Splunk Search

Community Activity

can't extract field in json Hi, I try to extract fields fron this json. I've tried with jsonkv and spath and it looks like that ' does generate... by efrenette11 Path Finder in Splunk Search 07-28-2015 0 5	0	5
How do index TAB delimited files? I am looking to read into SPLUNK a tab delimited file. But most of what I see is key based Field Extractions (, space... by Alan_Bradley Path Finder in Splunk Search 07-28-2015 1 8	1	8
How to filter out events by regex in transforms.conf? Hi guys, I'm new to Splunk and I need ur help! I was trying to discard some specific events by regex and failed. He... by LuiesCui Communicator in Splunk Search 07-28-2015 0 3	0	3
Missing logs on sos index Hi, we are using the SoS app, basically most of the searches are working. However we have noticed that the index sos... by arber Communicator in Splunk Search 07-28-2015 0 1	0	1
Count unique values of a field in one result I have the following result from a simple search: I, [2015-07-23T15:30:39+02:00 (1437658239.654) #38640] INFO -- cc... by valentin_bogdan Explorer in Splunk Search 07-28-2015 1 5	1	5
How do I run my search to find missing events on 80 Windows Domain Controllers running Splunk 6.1.4? We have Splunk running on all of our Windows Domain Controller servers (80 of them), but we seem to be missing events... by daniel_knights New Member in Splunk Search 07-28-2015 0 1	0	1
Why is Search Head "search" performance in a distributed search setup slower than the same search on a single instance? Hi Everyone, I'm testing a simple setup of a search head on a single 24 core host. The setup basically consists of 1... by jwquah Path Finder in Splunk Search 07-27-2015 0 8	0	8
Drilldown from Flashchart object Hey, I have a column flashchart on a dashboard called dash_usage.xml. When I click on a bar(e.g. called User where v... by Ant1D Motivator in Splunk Search 07-27-2015 2 5	2	5
How to extract these fields from my sample data? I wanted to extract the below values. Time TakenResponse code in the string - HTTP/1.1" 200 example, I need to know ... by mcvr New Member in Splunk Search 07-27-2015 0 2	0	2
How to display two field values in a single table column? I have the following search: index=cashflow host=atm source=income OR source=outcome \| eval accountStatus="Income: ... by JohnSwansson Explorer in Splunk Search 07-27-2015 1 7	1	7
How to aggregate a percentage of a total before another search? Hey! I am trying to figure out how to aggregate a percentage of the total before another search like this: eventName... by faramarz Path Finder in Splunk Search 07-27-2015 0 2	0	2
How to use "NOT" condition in regular expression? for example i have the string "update event from remote cache". i need to use NOT condition for this to capture ab ev... by Madhan45 Path Finder in Splunk Search 07-27-2015 0 3	0	3
How to split multilevel XML to extract fields and values? <messaging><messaging_id>data_range</messaging_id><currentTimeStamp>2015-06-11-090445569807</currentTimeStamp> <Trans... by Shan Builder in Splunk Search 07-27-2015 0 4	0	4
How do I edit my search to find certain strings in my data and replace them with other strings? Hi guys, I have this specific search that I want to edit: index="tablet_os" sourcetype="df" host=dc1* sda3 OR Data... by splunkman341 Communicator in Splunk Search 07-27-2015 0 6	0	6
How Can I use Stats Avg() On a Datetime Field? I have this indexed field which is read by splunk as a string, I need the average length, but the data has no Day, m... by vtsguerrero Contributor in Splunk Search 07-27-2015 0 4	0	4
Make a slippery transaction within 20 events, how do I calculate the duration between the 1st and 20th event, 2nd and 21st, etc? Hello all, I'm trying to make a slippery transaction within 20 events. For example, my search return 40 events and ... by collier31200 Explorer in Splunk Search 07-27-2015 0 2	0	2
Help with Field Extraction for java app log I'm having trouble getting a Field Extraction that I need and hope for some advice. Below are three examples. Please ... by pcorchary Explorer in Splunk Search 07-26-2015 0 1	0	1
Basic Drill Down Good day Splunkers. Splunk newbie here, I have been testing it for a few days already. I can now create searches and... by jepoyyyy Explorer in Splunk Search 07-26-2015 0 2	0	2
Possible to retrofit props.conf file I have a situation in which Cisco Sourcefire files are being ingested into Splunk (v6.0.1) under different sourcetype... by jwalzerpitt Influencer in Splunk Search 07-25-2015 0 3	0	3
D3 sankey chart without using Django framework Hi I found an example using Django Framework in Splunk app site. But I still can not figure out how to do the same ... by melonman Motivator in Splunk Search 07-25-2015 2 7	2	7
Treemap D3 Library integration I have 2 fields (nodeid,jobid in which you could have multiple nodes assigned to 1 jobid) and need to graph it in a f... by wweiland Contributor in Splunk Search 07-25-2015 1 4	1	4
How to create multivalue field from single value fields? I have several fields containing machine performance data named as CPUload and RAMload etcetera. They are dynamically... by ohlafl Communicator in Splunk Search 07-25-2015 1 5	1	5
how to show Value with individual count Hello Folks I am new to plunk please help me out of this I need Value with its individual count shown next to it . I... by Bhargav99 New Member in Splunk Search 07-24-2015 0 4	0	4
How can I sort the order of my sources to appear in my chart? Hoping someone can help me out. This is my search: [\| metadata type=sources index="test_inputs" \| search source="GAL... by MichaelPriest Communicator in Splunk Search 07-24-2015 0 7	0	7
Is there any way to use the date_month field in a search as a numeric field without performance loss? Hi, As you know, date_month, date_mday, date_year fields are so useful to fetch data quickly. I usually use these f... by Riel Engager in Splunk Search 07-24-2015 1 4	1	4