Splunk Search

Community Activity

How to exclude weekends (Saturday and Sunday) from a transaction search and and order the days chronologically? I have the following search: source="c:\\logs\\aaaa" \| transaction bbbb startswith=("CCCC STARTED") endswith=("CCC... by RVDowning Contributor in Splunk Search 09-02-2015 1 1	1	1
How to change Inline Search based on the click.value in Simple XML? Hello I am trying to implement an inline chart whose search criteria will change based on the $click.value$ on the t... by theouhuios Motivator in Splunk Search 09-02-2015 0 2	0	2
I Need Help Filling Null Fields with Zero I have 2 tax calls (CalculateTax and LookupTax) and want to count their errors for the previous day's hour. I then ad... by skoelpin SplunkTrust in Splunk Search 09-02-2015 0 10	0	10
How to escape a character in strptime? I'm trying to do a strptime on this time, 2015-09-01T01:03:22. This is the query I'm running, index=[redacted] sour... by sam_jacob Path Finder in Splunk Search 09-02-2015 0 2	0	2
[Cisco ironport mail logs] How can I do a transaction on a sometimes-multi-value field where a key field migrates values? Hello, My problem is that I have ironports mail logs splitted like this : Jun 8 13:51:21 my_server: Mon Jun 8 13:... by PierreE Path Finder in Splunk Search 09-02-2015 1 8	1	8
How to display few matching entries from table. Hi, I have created a table something like this. Name, Place , Business, Value Bob, NY, Retail, 1000 Alice, Boston, T... by ashokqos Path Finder in Splunk Search 09-02-2015 0 2	0	2
How to create a report showing percentage CPU usage for multiple servers? Hi guys, I'm trying to create a bar chart that shows the min, avg, and max for five specific servers. The chart sho... by idab Path Finder in Splunk Search 09-02-2015 1 9	1	9
How to configure props.conf for automatic field extractions from a CSV file without specifying all field names? Using Splunk v6.2.0 The default field-extraction ( sourcetype=csv ) from a CSV logfile worked fine, but it incorrect... by nk-1 Path Finder in Splunk Search 09-02-2015 0 4	0	4
How to edit my search to show the trending Malware Infection Rate in our company, not just one-time results? Hi, I am doing an analysis on malware infections in our company, more precisely per department. Working with total n... by shakermaker Explorer in Splunk Search 09-02-2015 0 6	0	6
Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user? Hi, I have a parameter system_mem that records the memory usage of an application. I am trying to do analysis by us... by DanielFordWA Contributor in Splunk Search 09-02-2015 0 2	0	2
How to display zero if there are null values reporting for a mail id? Hi, I have a search similar to the one below which gives the total count of emails sent out. Here, when there are ... by Navanitha Path Finder in Splunk Search 09-02-2015 0 5	0	5
Why am I not getting expected results using inputlookup with a time chart? I have the following search which displays the table on calls based on their time range. sourcetype=elogs clientid=... by nmohammed Builder in Splunk Search 09-01-2015 0 3	0	3
Why is our search on Windows DHCP logs using a MAC address lookup table not producing any results? We have created a MAC lookup table, but we get no hits in our searches. Our aim is to lookup the Manufacturer's name... by pjohnson1 Path Finder in Splunk Search 09-01-2015 0 8	0	8
Is there any performance impact when you use "search" vs using "where"? Hi, I am wondering if there is any guidelines as to using the "search" or "where" commands within a search query whe... by ShawnClark Explorer in Splunk Search 09-01-2015 1 6	1	6
Total number of events by index over the last month Hello, This to me seems like a rather easy question to have answered but I'll be if I can find one. I'm looking to c... by wtaylor149 Explorer in Splunk Search 09-01-2015 0 7	0	7
Whitelist not picking up files - heavy forwarder monitoring folder I've set up a heavy forwarder on "stage2" (linux machine) and a central Splunk instance on "stage1" (another linux ma... by shantu Explorer in Splunk Search 09-01-2015 0 1	0	1
Why is my custom sourcetype configuration not extracting the host field? I have a file with data similar to the following: 2015:09:01:15:00:00.005 sl200services007 3:INFO SERVER NOFMT 43279... by lisaac Path Finder in Splunk Search 09-01-2015 0 14	0	14
Why is my configuration using regex to assign sourcetypes with props.conf and transforms.conf not working? Hello, I am trying to get dynamic sourcetype working for a set directories under Splunk. The intention is that the f... by Volto Path Finder in Splunk Search 09-01-2015 0 4	0	4
After applying the stats percentile function to the daily max per sourcetype, how do I format the resulting table to create more fields? If I have the following, the max per day per sourcetype: index=_internal sourcetype=* sourcetype=splunkd \| timecha... by HattrickNZ Motivator in Splunk Search 09-01-2015 0 2	0	2
After adding a new Splunk server in a distributed environment, why does it not show up in results unless I include splunk_server=*? I recently added a new splunk server in a distributed environment. Now, when I do this search: index=os earliest="09... by louieb3 Path Finder in Splunk Search 09-01-2015 0 2	0	2
create field for syslog raw data Aug 31 10:06:32 serverA.com Aug 31 16:06:32 [serverA: HTTPPool02:debug]: sridhar:AUTH:error:Login failed for user sri... by SridharS Path Finder in Splunk Search 09-01-2015 0 8	0	8
How to extract the last file name from my sample string of data? Hello all, I have the following string: "6900 0 1024 0 0 0 0 0 0 0 C:\windows\System32\La... by jclemons7 Path Finder in Splunk Search 09-01-2015 0 2	0	2
How to compare a certain date/time in epoch format with a fixed date/time in human readable format? Hi, I'd like to compare two dates and time (if A<=B): the one, let's call it A, I have it already in epoch time and ... by skender27 Contributor in Splunk Search 09-01-2015 0 3	0	3
How to use geostats to display top 5 results per country and sort by count instead of alphabetically? Hello, I am new to Geostats and am wondering if a couple of features exist or not. Is it possible for each pie chart... by KindaWorking Path Finder in Splunk Search 09-01-2015 0 2	0	2
How to write a search to return the number of forwarders that have reported within the last hour? Hi Guys So what I'm looking for is the search from the Deployment Monitor app that shows the All Forwarders section ... by AaronMoorcroft Communicator in Splunk Search 09-01-2015 0 2	0	2

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Splunk Search

How to exclude weekends (Saturday and Sunday) from a transaction search and and order the days chronologically?

How to change Inline Search based on the click.value in Simple XML?

I Need Help Filling Null Fields with Zero

How to escape a character in strptime?

[Cisco ironport mail logs] How can I do a transaction on a sometimes-multi-value field where a key field migrates values?

How to display few matching entries from table.

How to create a report showing percentage CPU usage for multiple servers?

How to configure props.conf for automatic field extractions from a CSV file without specifying all field names?

How to edit my search to show the trending Malware Infection Rate in our company, not just one-time results?

Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user?

How to display zero if there are null values reporting for a mail id?

Why am I not getting expected results using inputlookup with a time chart?

Why is our search on Windows DHCP logs using a MAC address lookup table not producing any results?

Is there any performance impact when you use "search" vs using "where"?

Total number of events by index over the last month

Whitelist not picking up files - heavy forwarder monitoring folder

Why is my custom sourcetype configuration not extracting the host field?

Why is my configuration using regex to assign sourcetypes with props.conf and transforms.conf not working?

After applying the stats percentile function to the daily max per sourcetype, how do I format the resulting table to create more fields?

After adding a new Splunk server in a distributed environment, why does it not show up in results unless I include splunk_server=*?

create field for syslog raw data

How to extract the last file name from my sample string of data?

How to compare a certain date/time in epoch format with a fixed date/time in human readable format?

How to use geostats to display top 5 results per country and sort by count instead of alphabetically?

How to write a search to return the number of forwarders that have reported within the last hour?

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Event Series: Telemetry Pipeline Management

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation