Splunk Search

Community Activity

How to combine two fields, but add quotations marks around one of the fields prior to combining? Hello folks, I am trying to combine two fields by string; however, I need to put quotation marks around one of the f... by minkyuk Explorer in Splunk Search 06-26-2015 0 3	0	3
How do I edit the regex in my search to extract a part of a string? I have a log: BL: \| LL: INFO \| TS: 1234 \| AR: RxC_16.00.37.01 \| STORE: :BROADCAST \| USER: BROADCAST \| HOST: BROAD... by kumina New Member in Splunk Search 06-26-2015 0 7	0	7
How to split a string into multiple fields using whitespace as delimiter Hi, I have a field called "details" with the following value: details GAP 16 GAP PLI 31 ... by cedmarjls32 New Member in Splunk Search 06-26-2015 0 8	0	8
Why is my rex search not extracting the field from my event? Dear all, I want to extract a field from the event, and name it retail, and then use this new field to make a calcul... by hqw Path Finder in Splunk Search 06-26-2015 0 4	0	4
How to make the search dynamic - continuation of "How to use rex and sed to insert '-' and ':' in the result?" I have different environments. In each environment logs are located in different path. e.g.: C:\Program Files\Splunk.... by nilotpaldutta Explorer in Splunk Search 06-26-2015 0 3	0	3
How to parse and extract unstructured .log file data in Splunk? 04/07/15 23:55:01 Device: a b c d e f g h i j k 1ppd 0.00... by minkyuk Explorer in Splunk Search 06-26-2015 1 3	1	3
When creating a statistical table using the table command, is there a way to disable sorting of data on click of table column headers? When we create a statistical table using table command , is there a way to disable sorting of data on click of table ... by nawneel Communicator in Splunk Search 06-26-2015 0 4	0	4
How to search a lookup table to find any IP addresses that match the IPs in my firewall events? I have a lookup table called - c2cisp.csv. the definition is called c2cisp. The table has a field name ip. It contain... by meadowh Explorer in Splunk Search 06-26-2015 0 4	0	4
How do I get results from Splunk searchmanager JavaScript into Google JavaScript API to draw charts? How to get data results from a searchmanager javascript into google jsapi to draw charts? All My Searches and PostPr... by pedromvieira Communicator in Splunk Search 06-25-2015 0 5	0	5
Customize a CSS file to modify the color palette of charts Our team is currently using Splunk within core dashboards within the Splunk software and through embedded reports on ... by cmcclure_splunk Splunk Employee in Splunk Search 06-25-2015 1 1	1	1
How to search two Indexes, but only use the dedup command for fields in one index? I would like to search two different SourceTypes where one SourceType pipes a dedup command on fields that only that ... by boingodevin Engager in Splunk Search 06-25-2015 0 1	0	1
How do I write a search to get a table of metrics to show the count of different Markets by Site? Hi, I have a requirement where I want to display a metrics table. Vertically, I want to show different sites like (... by rameshlpatel Communicator in Splunk Search 06-25-2015 0 4	0	4
Find hosts matching naming criteria in Splunk? We use this search quite a bit, and love it. In this example it provides a list of all hosts (servers) reporting to ... by sm600 Explorer in Splunk Search 06-25-2015 0 4	0	4
Why does my search produce error "Search process did not exit cleanly, exit_code=254" in my search head clustering environment? What could cause this error? I have a distributed search environment with a Search Head having multiple indexers, and... by rbal_splunk Splunk Employee in Splunk Search 06-25-2015 1 1	1	1
How to combine two fields into one field? How do I combine two fields into one field? I've tried the following (http://answers.splunk.com/answers/8334/help-wit... by splunknewby Path Finder in Splunk Search 06-25-2015 0 5	0	5
How to search and extract a string of text as a new field? Hi, I want to search for a particular text, for example: "Error.*CP:Link Change: Received Link UP for already activ... by shrirangphadke Path Finder in Splunk Search 06-25-2015 0 4	0	4
How do I find out why _indextime is greater than _time for a lot of my events? Hi, I have a lot of events where "indextime" is > than "eventime". It means something went wrong and it might be one... by abhayneilam Contributor in Splunk Search 06-25-2015 1 4	1	4
Why would a search from a datamodel take longer than same search against raw ? I performed this search: \| datamodel Authentication Autherntication search \| search Authentication.src=xxx.yyy.com (... by jlyon_splunk Splunk Employee in Splunk Search 06-25-2015 0 1	0	1
Dual Histogram I am trying to create a histogram with two data sets that share the x-axis. I can do it for each data set but can not... by motobeats Path Finder in Splunk Search 06-25-2015 0 3	0	3
How to get two form inputs to run separate searches, each with their own submit button in a Simple XML dashboard? I'm trying to get 2 separate searches to work on a simple xml dashboard. I would like to have 2 input boxes and 2 se... by chadman Path Finder in Splunk Search 06-25-2015 0 2	0	2
Return adjacent entries until a specific string is found? This is a rather complex question, at least for me, so please bear with me. In one of our custom logs, when an error... by awendler Explorer in Splunk Search 06-25-2015 0 2	0	2
How to pass the date and time result from an inner search to the outer search? Hi, My inner search returns the date and time (for eg 06-22-2015-23). I want to use this time in my outer search as... by Karan_Jindal New Member in Splunk Search 06-25-2015 0 5	0	5
How to change the time range for a subsearch? Hi, I am creating a search that will take date range from datetime field that I have created above. However, inside... by rameshlpatel Communicator in Splunk Search 06-25-2015 0 1	0	1
How to find the location of a cell in a row How can I find the location of a cell in row? I'm using javascript like: var CustomRangeRenderer = TableView.BaseCe... by Marcovd Explorer in Splunk Search 06-25-2015 0 2	0	2
Alert to search greater than 30 days Hi there, I'm looking to create an alert that searches for entries 30 days greater than today. So basically, if I r... by prains New Member in Splunk Search 06-24-2015 0 3	0	3

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

How to combine two fields, but add quotations marks around one of the fields prior to combining?

How do I edit the regex in my search to extract a part of a string?

How to split a string into multiple fields using whitespace as delimiter

Why is my rex search not extracting the field from my event?

How to make the search dynamic - continuation of "How to use rex and sed to insert '-' and ':' in the result?"

How to parse and extract unstructured .log file data in Splunk?

When creating a statistical table using the table command, is there a way to disable sorting of data on click of table column headers?

How to search a lookup table to find any IP addresses that match the IPs in my firewall events?

How do I get results from Splunk searchmanager JavaScript into Google JavaScript API to draw charts?

Customize a CSS file to modify the color palette of charts

How to search two Indexes, but only use the dedup command for fields in one index?

How do I write a search to get a table of metrics to show the count of different Markets by Site?

Find hosts matching naming criteria in Splunk?

Why does my search produce error "Search process did not exit cleanly, exit_code=254" in my search head clustering environment?

How to combine two fields into one field?

How to search and extract a string of text as a new field?

How do I find out why _indextime is greater than _time for a lot of my events?

Why would a search from a datamodel take longer than same search against raw ?

Dual Histogram

How to get two form inputs to run separate searches, each with their own submit button in a Simple XML dashboard?

Return adjacent entries until a specific string is found?

How to pass the date and time result from an inner search to the outer search?

How to change the time range for a subsearch?

How to find the location of a cell in a row

Alert to search greater than 30 days

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation