015 0 2	0	2
How to create a timechart with charting.legend.labels, but maintain the x-axis label format and color two lines red and blue? I have a timechart with two lines (sum and max of values). Have a problem with the display format of the x-axis. It i... by hunyady Explorer in Splunk Search 10-06-2015 0 1	0	1
Error in 'search' command: Unable to parse the search: Comparator '>' is missing a term on the right hand side I have 2 queries in same format out of which query#1 is working and query#2 is not working and throwing error " Unifi... by rdhulipala Engager in Splunk Search 10-06-2015 0 4	0	4
How do you configure splunk to extract fields from SMTP Message Transaction Logs? We currently use Cisco IronPorts and are sending the Message Transaction Logs via syslog to Splunk. I couldn't find t... by aphanmanivong New Member in Splunk Search 10-06-2015 0 3	0	3
Can I apply an inputs.conf WinEventLog stanza by regex or IP range with a whitelist? Can we, because of Windows SID translations needing to be pointed to specific DomainController based on IP, point our... by wyodoc1 Explorer in Splunk Search 10-06-2015 0 1	0	1
How to schedule real-time search with a cron schedule in Splunk 6.2.1 I am trying to convert real-time searches in the dashboard to scheduled real-time searches to reduce performance over... by shailesh030 Path Finder in Splunk Search 10-06-2015 0 1	0	1
How to trace batch processing in one transaction? Say I have the following log, where I have separate input and output parts, however, they are processed as batch in b... by f8899 Engager in Splunk Search 10-06-2015 0 4	0	4
How to create a chart to view Business Transaction counts with line overlays for both highest and lowest data points?? I am looking for a chart for the business team to view the transaction counts for last day span hourly (so total of 2... by splunkuser354 New Member in Splunk Search 10-06-2015 0 1	0	1
HunkでのサーチにMRジョブが生成されない Hunkでサーチを実行すると、サーチによってHadoop側のMRジョブが自動的に生成されたり、生成されなかったりしていますが、理由が分かる方いらっしゃいますか？ by cwl Contributor in Splunk Search 10-05-2015 0 1	0	1
How do I extract a string from a message and create a chart on that field? My message text contains a value like this: 2015-09-30 16:52:19.907\|LOCATION:GATEWAY\|SERVICE:DepositsRestProxy\|VERSI... by manmayee New Member in Splunk Search 10-05-2015 0 9	0	9
Can I add 15M entries into a summary index on a daily basis? Running into challenges with monthly reporting, and need to figure out how to use the right Splunk tool for the job. ... by mvanderlist_spl Splunk Employee in Splunk Search 10-05-2015 0 1	0	1
How do i specify a multivalue field when I’m outputting key/value pairs? So let's say i want an event field1=blah field2=blah field3=blah,blah2,blah3 and i want field 3 to be extracted at a... by splunkIT Splunk Employee in Splunk Search 10-05-2015 1 5	1	5
How to associate and create fields between 2 JSON events? Hey Everyone, I'm trying to extract fields from an event using a somewhat similar foreign key concept/mechanism. For... by jeanmatthieu Explorer in Splunk Search 10-05-2015 0 5	0	5
Transaction very slow, use stats? Hello, I have the following logs (1 line = 1 event): id=10 from="10.10.10.44" id=10 ### whatever useless lo... by aq_natixis Engager in Splunk Search 10-05-2015 0 3	0	3

Get Updates on the Splunk Community!

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Splunk Search

Is it possible to do faceted search with Splunk, similarly to what we do with Solr?

Using a subsearch with inputlookup to filter results returns errors

How do I edit my search to get a total sum of list(count)?

How to create a chart overlay of last weeks CPU utilization with this week's CPU utilization?

How do I edit my search to add a second field (value) to my chart?

How to pre-calculate a value per day and store it in a lookup to find averages in later searches?

How to write the regex to extract and list values occurring after a constant string?

Instead of running ./splunk start or restart out of the /opt/splunk/bin directory, does anyone know how to add an alias in .bashrc?

How to create a scatter graph of chain stores on the y-axis with a dot over each city a store is located long the x-axis?

How to write a search to ignore a matching line, but not other lines in event to filter out false positives for an alert?

Why is my rex command after upgrade to 6.3 not working

Why are my json fields extracted twice? (redux)

How to create a timechart with charting.legend.labels, but maintain the x-axis label format and color two lines red and blue?

Error in 'search' command: Unable to parse the search: Comparator '>' is missing a term on the right hand side

How do you configure splunk to extract fields from SMTP Message Transaction Logs?

Can I apply an inputs.conf WinEventLog stanza by regex or IP range with a whitelist?

How to schedule real-time search with a cron schedule in Splunk 6.2.1

How to trace batch processing in one transaction?

How to create a chart to view Business Transaction counts with line overlays for both highest and lowest data points??

HunkでのサーチにMRジョブが生成されない

How do I extract a string from a message and create a chart on that field?

Can I add 15M entries into a summary index on a daily basis?

How do i specify a multivalue field when I’m outputting key/value pairs?

How to associate and create fields between 2 JSON events?

Transaction very slow, use stats?

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation