Splunk Search

Community Activity

DB Connect database input: How to output some text if query gives no results? Some important queries that run every 5 or 10 minutes that are configured as DB Connect database inputs, give rarely ... by tweaktubbie Communicator in Splunk Search 06-13-2015 0 1	0	1
Internal field `_serial` is gone in v6.2.3; why? I only just found out about the existence of the internal _serial field which should be equal to the row-number less ... by woodcock Esteemed Legend in Splunk Search 06-13-2015 0 3	0	3
search using a variable as condition Hola Splunkers, I want to consolidate two dynamic drilldowns in a table. Each drilldown is passing the same token $t... by snemiro_514 Path Finder in Splunk Search 06-12-2015 0 5	0	5
transaction vs stats commands When should I use the transaction command and when should I use stats? I could use a recap... by cfrln Explorer in Splunk Search 06-12-2015 14 4	14	4
How to edit my timechart search to find the top 5 users who get disconnected from our application on a monthly basis? I would like to view the top 5 users who get disconnected from our application on a monthly basis. I ran the search b... by mishradb New Member in Splunk Search 06-12-2015 0 2	0	2
Joining two logs by two common fields and output the values as a table Hi - I would like to join two logs and get specific result as table. I want to join by two common fields. Been work... by rajadatta New Member in Splunk Search 06-12-2015 0 2	0	2
Counting the Total Number of Days for all Time Hello. I'm trying to create a search that averages a sum of payments and counts the total number of days for all tim... by TJemisonIpacc Explorer in Splunk Search 06-12-2015 0 11	0	11
How to grab a count of logs over a field while excluding specific logs. I have a search query that has a field called "message_text" that I run a stats command, counting the number of log e... by Splunkster45 Communicator in Splunk Search 06-12-2015 0 2	0	2
cidrmatch function not working I have imported two Cisco firewall configurations and I am trying to extract IP addresses for our local machines. Th... by Ronvgraham Engager in Splunk Search 06-12-2015 0 3	0	3
I get results for metadata searches, but why do I get 0 search results running regular searches on my new Splunk 6.2.3 search head? Hello Splunkverse, I've recently set up a new Search Head to test 6.2.3 and it looks awesome. I do have one major i... by ltrand Contributor in Splunk Search 06-12-2015 0 4	0	4
How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access? In my data model, I have a number of calculated fields that are derived from an Eval Expression. As the same expressi... by therockhead Path Finder in Splunk Search 06-12-2015 0 2	0	2
Splunk DB Connect 1: Is it possible to use an eval before dbquery? Hi everybody, I want to know if it's possible to use an eval before [dbquery "select blablabla"] For example: inde... by sfatnass Contributor in Splunk Search 06-12-2015 0 4	0	4
How to block access to the search bar for users in an app? Hello, I would like to create an app where users can only check out the existing dashboards, but cannot run searches... by DavidHourani Super Champion in Splunk Search 06-12-2015 1 8	1	8
List All Lookups in An App? Is there a way to list all of the lookups in a given app (w/o using Sideview utils)? Or, how can I use sideview look... by andrewkenth Communicator in Splunk Search 06-12-2015 2 9	2	9
Search to determine what is missing in Lookup table I have a lookup tabled defined with two columns Host and Source. I am trying to do a search to determine which hosts... by tmurray3 Path Finder in Splunk Search 06-11-2015 3 5	3	5
Rename a column name to yesterday's date in 'dd-mon-yy' format Hi All, I want to rename a column name to yesterday's date written in 'dd-mon-yy' format. Search: sourcetype=shma... by kabiraj Path Finder in Splunk Search 06-11-2015 0 2	0	2
using eval on a field after using the predict function I have the follwoing search that does prediction, and what I want to do is add another column to this graph, in this ... by HattrickNZ Motivator in Splunk Search 06-11-2015 0 4	0	4
Removing duplicate substrings from a multivalue field? Hello everyone, I am creating a custom asset inventory and am combining data from multiple sources. These sources do... by smlrwd Explorer in Splunk Search 06-11-2015 1 7	1	7
Table showing highest usage by host where usage is comma separated Here is the search I'm using: index="_internal" source="*metrics.log" per_host_thruput series NOT splunk \| eval kb ... by jeck11 Path Finder in Splunk Search 06-11-2015 0 3	0	3
How to make transactions that keep groupings in chronological order I am working with time-series data, and I want to groups events based on the same values in three fields: field1, fie... by rjthibod Champion in Splunk Search 06-11-2015 1 7	1	7
hunk search-time field extraction not working Hunk v6.2.2 to hortonworks hadoop v2.2.4.2. My search-time field extraction for client_host is not consistent. It w... by suarezry Builder in Splunk Search 06-11-2015 1 5	1	5
Need Solution to Edit Lookup Files via Web Form We are creating a solution to monitor servers that are behind a network load balancer (NLB). The NLB sends health pro... by mjshoaf New Member in Splunk Search 06-11-2015 0 1	0	1
How to edit my search to determine IP Segment using a lookup? Splunk newbie here.... Looking to determine IP Segment Name using a lookup table. I have a csv file that has three f... by wtaylor149 Explorer in Splunk Search 06-11-2015 0 4	0	4
How to search the latest timestamp each user received their last email? Hi, I need to search when (timestamp) each user has received the last email. Is this possible? I tried to="<*@domain.... by Mufu Engager in Splunk Search 06-11-2015 0 4	0	4
[beginner] Provide simple stat with different string from the field _raw Hi, if I have some logs like this: ID DATE _RAW 1 10/06/2015 text .. ERROR text... 2 10/06/2015 text ..... by chrispappo Explorer in Splunk Search 06-11-2015 0 8	0	8