Splunk Search

Community Activity

Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"? I created a data model "Aggregate". I added an object which is a root search object named "usage". There is a search ... by sushmitha_mj Communicator in Splunk Search 07-17-2015 0 6	0	6
How to write the regex to extract semicolon delimited fields? I have the following log statement, which uses semicolon delimiter and where i want to extract columns as specific fi... by ismarslomic Path Finder in Splunk Search 07-17-2015 0 13	0	13
How to detect and fill default value to empty-value field ? Hello, When i did a search on my SQL data, there are a lot of empty-value fields, which don't contain anything, i wa... by sieutruc Contributor in Splunk Search 07-17-2015 1 4	1	4
Regex field extraction Splunk Version 6.2.0 Splunk Build 237341 (MacOSX Yosemite) This is the line I'm looking to extract fields using rege... by gonzalogasca New Member in Splunk Search 07-17-2015 0 3	0	3
REGEX match on multiple conditions help I need help with a REGEX that needs to match multiple conditions in a log event. The event looks like this: 02:02:0... by roguepacket Engager in Splunk Search 07-17-2015 2 4	2	4
Search multiple column in logs and give count of respective column Hi, My question is divided into 2 parts - 1.) I have a log file in which there are about 20-22 columns but i want t... by sunnyparmar Communicator in Splunk Search 07-17-2015 0 7	0	7
timestamp in the beginning Why splunk adds the date and time to the beginning of a log. How to clean it? Jul 15 09:27:20 172.16.19.1 Jul 15 201... by vinchakov_a Path Finder in Splunk Search 07-16-2015 0 5	0	5
Why is my lookup search query not returning expected results? I've got a KeywordList.csv lookup table with 3 columns (URI, URI_Keyword, URI_KeywordType). URI is a pre-existing fi... by mistergreen28 New Member in Splunk Search 07-16-2015 0 3	0	3
Not getting field automatically from lookup table I have a file: racf_username.csv located in /opt/splunk/etc/system/lookups which looks like; racf,username A123456,A ... by RVDowning Contributor in Splunk Search 07-16-2015 0 4	0	4
How to do multiple searches at once? Hi guys, I need to have multiple searches running that pull up a word from the same field and replace it with anothe... by BITSIntern Path Finder in Splunk Search 07-16-2015 0 10	0	10
RStudio integration with Splunk Is there any way to run Splunk queries from the RStudio IDE rather than from within the search bar? by mgianola Explorer in Splunk Search 07-16-2015 0 1	0	1
How to create a field from another field? I have a field "F1" with values as following: I want to add a filed "F2" with value 'a' to all 'a*', with value 'b'... by lys1030 Explorer in Splunk Search 07-16-2015 0 2	0	2
Setting options for host regex not working as expected We have a set of hosts that all begin with the letter 'm' and we want to set DATETIME_CONFIG = CURRENT for them. If ... by cjosephson Engager in Splunk Search 07-16-2015 0 4	0	4
Line Chart single value over time I have a log containing memory usage over a period of time. How can I plot a line graph where the x-axis is the time,... by Blackninja5431 New Member in Splunk Search 07-16-2015 0 2	0	2
key value begins with newline not searchable We have a key value pair where the value begins with a newline '\n'. It used to not have that newline and old search... by jeastman Path Finder in Splunk Search 07-16-2015 1 3	1	3
Feed output back into search to show more data Fairly new to Splunk so forgive the, what must be, fairly obvious question. We have an alert setup to email us if we... by alexlomas Path Finder in Splunk Search 07-16-2015 0 2	0	2
how to create a search bar in a dashboard? Hi guys, Thanks for reading this question. I have a dashboard on which I display several fields in a table as you can... by clairebesson Explorer in Splunk Search 07-16-2015 0 5	0	5
Pulling stats for the most recent time for values in a lookup table, why doesn't a join work when entries have a wildcard "*" character? Hi, I am trying to pull some statistics on what is the most recent time a value in a lookuptable appeared in my Splu... by octavian_i New Member in Splunk Search 07-16-2015 0 1	0	1
Transaction command not returning results I would like to extract from my log file user details on how many time they have had a request to the SGW where the n... by ssaenger Communicator in Splunk Search 07-16-2015 0 1	0	1
Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? Hello , I am trying to calculate time diff between two fields in a single event. My current search: sourcetype="XX... by ambujhbti New Member in Splunk Search 07-16-2015 0 4	0	4
How to search in two lookup files? Hey everybody, I'm making a comparison between two files: one uploaded as an index and the second as a lookup file. ... by isedrof Engager in Splunk Search 07-16-2015 0 8	0	8
Can transaction be used only with "endswith" without use of "startswith"? Can transaction be used with endswith only without use of startswith? I read that transaction is processing events fr... by Ahmedkhalil Communicator in Splunk Search 07-16-2015 0 10	0	10
Why does my lookup not run? I am writing a query to lookup processed web domains against a lookup list. I have defined a lookup named ss3url_loo... by borgy95 Path Finder in Splunk Search 07-16-2015 0 5	0	5
Why does an ODBC query show a different result from the Splunk timechart report? Hi, I have a simple report/saved search with fixed time (-8@w1 to +1@w1) that calculates a timechart from a long lis... by big_twilde Engager in Splunk Search 07-16-2015 0 1	0	1
I have two tables "order.csv" and "delivery.csv". How can I use lookup command to check the delivery status based on the product? delivery.csv contains the fields- key,name,product,priceorder.csv contains the fields- key,shipdate,location,delivery... by Madhan45 Path Finder in Splunk Search 07-16-2015 0 3	0	3