Splunk Search

Community Activity

Nested "Where" Commands - Error: The expression is malformed I'm trying to filter the results of a search based on the results of a (pretty complex) subsearch using the where com... by rescobar713 Path Finder in Splunk Search 06-26-2015 0 4	0	4
How do I edit my if else search for comparing two values? I have a field Name and a field ID. So a person named Adam has an ID 1. The next time Adam is renamed Rob, but ID rem... by sushmitha_mj Communicator in Splunk Search 06-26-2015 0 4	0	4
How to display a chart with values and also a timechart below that? I'm trying to show a chart and need to show the actual values. At the same time I would like to display a linear tim... by chadman Path Finder in Splunk Search 06-26-2015 0 4	0	4
How to write a conditional timechart search that will not count more than 1 event per day? I'd like an efficient search that will return either "Yes" or "No" for a timechart per day. I would imagine a limitin... by splunkrsherman New Member in Splunk Search 06-26-2015 0 4	0	4
How handle time-based join with streamstats I have 2 sets of events, 1 for registration events, and 1 for host state events. There is a common field between the... by kwalking New Member in Splunk Search 06-26-2015 0 2	0	2
How to apply a regex filter to my pivot? http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Pivot#Filter_element According to this, there is a... by szabados Communicator in Splunk Search 06-26-2015 0 3	0	3
Why are Interesting Fields not yielding complete values in the search result? Hi, When a blank space is introduced in values, the search results are not yielding complete values. Please see deta... by muguniya Explorer in Splunk Search 06-26-2015 0 1	0	1
How to combine two fields, but add quotations marks around one of the fields prior to combining? Hello folks, I am trying to combine two fields by string; however, I need to put quotation marks around one of the f... by minkyuk Explorer in Splunk Search 06-26-2015 0 3	0	3
How do I edit the regex in my search to extract a part of a string? I have a log: BL: \| LL: INFO \| TS: 1234 \| AR: RxC_16.00.37.01 \| STORE: :BROADCAST \| USER: BROADCAST \| HOST: BROAD... by kumina New Member in Splunk Search 06-26-2015 0 7	0	7
How to split a string into multiple fields using whitespace as delimiter Hi, I have a field called "details" with the following value: details GAP 16 GAP PLI 31 ... by cedmarjls32 New Member in Splunk Search 06-26-2015 0 8	0	8
Why is my rex search not extracting the field from my event? Dear all, I want to extract a field from the event, and name it retail, and then use this new field to make a calcul... by hqw Path Finder in Splunk Search 06-26-2015 0 4	0	4
How to make the search dynamic - continuation of "How to use rex and sed to insert '-' and ':' in the result?" I have different environments. In each environment logs are located in different path. e.g.: C:\Program Files\Splunk.... by nilotpaldutta Explorer in Splunk Search 06-26-2015 0 3	0	3
How to parse and extract unstructured .log file data in Splunk? 04/07/15 23:55:01 Device: a b c d e f g h i j k 1ppd 0.00... by minkyuk Explorer in Splunk Search 06-26-2015 1 3	1	3
When creating a statistical table using the table command, is there a way to disable sorting of data on click of table column headers? When we create a statistical table using table command , is there a way to disable sorting of data on click of table ... by nawneel Communicator in Splunk Search 06-26-2015 0 4	0	4
How to search a lookup table to find any IP addresses that match the IPs in my firewall events? I have a lookup table called - c2cisp.csv. the definition is called c2cisp. The table has a field name ip. It contain... by meadowh Explorer in Splunk Search 06-26-2015 0 4	0	4
How do I get results from Splunk searchmanager JavaScript into Google JavaScript API to draw charts? How to get data results from a searchmanager javascript into google jsapi to draw charts? All My Searches and PostPr... by pedromvieira Communicator in Splunk Search 06-25-2015 0 5	0	5
Customize a CSS file to modify the color palette of charts Our team is currently using Splunk within core dashboards within the Splunk software and through embedded reports on ... by cmcclure_splunk Splunk Employee in Splunk Search 06-25-2015 1 1	1	1
How to search two Indexes, but only use the dedup command for fields in one index? I would like to search two different SourceTypes where one SourceType pipes a dedup command on fields that only that ... by boingodevin Engager in Splunk Search 06-25-2015 0 1	0	1
How do I write a search to get a table of metrics to show the count of different Markets by Site? Hi, I have a requirement where I want to display a metrics table. Vertically, I want to show different sites like (... by rameshlpatel Communicator in Splunk Search 06-25-2015 0 4	0	4
Find hosts matching naming criteria in Splunk? We use this search quite a bit, and love it. In this example it provides a list of all hosts (servers) reporting to ... by sm600 Explorer in Splunk Search 06-25-2015 0 4	0	4
Why does my search produce error "Search process did not exit cleanly, exit_code=254" in my search head clustering environment? What could cause this error? I have a distributed search environment with a Search Head having multiple indexers, and... by rbal_splunk Splunk Employee in Splunk Search 06-25-2015 1 1	1	1
How to combine two fields into one field? How do I combine two fields into one field? I've tried the following (http://answers.splunk.com/answers/8334/help-wit... by splunknewby Path Finder in Splunk Search 06-25-2015 0 5	0	5
How to search and extract a string of text as a new field? Hi, I want to search for a particular text, for example: "Error.*CP:Link Change: Received Link UP for already activ... by shrirangphadke Path Finder in Splunk Search 06-25-2015 0 4	0	4
How do I find out why _indextime is greater than _time for a lot of my events? Hi, I have a lot of events where "indextime" is > than "eventime". It means something went wrong and it might be one... by abhayneilam Contributor in Splunk Search 06-25-2015 1 4	1	4
Why would a search from a datamodel take longer than same search against raw ? I performed this search: \| datamodel Authentication Autherntication search \| search Authentication.src=xxx.yyy.com (... by jlyon_splunk Splunk Employee in Splunk Search 06-25-2015 0 1	0	1

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...

Build and Launch AI Agents from Your Splunk Workflows

Replay Tech Talk Build and Launch AI Agents from Your Splunk Workflows We’ve all been there: juggling ...

index This | What kind of room has no doors?

IndexEducation Cover Art Banner Cisco.png August 2026 Edition Hayyy Splunk Education Enthusiasts and the ...

Splunk Search

Nested "Where" Commands - Error: The expression is malformed

How do I edit my if else search for comparing two values?

How to display a chart with values and also a timechart below that?

How to write a conditional timechart search that will not count more than 1 event per day?

How handle time-based join with streamstats

How to apply a regex filter to my pivot?

Why are Interesting Fields not yielding complete values in the search result?

How to combine two fields, but add quotations marks around one of the fields prior to combining?

How do I edit the regex in my search to extract a part of a string?

How to split a string into multiple fields using whitespace as delimiter

Why is my rex search not extracting the field from my event?

How to make the search dynamic - continuation of "How to use rex and sed to insert '-' and ':' in the result?"

How to parse and extract unstructured .log file data in Splunk?

When creating a statistical table using the table command, is there a way to disable sorting of data on click of table column headers?

How to search a lookup table to find any IP addresses that match the IPs in my firewall events?

How do I get results from Splunk searchmanager JavaScript into Google JavaScript API to draw charts?

Customize a CSS file to modify the color palette of charts

How to search two Indexes, but only use the dedup command for fields in one index?

How do I write a search to get a table of metrics to show the count of different Markets by Site?

Find hosts matching naming criteria in Splunk?

Why does my search produce error "Search process did not exit cleanly, exit_code=254" in my search head clustering environment?

How to combine two fields into one field?

How to search and extract a string of text as a new field?

How do I find out why _indextime is greater than _time for a lot of my events?

Why would a search from a datamodel take longer than same search against raw ?

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Build and Launch AI Agents from Your Splunk Workflows

index This | What kind of room has no doors?

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation