Splunk Search

Community Activity

when executing an external lookup, does splunk execute it on all nodes or just on the search head? I have a set of log data that contains user_ids, and want to do a lookup to resolve the user_id to an email address. ... by whisperstream Explorer in Splunk Search 07-31-2015 0 2	0	2
How I do identify all splunk components based off of the _internal index? Using the internal index, is there a way for me to find out errors being thrown from the different splunk components? by splunkDude2015 Explorer in Splunk Search 07-31-2015 0 2	0	2
How to merge events that are +/- 2 minutes apart into one single event using Transaction or Stats. I have the following table and even if some of the events don’t indicate the same minute, they are part of the same i... by cedmarjls32 New Member in Splunk Search 07-31-2015 0 1	0	1
How to display requests_currently_being_processed = (number) ? Hi guys, So today I am trying to graph "requests_currently_being_processed" by server by time- over 1 hour period. ... by splunkman341 Communicator in Splunk Search 07-31-2015 0 4	0	4
Adding a percentage Failure column to a table from a chart command I have the following search. index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="u... by zd00191 Communicator in Splunk Search 07-31-2015 0 3	0	3
Is it possible to search the modified date/time of a file? Is it possible to get the modified date/time of a file in search? The search below shows the time based on events and... by rmsagar Engager in Splunk Search 07-31-2015 0 3	0	3
db connect host? Hi, I want to pull in data from an Oracle database via db connect. I'm looking for some general guidance. I want to ... by a212830 Champion in Splunk Search 07-31-2015 0 4	0	4
How to create a dynamic table based on one search result? Hello, I'm building a line graph with a field with "UsedSpaceGB" from the year 2009 until now so I can see the growt... by outofheapspace Explorer in Splunk Search 07-31-2015 0 3	0	3
Why am I getting zero results with my stats distinct count search? Hi I wonder whether someone can help me please. I'm using the code below to run a search which works fine. index=... by IRHM73 Motivator in Splunk Search 07-31-2015 0 6	0	6
inputs.conf wildcards and whitelist question i would like to monitor the following in different sourcetypes, but doesnt seem to get the whitelist correct there wi... by minthu New Member in Splunk Search 07-30-2015 0 2	0	2
multi pattern string calculation on fields and count the fields value too I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers Counts=[100A=1... by sumitnagal Path Finder in Splunk Search 07-30-2015 0 1	0	1
How do I write a search to join these two lines of data and output results in a table with three columns? Hi Splunk heads, Can you please help me with a really tricky search? I am trying to join the following two lines tha... by Fergal111 Path Finder in Splunk Search 07-30-2015 1 9	1	9
Why is my rex command not extracting the field from my data? Hi, My rex is not giving any results. I want to extract "XXX" from the below highlighted area. I used rex field=... by Laya123 Communicator in Splunk Search 07-30-2015 0 9	0	9
How to get a sparkline to run on a different time span? I am wondering if it is possible to have a sparkline run on a different time span instead of the 15 minutes that I ha... by syx093 Communicator in Splunk Search 07-30-2015 0 2	0	2
How can I cache search results to avoid data recalculation? Hi, I have a dashboard with parameterized search (it takes three arguments from timepicker and dropdowns) that takes ... by RiccardoV Communicator in Splunk Search 07-30-2015 0 6	0	6
How to extract more number of strings under the same field name? my event is - "common.exceptions.CommandFailedAtServerException: concurrent.ExecutionException: common.SocketPoolEx... by Madhan45 Path Finder in Splunk Search 07-30-2015 0 6	0	6
How to sort chart columns where the column headers are field values? I have the following search. index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="u... by zd00191 Communicator in Splunk Search 07-30-2015 0 1	0	1
How do I customize the bar colors for my dashboard bar chart? Hi all, May i know if there is any way to change the colors of the bars in this screenshot? I want the grey part to ... by hqw Path Finder in Splunk Search 07-30-2015 4 4	4	4
How do I keep startswith from evicting a previous transaction? Assume I have an input file like the following: 2015-07-28 12:00:01 Executing function a... 2015-07-28 12:00:02 debu... by jswarren New Member in Splunk Search 07-30-2015 0 11	0	11
Why am I unable to get started with searching real-time data coming in on a TCP port? Hi All I may be getting old and senile, but I just can't seem to get started with searching. I have added a TCP sour... by ActiveRFID New Member in Splunk Search 07-30-2015 0 8	0	8
How to add lookup files manually? Hi Everybody, I want to ask you, how we can add lookup files into Splunk manually? I'm working on a script that can ... by isedrof Engager in Splunk Search 07-30-2015 0 3	0	3
How do I create a stacked bar chart? I have 3 servers: host=host1, host2, and host3 From these servers I get s_status=ok, nok I would like to get a graph... by lakromani Builder in Splunk Search 07-30-2015 1 6	1	6
Pass fields from inner search to outer search Please disregard...mods can delete. by patelaa Explorer in Splunk Search 07-29-2015 0 2	0	2
Shouldn't this map command work? \|stats count\|eval cip='foo'\|map search="search index=* Address=$cip$" It errors out saying "Error in 'map': Did not... by wkupersa Path Finder in Splunk Search 07-29-2015 0 3	0	3
How to use Splunk to detect web attacks with PHP IDS regex rules? I'm noodling the thought of using Splunk to detect Web attacks (similarly to Scalp) via the Apache HTTP logs. Scalp ... by jeremyarcher Path Finder in Splunk Search 07-29-2015 1 4	1	4