Splunk Search

Community Activity

If I have 3 months of data, how do I write a search to return repeating values that appear in all 3 months? Hi, I have data like below: Day month Signature 10 oct trojan 11 oct abc 12 oct efg 10 nov abc 11 nov efg 11... by thambisetty SplunkTrust in Splunk Search 06-28-2015 0 1	0	1
How to apply the time modifiers in the subsearch to limit the time range of results returned in the parent search? Hi! I have log statements containing error messages. This is lacking context information (ie user id). Using the eve... by tenorway Path Finder in Splunk Search 06-28-2015 0 6	0	6
Is it possible to run an eval search using a wildcard to pull the date stamp from the source file name? Hi All, I am new to splunk. Just using this wonderful application for my day to day activity. Below is the search w... by indianhans Engager in Splunk Search 06-28-2015 0 5	0	5
How to I extract survey results from an event where question/answer pairs are delimited by "," and key-values are delimited by "\|"? Dear all, I want to extract results from a field, but I'm facing some problems. Could you pls kindly guide me on wha... by hqw Path Finder in Splunk Search 06-28-2015 0 2	0	2
Splunk DB Connect v1 connects to the database successfully but returns no results when I try any query I have installed Splunk DB Connect v1 App and MySQL driver and configured them with my database details. Looks like ... by logmar5 Explorer in Splunk Search 06-28-2015 0 2	0	2
Help with REGEX for data filter In my transforms.conf I currently have [filter-marimba] REGEX=^(?!\[[^\]]+\]\s+-\s+warning.*) DEST_KEY = queue FORMA... by nce054 Path Finder in Splunk Search 06-28-2015 0 14	0	14
How do I find common values from the results of two searches? Hi all, I have a use case. I have a list of the top viewed products for the last 3 months individually. Now, I want... by avis1119 New Member in Splunk Search 06-27-2015 0 1	0	1
When showing data through table, can't sort in descending order because null > any numerical value So I am displaying a ton of events with a very long table with tons of fields (input pkt, output pkt, input octet, ou... by kkas Path Finder in Splunk Search 06-27-2015 0 5	0	5
How to edit my timechart search to show average CPU utilization in 1 minute increments (on chart as well)? I'm trying to use the following search... index=os sourcetype=cpu host=sp3ctxps01 \| multikv fields pctIdle \| eval ... by timmy13 Communicator in Splunk Search 06-27-2015 0 1	0	1
How to accelerate a report and use fillnull or usenull with stats? Splunk 6.2.2 ... I want to build an accelerated daily report. The search I want to power this daily report is... ind... by yacht_rock Explorer in Splunk Search 06-27-2015 0 2	0	2
display sum value in pie chart I have used in the past count value in the pie chart. Now I need to display sum value in the chart. How can I do this... by ashabc Contributor in Splunk Search 06-27-2015 0 4	0	4
How to put the result of an additional search into an alert email triggered by the base search? Hi Is there any way to put the search result of additional search into the alert mail triggered by the base search? ... by SY715 Explorer in Splunk Search 06-27-2015 0 2	0	2
Why does a join query not return results unless I give specific field values? Hello, I am noticing the following strange behavior with a join. It is actually not returning results when I use a ... by jamesvz84 Communicator in Splunk Search 06-27-2015 0 3	0	3
Google Analytics data into Splunk I could swear I heard at .conf2013 that there was a Google Analytics app/add-on, but I sure can't seem to find one no... by redc Builder in Splunk Search 06-27-2015 0 1	0	1
How to search call data records to find parallel concurrent calls from the same originating telephone number? I have an index of telephony call data records where each record has an event_start_timestamp, mapped to the event ti... by garryclarke Path Finder in Splunk Search 06-26-2015 1 1	1	1
Why does "search host!=ComputerName" return all results? I'm looking for Splunk Universal Forwarders that have a different name registered other than the actual host name. T... by DamageSplunk Explorer in Splunk Search 06-26-2015 0 1	0	1
How to add "point-in-time" annotations to a chart? I'd like to "annotate" a graph which shows performance over time with what points the releases have been at. I see t... by NaraSplunk Explorer in Splunk Search 06-26-2015 1 3	1	3
How do I write a search that outputs a table where each Computer_Name has 3+ variables and their counts So I am trying to output audit failures in a readable manner while displaying relevant data. I am trying to output th... by kkas Path Finder in Splunk Search 06-26-2015 0 2	0	2
Nested "Where" Commands - Error: The expression is malformed I'm trying to filter the results of a search based on the results of a (pretty complex) subsearch using the where com... by rescobar713 Path Finder in Splunk Search 06-26-2015 0 4	0	4
How do I edit my if else search for comparing two values? I have a field Name and a field ID. So a person named Adam has an ID 1. The next time Adam is renamed Rob, but ID rem... by sushmitha_mj Communicator in Splunk Search 06-26-2015 0 4	0	4
How to display a chart with values and also a timechart below that? I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear tim... by chadman Path Finder in Splunk Search 06-26-2015 0 4	0	4
How to write a conditional timechart search that will not count more than 1 event per day? I'd like an efficient search that will return either "Yes" or "No" for a timechart per day. I would imagine a limitin... by splunkrsherman New Member in Splunk Search 06-26-2015 0 4	0	4
How handle time-based join with streamstats I have 2 sets of events, 1 for registration events, and 1 for host state events. There is a common field between the... by kwalking New Member in Splunk Search 06-26-2015 0 2	0	2
How to apply a regex filter to my pivot? http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Pivot#Filter_element According to this, there is a... by szabados Communicator in Splunk Search 06-26-2015 0 3	0	3
Why are Interesting Fields not yielding complete values in the search result? Hi, When a blank space is introduced in values, the search results are not yielding complete values. Please see deta... by muguniya Explorer in Splunk Search 06-26-2015 0 1	0	1

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

If I have 3 months of data, how do I write a search to return repeating values that appear in all 3 months?

How to apply the time modifiers in the subsearch to limit the time range of results returned in the parent search?

Is it possible to run an eval search using a wildcard to pull the date stamp from the source file name?

How to I extract survey results from an event where question/answer pairs are delimited by "," and key-values are delimited by "|"?

Splunk DB Connect v1 connects to the database successfully but returns no results when I try any query

Help with REGEX for data filter

How do I find common values from the results of two searches?

When showing data through table, can't sort in descending order because null > any numerical value

How to edit my timechart search to show average CPU utilization in 1 minute increments (on chart as well)?

How to accelerate a report and use fillnull or usenull with stats?

display sum value in pie chart

How to put the result of an additional search into an alert email triggered by the base search?

Why does a join query not return results unless I give specific field values?

Google Analytics data into Splunk

How to search call data records to find parallel concurrent calls from the same originating telephone number?

Why does "search host!=ComputerName" return all results?

How to add "point-in-time" annotations to a chart?

How do I write a search that outputs a table where each Computer_Name has 3+ variables and their counts

Nested "Where" Commands - Error: The expression is malformed

How do I edit my if else search for comparing two values?

How to display a chart with values and also a timechart below that?

How to write a conditional timechart search that will not count more than 1 event per day?

How handle time-based join with streamstats

How to apply a regex filter to my pivot?

Why are Interesting Fields not yielding complete values in the search result?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation