Splunk Search

Community Activity

How to add hours to _time for specific events using eval? I need to add 3 hours to records which have SITE=1 and not change anything for other sites. I started with this, b... by kevinjacks Explorer in Splunk Search 09-09-2015 0 2	0	2
How to create a list of fields in a table with stats displayed on the Selected Fields sidebar, including rare 10 values, their counts, and percentages? I want to take a list of fields and show the stats displayed on the Selected fields sidebar in a table. When we do a... by landen99 Motivator in Splunk Search 09-09-2015 0 3	0	3
Why am I getting "Error in 'rex' command...Regex: missing )"? Hello All, I am brand new to Splunk and can't for the life of me figure out what I am doing wrong. I would like to ... by splunker1981 Path Finder in Splunk Search 09-09-2015 0 3	0	3
How to extract these individual fields for iostat data? I am having a difficult time extracting fields for data returned by iostat. Has anyone been able to extract these in... by jodros Builder in Splunk Search 09-09-2015 0 1	0	1
How to display the Interesting Fields in a custom search view using the Splunk web framework? I'm using the web framework to create my own custom search view. However, from http://docs.splunk.com/DocumentationSt... by dcdd New Member in Splunk Search 09-09-2015 0 2	0	2
How to parse CEF files with key value pairs that contain white space? Hello all! I am a Splunk "newb" when it comes to parsing out files for ingestion. Here is my situation. I have a CE... by brent_weaver Builder in Splunk Search 09-09-2015 0 5	0	5
How can I use values in a table for a gauge? Hi all, I have a search that returns a table with only one line and four int values. What I'd like to do, is to cre... by pinVie Path Finder in Splunk Search 09-09-2015 0 1	0	1
R Project: How do I use commands involving paths with R language in Splunk? I want to use R to train a machine learning model, export it using saveRDS(), and then importing it again within Splu... by dkoops Path Finder in Splunk Search 09-09-2015 1 2	1	2
How to incorporate a pattern into a search? If I can see a pattern forming that will help me track users in my environment, how can I set up a search to serve t... by matt_cunningham New Member in Splunk Search 09-09-2015 0 1	0	1
How to search the total distinct count on two different fields? Hi, This is kind of a silly question, but currently my application is logging the session id as two separate fields,... by jameskerivan Explorer in Splunk Search 09-08-2015 0 2	0	2
I need to find an IP Address or user agent for a client that visits 5 uri stems, how can I incorporate this into a query An group of IP Addresses, continue to hit a set of 5 uri stems. If they change their IP Address, I would still like t... by matt_cunningham New Member in Splunk Search 09-08-2015 0 4	0	4
What can I use instead of the join command for my search? Hi, I would like to use something different instead of join index=test STATUS=Closed \| stats dc(ID) as TOTAL by PE... by akawacz Path Finder in Splunk Search 09-08-2015 0 6	0	6
Why isn't my index available for search in a distributed search environment? Hi to everyone I have a "Distributed Environment", with two indexers, and two search heads. In the Master Node Index... by rubeniturrieta Communicator in Splunk Search 09-08-2015 0 7	0	7
Transforms.conf and props.conf field extractions Hey fellow Splunker's. I am trying to figure out what i am doing wrong in the transforms.conf to create the proper fi... by Michael_Schyma1 Contributor in Splunk Search 09-08-2015 0 11	0	11
Week number and Month/Day of the begining of that week I report on a count of events by week number, it displays like this: Week Number Count ----------- -... by wpreston Motivator in Splunk Search 09-08-2015 3 7	3	7
Why is my time search not showing expected results with a relative time picker input? Hello everyone, Need your help. I have this dashboard to display some counter information for each host over a certa... by idab Path Finder in Splunk Search 09-08-2015 0 1	0	1
When I get a certain string in one search result, how do I append a field from another event that can be found through correlation of 2 other fields? Hi, Best way for me to explain is by example. example search: host=guac sourcetype="syslog" \| rex field=_raw "gu... by splunk0 Path Finder in Splunk Search 09-08-2015 0 2	0	2
How can I add icons that replace the cell.value on my table without using rangemap? Hi, I want to add icons that replace the cell.value on my table without using range map. How can I do that? thx by sfatnass Contributor in Splunk Search 09-08-2015 2 2	2	2
How do I write the regex to extract fields from another existing field? Hi, I need to extract a field from another field, no metadata fields. The existing field (let's call it existing_fi... by skender27 Contributor in Splunk Search 09-08-2015 0 15	0	15
Use variable on bucketing option Is there any way to use a variable on the bucketing start option? It only works if you use an explicit numeric value.... by bfernandez Communicator in Splunk Search 09-08-2015 0 5	0	5
How can I extract fields based on headers from a CSV file in .gz format? I tried providing a csv file location in inputs.conf, [monitor:///path/to/*.csv.gz] source = testcsv sourcetype = t... by jkponnuri Explorer in Splunk Search 09-07-2015 0 8	0	8
How to take index names from a CSV file and run a stats count on the listed index names? I need to find various information (counts, last and first event received time, etc) on indexes listed in a CSV file.... by varad_joshi Communicator in Splunk Search 09-07-2015 0 2	0	2
how to transpose ? field1,field2,field3 1, a, b 1, b, c 1, c, d 2, r, s 2, s, k 2, k, l 2, l, m field 1 is the key based on above dat... by sajumulakkal New Member in Splunk Search 09-07-2015 0 3	0	3
How to search users who had concurrent access on different PCs within the same logon and logoff period from my sample data set? Sample data set user, pc, logon, logoff, durationOfLogon User11, HNA1E8I, 01-06-15 13:49:09, 01-06-15 13:49:11, 0:00... by hkhat5 New Member in Splunk Search 09-07-2015 0 2	0	2
How can I keep only first 6k bytes of single line event by transforms.conf How can I keep only first 6k bytes of single line event. I have syslog type of data. They are single line and someti... by Masa Splunk Employee in Splunk Search 09-07-2015 0 7	0	7

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...

Splunk Search

How to add hours to _time for specific events using eval?

How to create a list of fields in a table with stats displayed on the Selected Fields sidebar, including rare 10 values, their counts, and percentages?

Why am I getting "Error in 'rex' command...Regex: missing )"?

How to extract these individual fields for iostat data?

How to display the Interesting Fields in a custom search view using the Splunk web framework?

How to parse CEF files with key value pairs that contain white space?

How can I use values in a table for a gauge?

R Project: How do I use commands involving paths with R language in Splunk?

How to incorporate a pattern into a search?

How to search the total distinct count on two different fields?

I need to find an IP Address or user agent for a client that visits 5 uri stems, how can I incorporate this into a query

What can I use instead of the join command for my search?

Why isn't my index available for search in a distributed search environment?

Transforms.conf and props.conf field extractions

Week number and Month/Day of the begining of that week

Why is my time search not showing expected results with a relative time picker input?

When I get a certain string in one search result, how do I append a field from another event that can be found through correlation of 2 other fields?

How can I add icons that replace the cell.value on my table without using rangemap?

How do I write the regex to extract fields from another existing field?

Use variable on bucketing option

How can I extract fields based on headers from a CSV file in .gz format?

How to take index names from a CSV file and run a stats count on the listed index names?

how to transpose ?

How to search users who had concurrent access on different PCs within the same logon and logoff period from my sample data set?

How can I keep only first 6k bytes of single line event by transforms.conf

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation