Splunk Search

Community Activity

How Can I View IPs That Have NOT Generated Events? For example, I want to run the following search and have splunk output IPs that do NOT show up in the results. index... by ErraticIncome93 Explorer in Splunk Search 08-25-2015 0 6	0	6
Is it possible to get both rare and top results in the same search result table? Hi, I want to know if it's possible to get rare and top value on the same table search. index=_internal \|top limit... by sfatnass Contributor in Splunk Search 08-25-2015 0 3	0	3
Is there a way to filter out events from search results based on the logged-in Splunk user running the search and specified field values? I have a requirement to filter out events based on: the USER running the search and FIELD VALUES contained in the ev... by robburns Engager in Splunk Search 08-25-2015 0 4	0	4
How to create a timechart with overlay lines for Mean, Upper Control Limit, Lower Control Limit, and Targets? Hi, I have a number of timecharts displaying KPIs over the last 30 days. What would be the most efficient way to ad... by DanielFordWA Contributor in Splunk Search 08-25-2015 1 1	1	1
Error in 'eval' command: The operator at '{}.Instrument' is invalid. Do you know why I get the following error message? vols{}.Instrument is a valid field but it doesn't like the {}. i... by TheMilkMan New Member in Splunk Search 08-25-2015 0 6	0	6
How can I create a table of results from my XML data? Given the following event log XML (sample) data: <?xml version="1.0" encoding="utf-8" standalone="no"?> <!--This fil... by GadgetGeek Path Finder in Splunk Search 08-24-2015 1 3	1	3
Multiple sums in one graph This is a followup question to This. http://answers.splunk.com/answers/301144/sum-of-new-events-over-time.html Now f... by liorfink Engager in Splunk Search 08-24-2015 0 2	0	2
How to edit my search to group by each month and then group by "Classification"? Hi Everyone, My apologies for the long message, but I hope this will give enough information about my requirement. ... by nilotpaldutta Explorer in Splunk Search 08-24-2015 0 2	0	2
How to extract data from a multiline field? Hello, I am trying to extract data from a field ("Files:") that holds multiple lines of data. The lines that I am af... by ahogbin Communicator in Splunk Search 08-24-2015 0 1	0	1
After upgrading from Splunk 6.1.1 to 6.19, why am I getting "appear to be running outdated version of search app..." on our search head? Hi, I just upgraded from 6.1.1 to 6.1.9, and now, in the search head, a message is appearing, telling me that the se... by a212830 Champion in Splunk Search 08-24-2015 0 1	0	1
Initiating Splunk on AWS AMI, why am I getting "Search not executed: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch. user=admin" I've initiated an AMI of Splunk on a t2.medium instance, and even before I've actively used it, I get Search not e... by gmark Explorer in Splunk Search 08-24-2015 0 5	0	5
How do I combine my two searches, using the result from the first search to run the second search? My 1st search will be like this to get Peak Day and Peak Hour according to hits: earliest="06/08/2015:00:00" latest=... by shreyasathavale Communicator in Splunk Search 08-24-2015 0 18	0	18
How to "stats avg(field1) by field2" and display that average in a top limit=20 field2 stats page I'm working with Alert logs, which spit out log events only if certain SQL queries take longer than a threshold time.... by shantu Explorer in Splunk Search 08-24-2015 0 2	0	2
Search for when "Event X" happens within x hours of "Event Y" I have this search: ("WARNING: ERROR Message" host=SERVER1) OR (EventCode=1074 Shutdown_Type="*") This shows both ... by bravon Communicator in Splunk Search 08-24-2015 0 2	0	2
Why are field extractions only working for 24 hours or less if the log format hasn't changed? I have some logs from a media server that are all formatted in a consistent way, making field extraction creation ver... by pwilliams_splun Splunk Employee in Splunk Search 08-24-2015 1 21	1	21
Why did my index search cease and I receive a "Maximum Threshold Met" error message? There is a small group of people in my office using Splunk on their local machine. Two of us have received this mess... by SplunkChallenge New Member in Splunk Search 08-24-2015 0 1	0	1
How does one create inline Python scripts for use in Splunk searches? I am creating a simple script to take a hex(base 16) encoded field and convert it to readable text. For this endeavor... by dc5553 Explorer in Splunk Search 08-24-2015 0 2	0	2
How would you search for an alphanumeric string where the first part is fixed and the end number varies in length? I would appreciate help in a search for the following: The first part of the string is always /device/status/ while t... by Akita881 New Member in Splunk Search 08-24-2015 0 4	0	4
Dashboard Drilldown: How to use the timechart command to pass _time or time fields to a form? Hi guys, index=_internal sourcetype=stream:stats host=* \| spath Output=TcpSessionCount path=sniffer{}.processors{}... by chengyu Path Finder in Splunk Search 08-24-2015 0 2	0	2
How to plot username (non-numeric) value on the y-axis on a scatter chart? I have a log in the following format: username=nan time=09:00 operation=login username=ver time=10:00 opertiaon=logo... by Venkat_16 Contributor in Splunk Search 08-24-2015 0 3	0	3
stats right justify numbers I have stats output some numbers like min, max, avg. The numbers are left justifed and make it really hard to read. ... by wang Path Finder in Splunk Search 08-24-2015 2 2	2	2
Subsearch within a bucket I am looking to correlate events from two different sources whereby a rare event in source A, (in a 1 hour window) se... by nickhills Ultra Champion in Splunk Search 08-24-2015 0 5	0	5
Join outer fails to return valid result even when the value exists in both searches Below is the search which I'm trying: index=p_data sourcetype="p_sourcetype" \| xmlkv \| where EventId!="" \| table sou... by leonheart78 Explorer in Splunk Search 08-24-2015 0 10	0	10
how to get host, sourcetype and source from a single \|metadata search. say i am running a search like this: \| metadata type=hosts \| eval FirstSeen=firstTime \| eval RecentSeen=recentTime \|... by Genti Splunk Employee in Splunk Search 08-24-2015 1 2	1	2
What are the critiria to use various Splunk Predict Algorithms,How do we interpret the following prediction algorithms: LL, LLP, LLT, LLB? when to use which algorithms? I am trying to use predict command from Splunk for predictive analysis. I would like to know certain details about di... by nawneel Communicator in Splunk Search 08-24-2015 0 2	0	2

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...

Splunk Search

How Can I View IPs That Have NOT Generated Events?

Is it possible to get both rare and top results in the same search result table?

Is there a way to filter out events from search results based on the logged-in Splunk user running the search and specified field values?

How to create a timechart with overlay lines for Mean, Upper Control Limit, Lower Control Limit, and Targets?

Error in 'eval' command: The operator at '{}.Instrument' is invalid.

How can I create a table of results from my XML data?

Multiple sums in one graph

How to edit my search to group by each month and then group by "Classification"?

How to extract data from a multiline field?

After upgrading from Splunk 6.1.1 to 6.19, why am I getting "appear to be running outdated version of search app..." on our search head?

Initiating Splunk on AWS AMI, why am I getting "Search not executed: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch. user=admin"

How do I combine my two searches, using the result from the first search to run the second search?

How to "stats avg(field1) by field2" and display that average in a top limit=20 field2 stats page

Search for when "Event X" happens within x hours of "Event Y"

Why are field extractions only working for 24 hours or less if the log format hasn't changed?

Why did my index search cease and I receive a "Maximum Threshold Met" error message?

How does one create inline Python scripts for use in Splunk searches?

How would you search for an alphanumeric string where the first part is fixed and the end number varies in length?

Dashboard Drilldown: How to use the timechart command to pass _time or time fields to a form?

How to plot username (non-numeric) value on the y-axis on a scatter chart?

stats right justify numbers

Subsearch within a bucket

Join outer fails to return valid result even when the value exists in both searches

how to get host, sourcetype and source from a single |metadata search.

What are the critiria to use various Splunk Predict Algorithms,How do we interpret the following prediction algorithms: LL, LLP, LLT, LLB? when to use which algorithms?

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation