Splunk Search

Community Activity

How to edit my search to extract a specific value from a reoccurring field within a single event? Hi all, I'm having trouble extracting a specific value from a reoccurring field within a single event. My search loo... by raby1996 Path Finder in Splunk Search 08-05-2015 0 6	0	6
How to edit my search to display a list of values in a single field? I've been looking through here for some time without success. My situation is this. I'm trying to parse regular Apa... by Phoenie1 Engager in Splunk Search 08-05-2015 0 3	0	3
What is the right way to Join? I've been searching how to join, but every example that I apply seems to be wrong. I've got referents type of log: ... by rochapablo Engager in Splunk Search 08-05-2015 0 2	0	2
How to calculate N series of values? My table look like this Date/Time Name Value 26/6/2014 1:00 Foo... by kkarthik2 Observer in Splunk Search 08-05-2015 0 1	0	1
How is priority handled for manual and automatic field extractions? HI, how is priority handled in regards to extractions. Lets assume I have an EXTRACT in props.conf extracting som... by pinVie Path Finder in Splunk Search 08-05-2015 0 1	0	1
How can I extract text between 2 standard texts that may contain " . , ? / " ? I have this type of log: Bin:456852 IssuingBank:PBS INTERNATIONAL A/S;DANSKE BANK;DANSKEBANK IssingCountry:DK IRF: ... by kostasKats Explorer in Splunk Search 08-05-2015 0 18	0	18
If I only have transaction data from 8AM to 6PM, how do I display a timechart from 00 to 24 hours? I have data (transactions data) which shows 8 AM to 6 PM, but I need to show a report from 00 hrs to 24 hrs. I tried ... by jkponnuri Explorer in Splunk Search 08-04-2015 0 7	0	7
Why is my search returning a different set of results after I replaced the 'dedup' command with 'stats dc()' to improve performance? Hi, I wonder whether someone may be able to help me please. I'm using the search below to successfully produce a g... by IRHM73 Motivator in Splunk Search 08-04-2015 0 2	0	2
How to calculate a rolling quarters growth rate, so if the current month is August, then growth rate = (May+June+July 2015)/(May+June+July 2014)? Hi all, I want to calculate the rolling quarters growth rate, which is calculated from the sum of the previous 3 mon... by hqw Path Finder in Splunk Search 08-04-2015 0 3	0	3
Looking for a License Usage query to generate external scripted alerts with hi guys i'm looking for help around license usage. i'm trying to troubleshoot a license violation we had recently wh... by awurster Contributor in Splunk Search 08-04-2015 1 1	1	1
Stats against timechart I have a search that I can use in a dashboard that gives me statistical data about bandwidth usage on a firewall. I ... by hlarimer Communicator in Splunk Search 08-04-2015 0 8	0	8
Use EVAL and Case for Windows EventCodes to provide information in table output. Using this code I am able to generate a table for IIS Application Pool specific errors. With the eval-case providing ... by JDukeSplunk Builder in Splunk Search 08-04-2015 0 2	0	2
How to configure the search head for distributed search with one search head, one indexer, and no cluster? I am setting up a green-field Splunk environment with one search head and one indexer, which we would like to separat... by JoelCBennett Engager in Splunk Search 08-04-2015 0 11	0	11
Is there a unix-style 'paste' in Splunk to merge three multivalue fields? paste is an extremely useful unix command. I want to use that very feature to merge three multivalue fields in exact... by pclewis Explorer in Splunk Search 08-04-2015 0 2	0	2
How to get the average of two fields from two different indexes by time? I'm trying to get the average memory and CPU usage by the hour. Unfortunately, that information is stored on two diff... by sam_jacob Path Finder in Splunk Search 08-04-2015 0 4	0	4
How to write a search to convert some table rows as columns? I need to convert the following source data as a specified output. Source Data Hostname Event_time K... by vemukira000 New Member in Splunk Search 08-04-2015 0 1	0	1
How to edit props.conf to specify a different regex for each of three sourcetypes? Hello, I'm trying to parse three different log files with different regex. I have three different sourcetypes for... by minkyuk Explorer in Splunk Search 08-04-2015 0 3	0	3
How to calculate the durations between 1 start event and multiple end events? Hello all, How do I get the time between one start event and multiple end events? Let me explain: I have one start... by collier31200 Explorer in Splunk Search 08-04-2015 1 4	1	4
Since we're using the batch stanza on our forwarders, how can we manually find duplicate indexed logs? We're using 'batch' stanza on our Splunk forwarders so they delete the log files once they've been indexed. Obviously... by shahzadarif Path Finder in Splunk Search 08-04-2015 0 2	0	2
Can we save the extracted fields from one Splunk instance and import them to another Splunk instance? Can we save the extracted fields from one Splunk instance and import the same to another Splunk instance ? Please le... by varunnair26 Explorer in Splunk Search 08-04-2015 0 3	0	3
What's a faster search than a Nested IF statement? I wrote this search to look at a user agent string (RTG_Browser) and identify the operating system. I plan on writing... by skoelpin SplunkTrust in Splunk Search 08-03-2015 0 8	0	8
How to obtain a sum of averages I have a data set that looks similar to the sample lines below and I'm having a difficult time finding a good way to ... by rrustong Explorer in Splunk Search 08-03-2015 0 3	0	3
Table - Row Colouring - (Splunk 6.x examples app) I was just trying to use the same example javascript and css with different search query, but i'm not able to get the... by splunker12er Motivator in Splunk Search 08-03-2015 0 5	0	5
How to calculate bandwidth utilization on an snmp interface from one point to another Hi, I keep getting negative values on my chart when i run my search below.All I'm trying to do is calculate the band... by bidahor13 Path Finder in Splunk Search 08-03-2015 0 15	0	15
I created a lookup and mapped to the logs, but how do I get the count of another field from a different log into my table? index=main sourcetype=mysourcetype\| stats count by X \| lookup data.csv cad as X \|table name, count, login \| where nam... by Bhargav99 New Member in Splunk Search 08-03-2015 0 4	0	4

Get Updates on the Splunk Community!

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Splunk Search

How to edit my search to extract a specific value from a reoccurring field within a single event?

How to edit my search to display a list of values in a single field?

What is the right way to Join?

How to calculate N series of values?

How is priority handled for manual and automatic field extractions?

How can I extract text between 2 standard texts that may contain " . , ? / " ?

If I only have transaction data from 8AM to 6PM, how do I display a timechart from 00 to 24 hours?

Why is my search returning a different set of results after I replaced the 'dedup' command with 'stats dc()' to improve performance?

How to calculate a rolling quarters growth rate, so if the current month is August, then growth rate = (May+June+July 2015)/(May+June+July 2014)?

Looking for a License Usage query to generate external scripted alerts with

Stats against timechart

Use EVAL and Case for Windows EventCodes to provide information in table output.

How to configure the search head for distributed search with one search head, one indexer, and no cluster?

Is there a unix-style 'paste' in Splunk to merge three multivalue fields?

How to get the average of two fields from two different indexes by time?

How to write a search to convert some table rows as columns?

How to edit props.conf to specify a different regex for each of three sourcetypes?

How to calculate the durations between 1 start event and multiple end events?

Since we're using the batch stanza on our forwarders, how can we manually find duplicate indexed logs?

Can we save the extracted fields from one Splunk instance and import them to another Splunk instance?

What's a faster search than a Nested IF statement?

How to obtain a sum of averages

Table - Row Colouring - (Splunk 6.x examples app)

How to calculate bandwidth utilization on an snmp interface from one point to another

I created a lookup and mapped to the logs, but how do I get the count of another field from a different log into my table?

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation