Splunk Search

Community Activity

How to search for the the last data point in a graph for each host in a table? In a given graph, say, [\|inputlookup capacityQuarterOne.csv] in which I have a big table of [ host / used_mb ] for e... by minkyuk Explorer in Splunk Search 06-30-2015 0 3	0	3
Can't search I am just getting started with Splunk at home on Ubuntu. I'm gathering logs from my pfsense firewall and I can see t... by wiz561 Explorer in Splunk Search 06-30-2015 0 4	0	4
Does deploying Splunk from AWS require a public IP address? I deployed Splunk Enterprise appliance from AWS Marketplace. The Splunk is deployed, but I cannot access the URL X.X.... by Beaubeau New Member in Splunk Search 06-30-2015 0 1	0	1
How do I edit my transaction search to only return on unique time result? I'm trying to adjust the following search: index=pcindex sourcetype=parlayx \| transaction corr \| search "lvl=ERROR" ... by mikylace Explorer in Splunk Search 06-30-2015 0 10	0	10
How do I edit my search to make a change to the resulting output? My search: index="ABC" sourcetype=* Customers=ABCD \| top limit=1 Customers Output is: ABCD 233322 I want only... by puneetkharband1 Path Finder in Splunk Search 06-30-2015 0 6	0	6
How do I find all IPs that generated an HTTP 200 in one index & also generated an event (Snort alert) in another index? I want to take the values of src_ip from this search: index=http status=200 and see which of those source IPs also g... by ErraticIncome93 Explorer in Splunk Search 06-30-2015 1 2	1	2
How to search the cumulative sum for multiple fields and chart them by day? Hello I am trying to get a cumulative sum of multiple fields and then chart them. Problem is, I can use accum on onl... by theouhuios Motivator in Splunk Search 06-30-2015 0 13	0	13
Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap? Hi I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set di... by BITSIntern Path Finder in Splunk Search 06-30-2015 0 4	0	4
not editable fields hi everybody, i'm try to conserve content field value but i don't understand how i can. in my search : index=A OR i... by sfatnass Contributor in Splunk Search 06-30-2015 0 12	0	12
How to count distinct occurrences of one field based on another field? I have a CSV file similar to the one below: timestamp, fullcommand, testname, details time1, c1, test1, details1 time... by raduenea Explorer in Splunk Search 06-30-2015 1 4	1	4
What would cause a search-time CSV lookup to only return results intermittently? OK; this one's odd... what might cause a lookup in a search to only return results some of the time...? Brief descri... by malat_UoM Explorer in Splunk Search 06-30-2015 0 2	0	2
DB Connect 1: Is it possible to get a new field using dbquery that does not exist in an index? Hi I want to know if it's possible to get a new field from dbquery that does not exist in an index: index=A [\|inp... by sfatnass Contributor in Splunk Search 06-30-2015 0 2	0	2
last events in a timeframe Hello, I am working with vulnerability scan results which follow this template: timestamp hostname vulnerability_na... by wsw70 Communicator in Splunk Search 06-29-2015 0 1	0	1
same IP address to the same URL Hi, How do i find the no of sequential hits that came from the same IP address to the same URL by theertpr Explorer in Splunk Search 06-29-2015 0 2	0	2
Create Saved Search For A Files Time Stamp Splunk univerisal forwarder is installed on a linux server. This server is indexing a number of files. I need to cr... by itsquinj New Member in Splunk Search 06-29-2015 0 1	0	1
How do I change the output format of my search results? Hi Using the search below, I'm getting an output in the format below (A,B,C are headers): A B C -------------... by SrinivasaC Path Finder in Splunk Search 06-29-2015 0 4	0	4
How can you format numbers in a ctable? I've got a search like this against a collection of Web logs: sourcetype="access_common" \| ctable uri_path host The... by dpadams Communicator in Splunk Search 06-29-2015 0 1	0	1
Combine results from mutliple searches I am trying to create a master report from logs tracking a webform moving through a process. I have information comi... by cyndiback Path Finder in Splunk Search 06-29-2015 0 1	0	1
Compare result to other results on same day of the week I apologize for my awkward phrasing. I am looking at some data that shows me whenever a certain event happens at any ... by Amohlmann Communicator in Splunk Search 06-29-2015 2 6	2	6
Finding duration of a transaction Hey everyone. First let me start by saying I don't think that the "duration" field generated by a transaction will wo... by msarro Builder in Splunk Search 06-29-2015 0 6	0	6
How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns. I have no idea how to paginate a tables. Splunk builds rows by default: 1 2 3 4 5 6 7 8 I can convert to a very lon... by huy7070 New Member in Splunk Search 06-29-2015 0 3	0	3
Is this feasible to do in Splunk? Hello, I am new to Splunk and I am using it for work. What I have is a raw log of data that tells me dates, when scri... by alanxu Communicator in Splunk Search 06-29-2015 0 4	0	4
How to tell if two rows from different tables each are both an equal match? Hello Splunkitans, If I am given a table of 5000 rows and a second "filter" table of 500 rows, If I were to extract ... by minkyuk Explorer in Splunk Search 06-29-2015 0 1	0	1
Searching through "inputlookups" - syntax error? \|inputlookup ambp1.csv\|fields host,cap\| map maxsearches=10000000 search="\|cpt_x disk $host$ %cap%\|eval UsedPct=(max(u... by minkyuk Explorer in Splunk Search 06-29-2015 0 5	0	5
How do we edit this search to combine our 2 individually working searches? Our security analyst is having an issue with his search...and I cannot for the life of me figure out the issue. Am I... by sm600 Explorer in Splunk Search 06-29-2015 0 8	0	8