Splunk Search

Community Activity

Bucket time span causing incorrect date entries I have the following query: some query... \| bucket _time span=1d \| eval date=strftime(_time, "%b %d, %Y") \| chart av... by ohlafl Communicator in Splunk Search 07-29-2015 0 2	0	2
Why am I not able to see my extracted field in Splunk Web? I am not able to see my extracted field. I can see the field created under splunk/etc/users/local Also, I added the... by manja054 Explorer in Splunk Search 07-29-2015 0 5	0	5
How to extract and assign a timestamp from a multiline event? How to extract and assign the timestamp from the below multiline event. Timestamp exists in the 4th line from last. ... by srinathd Contributor in Splunk Search 07-29-2015 0 6	0	6
How do I edit my transaction search to find the queue time for different steps in my sample data? Hi, I am working in a market research company. We will send some online surveys to some samples. We have 3 steps to ... by Laya123 Communicator in Splunk Search 07-29-2015 0 3	0	3
How do I optimize my regex for a field extraction to improve efficiency and searchability? I am working on field extraction in splunk and I have come up with the below regex (spunk regex does not work the sa... by HattrickNZ Motivator in Splunk Search 07-29-2015 0 9	0	9
How to filter out rows for individual tables by Metric date? Hello, I have a handful of tables that contain monthly reported data. Each table starts at a different Metric time, ... by minkyuk Explorer in Splunk Search 07-29-2015 0 3	0	3
How do I extract and separate an arbitrary number of field values with regex? input: myCommand -myArgs taska taskb taskc myCommand -myArgs taska myCommand -myArgs taska taskb taskc taskd What... by andrew207 Path Finder in Splunk Search 07-29-2015 0 4	0	4
Did folderize stop working? I had an old Splunk saved search from several versions ago which successfully used folderize. However, when I ran it... by ualbanytech Path Finder in Splunk Search 07-28-2015 2 1	2	1
Is it possible in Splunk to trigger a search, generate a report, and email it or save the report in some location? Hi Team, I would like to know if it is possible in Splunk to trigger a search (with regular expressions), generate t... by smolcj Builder in Splunk Search 07-28-2015 0 5	0	5
Trying to find the index of a value within a multivalued field, why is is mvfind on the multivalue field not working? Hi, I am trying to find the index of a value within a multivalued field. I assume mvfind is the correct eval functio... by t_tharr Engager in Splunk Search 07-28-2015 0 2	0	2
I need to track the progress of students over time Our event lists the answer to one question on a test. Our test numbers are unique to one set of test questions by one... by wwf New Member in Splunk Search 07-28-2015 0 7	0	7
Can automated lookups be defined on a search head but not pushed to search peers? I have a 60MB lookup file on my ES search head that is only used for automated lookups against data indexed locally o... by sspinner Explorer in Splunk Search 07-28-2015 0 3	0	3
Is there a way to use regex on a standalone string to pull out each value, then append "field!=" to the front to exclude these values from a search? I have a large list of values for a field that I would like to exclude from my search. Rather than having a huge sear... by jlosee Path Finder in Splunk Search 07-28-2015 0 9	0	9
How to search two indexes to find if an event in index B does not occur within certain time range of an event in index A? I hope the following makes sense...I have two indexes for separate application logs, index A and index B. I need help... by patelaa Explorer in Splunk Search 07-28-2015 1 2	1	2
How do I use the "AND" operator or any other way to list all values of a field that have both statuses FAIL and SUCCESS? I have a search where the transaction status of a policy was set to FAIL. It was processed manually and now it has c... by athorat Communicator in Splunk Search 07-28-2015 0 9	0	9
How to search the sum of transactions where the times do not overlap? I want to be able to show the sum of time that users have had licenses checked out (historically). But if a user has ... by cmamer New Member in Splunk Search 07-28-2015 0 4	0	4
How to combine my two searches for Windows WMI Data (Host, OS, Version, SP and Number of Installed updates) into one report? Hello, I have two different searches that return the data that I would like to see in one report. However, I am havi... by JDukeSplunk Builder in Splunk Search 07-28-2015 0 2	0	2
How to search two events that occurred right before a specific event showing a certain error to analyze what happened? Hello, When I search for some events (i.e index=main *password fail), I want to get the events with two lines before... by chris1 Explorer in Splunk Search 07-28-2015 0 1	0	1
Multiple instances of Splunk w/ Boot-start How can I have multiple splunk instances on linux and use boot-start? The command "./splunk enable boot-start" will ... by magicfletch Engager in Splunk Search 07-28-2015 1 3	1	3
How to write a regular expression to filter out any data after a second semi-colon per line? Hi, I have a file that contains the following format and I wish to only index information before the 1st two semi-co... by newbiesplunk Path Finder in Splunk Search 07-28-2015 0 3	0	3
How to edit XML to set certain colors for bars in a chart based on percentage values from my data? Hi guys, I am trying to edit a chart I have to have certain colors corresponding to the data inside. I have 5 server... by splunkman341 Communicator in Splunk Search 07-28-2015 0 2	0	2
How do I edit my search to remove duplicates of a field that appear in a table column? Say I have a table ... host, IP, destinationHostname, Port, count host1 10.10.10.1 desthost1 9999, 33 host1 10.10.1... by pkeller Contributor in Splunk Search 07-28-2015 0 4	0	4
Trouble reading log lines with large JSON or multiline Java exceptions from slf4j My question is similar to others around extracting new fields, but the answers I've tried to date haven't worked. Wh... by mriley_cpmi Explorer in Splunk Search 07-28-2015 0 3	0	3
can't extract field in json Hi, I try to extract fields fron this json. I've tried with jsonkv and spath and it looks like that ' does generate... by efrenette11 Path Finder in Splunk Search 07-28-2015 0 5	0	5
How do index TAB delimited files? I am looking to read into SPLUNK a tab delimited file. But most of what I see is key based Field Extractions (, space... by Alan_Bradley Path Finder in Splunk Search 07-28-2015 1 8	1	8

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Splunk Search

Bucket time span causing incorrect date entries

Why am I not able to see my extracted field in Splunk Web?

How to extract and assign a timestamp from a multiline event?

How do I edit my transaction search to find the queue time for different steps in my sample data?

How do I optimize my regex for a field extraction to improve efficiency and searchability?

How to filter out rows for individual tables by Metric date?

How do I extract and separate an arbitrary number of field values with regex?

Did folderize stop working?

Is it possible in Splunk to trigger a search, generate a report, and email it or save the report in some location?

Trying to find the index of a value within a multivalued field, why is is mvfind on the multivalue field not working?

I need to track the progress of students over time

Can automated lookups be defined on a search head but not pushed to search peers?

Is there a way to use regex on a standalone string to pull out each value, then append "field!=" to the front to exclude these values from a search?

How to search two indexes to find if an event in index B does not occur within certain time range of an event in index A?

How do I use the "AND" operator or any other way to list all values of a field that have both statuses FAIL and SUCCESS?

How to search the sum of transactions where the times do not overlap?

How to combine my two searches for Windows WMI Data (Host, OS, Version, SP and Number of Installed updates) into one report?

How to search two events that occurred right before a specific event showing a certain error to analyze what happened?

Multiple instances of Splunk w/ Boot-start

How to write a regular expression to filter out any data after a second semi-colon per line?

How to edit XML to set certain colors for bars in a chart based on percentage values from my data?

How do I edit my search to remove duplicates of a field that appear in a table column?

Trouble reading log lines with large JSON or multiline Java exceptions from slf4j

can't extract field in json

How do index TAB delimited files?

Announcing Modern Navigation: A New Era of Splunk User Experience

Best Practices: Splunk auto adjust pipeline queue

Request for Professional Development: Attending .conf26

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation