Splunk Search

Ask a Question

Discussions

Thread Info

How do I create a stacked bar chart sorted by host.

I am still learning all the nice functionality in Splunk, but have some trouble with this. Eks struktur: Aug 05...

by Builder in

timechart shows 0 when there is no result

Hi guys, I have a problem with timechart and I need ur help! I got a search line here: index="perform" "Bytes Rece...

by Communicator in

Identifying Multiple fields with REGEX

Hi, I have a field in the form of; Key - Value | Key - Value | Key - Value eg Derek - 99.00 | Dave - 114.00 | Pau...

by Path Finder in

Using multiple REGEX for extracting a single field

I want to extract fields from a customized log (no pre-defined/standard log structure) I do need to extract a fiel...

by Motivator in

How to add an average transaction duration overlay to a timechart with a split by clause?

Splunk=6.1.4 My search looks like this: | transaction TransID keepevicted=true | search eventcount=2 | timechart l...

by Explorer in

How to migrate search app content from an old Splunk instance to new search head cluster members using the deployer?

Experts, We have a Splunk instance which is 3 years old and need to migrate the content to new search head cluster...

by Motivator in

List files in search then table the duration between beginning and end of processing

I'm trying to limit the scope of a search to a 24 hour window and list all of the files analyzed within that period b...

by Explorer in

How to edit my search to extract a specific value from a reoccurring field within a single event?

Hi all, I'm having trouble extracting a specific value from a reoccurring field within a single event. My search l...

by Path Finder in

How to edit my search to display a list of values in a single field?

I've been looking through here for some time without success. My situation is this. I'm trying to parse regular Apach...

by Engager in

What is the right way to Join?

I've been searching how to join, but every example that I apply seems to be wrong. I've got referents type of log:...

by Engager in

How to calculate N series of values?

My table look like this Date/Time Name Value 26/6/2014 1:00 Foo 10 26/6/2014 2:00 foo 100 ..................Hig...

by Observer in

How is priority handled for manual and automatic field extractions?

HI, how is priority handled in regards to extractions. Lets assume I have an EXTRACT in props.conf extracting...

by Path Finder in

How can I extract text between 2 standard texts that may contain " . , ? / " ?

I have this type of log: Bin:456852 IssuingBank:PBS INTERNATIONAL A/S;DANSKE BANK;DANSKEBANK IssingCountry:DK IRF...

by Explorer in

If I only have transaction data from 8AM to 6PM, how do I display a timechart from 00 to 24 hours?

I have data (transactions data) which shows 8 AM to 6 PM, but I need to show a report from 00 hrs to 24 hrs. I tried ...

by Explorer in

Why is my search returning a different set of results after I replaced the 'dedup' command with 'stats dc()' to improve performance?

Hi, I wonder whether someone may be able to help me please. I'm using the search below to successfully produce...

by Motivator in

How to calculate a rolling quarters growth rate, so if the current month is August, then growth rate = (May+June+July 2015)/(May+June+July 2014)?

Hi all, I want to calculate the rolling quarters growth rate, which is calculated from the sum of the previous 3 m...

by Path Finder in

Looking for a License Usage query to generate external scripted alerts with

hi guys i'm looking for help around license usage. i'm trying to troubleshoot a license violation we had recently ...

by Contributor in

Stats against timechart

I have a search that I can use in a dashboard that gives me statistical data about bandwidth usage on a firewall. I h...

by Communicator in

Use EVAL and Case for Windows EventCodes to provide information in table output.

Using this code I am able to generate a table for IIS Application Pool specific errors. With the eval-case providing ...

by Builder in

How to configure the search head for distributed search with one search head, one indexer, and no cluster?

I am setting up a green-field Splunk environment with one search head and one indexer, which we would like to separat...

by Engager in

Is there a unix-style 'paste' in Splunk to merge three multivalue fields?

paste is an extremely useful unix command. I want to use that very feature to merge three multivalue fields in exactl...

by Explorer in

How to get the average of two fields from two different indexes by time?

I'm trying to get the average memory and CPU usage by the hour. Unfortunately, that information is stored on two diff...

by Path Finder in

How to write a search to convert some table rows as columns?

I need to convert the following source data as a specified output. Source Data Hostname Event_time ...

by New Member in

How to edit props.conf to specify a different regex for each of three sourcetypes?

Hello, I'm trying to parse three different log files with different regex. I have three different sourcetypes...

by Explorer in

How to calculate the durations between 1 start event and multiple end events?

Hello all, How do I get the time between one start event and multiple end events? Let me explain: I have one s...

by Explorer in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How do I create a stacked bar chart sorted by host.

timechart shows 0 when there is no result

Identifying Multiple fields with REGEX

Using multiple REGEX for extracting a single field

How to add an average transaction duration overlay to a timechart with a split by clause?

How to migrate search app content from an old Splunk instance to new search head cluster members using the deployer?

List files in search then table the duration between beginning and end of processing

How to edit my search to extract a specific value from a reoccurring field within a single event?

How to edit my search to display a list of values in a single field?

What is the right way to Join?

How to calculate N series of values?

How is priority handled for manual and automatic field extractions?

How can I extract text between 2 standard texts that may contain " . , ? / " ?

If I only have transaction data from 8AM to 6PM, how do I display a timechart from 00 to 24 hours?

Why is my search returning a different set of results after I replaced the 'dedup' command with 'stats dc()' to improve performance?

How to calculate a rolling quarters growth rate, so if the current month is August, then growth rate = (May+June+July 2015)/(May+June+July 2014)?

Looking for a License Usage query to generate external scripted alerts with

Stats against timechart

Use EVAL and Case for Windows EventCodes to provide information in table output.

How to configure the search head for distributed search with one search head, one indexer, and no cluster?

Is there a unix-style 'paste' in Splunk to merge three multivalue fields?

How to get the average of two fields from two different indexes by time?

How to write a search to convert some table rows as columns?

How to edit props.conf to specify a different regex for each of three sourcetypes?

How to calculate the durations between 1 start event and multiple end events?

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

Developer Spotlight with Paul Stout

How to check MQ reconnects after a connection is d...

I cloned HTTP traffic collection from Splunk Strea...

Proactively stream data to different index after C...

Write Splunk log with Laminas

Issues in multiselect input dropdown