Splunk Search

Community Activity

How to edit my timechart search to show distinct users per day and new users across all time per product? I am new to splunk. I am trying to create a timechart based report which shows me Distinct "Users" per day as well as... by ahsanshah New Member in Splunk Search 06-14-2015 0 6	0	6
How to configure props.conf and transforms.conf for index-time field extraction from a CSV file? Hi, We are trying the index-time field extraction for a specific case, and have no idea about the correct configurat... by egsub Explorer in Splunk Search 06-14-2015 0 3	0	3
How to dedup search to limit to 1 event per host per day I'm using the winhostmon collection and I want to chart disk space usage over time. I have the collection set up to ... by DamageSplunk Explorer in Splunk Search 06-13-2015 0 1	0	1
Why is the memory usage high on the indexer when running a simple stats count search? The search index=main \| stats count is taking a lot of memory on the indexer when there are lots of events. Isn't the... by marcusnilssonmr Path Finder in Splunk Search 06-13-2015 1 1	1	1
DB Connect database input: How to output some text if query gives no results? Some important queries that run every 5 or 10 minutes that are configured as DB Connect database inputs, give rarely ... by tweaktubbie Communicator in Splunk Search 06-13-2015 0 1	0	1
Internal field `_serial` is gone in v6.2.3; why? I only just found out about the existence of the internal _serial field which should be equal to the row-number less ... by woodcock Esteemed Legend in Splunk Search 06-13-2015 0 3	0	3
search using a variable as condition Hola Splunkers, I want to consolidate two dynamic drilldowns in a table. Each drilldown is passing the same token $t... by snemiro_514 Path Finder in Splunk Search 06-12-2015 0 5	0	5
transaction vs stats commands When should I use the transaction command and when should I use stats? I could use a recap... by cfrln Explorer in Splunk Search 06-12-2015 14 4	14	4
How to edit my timechart search to find the top 5 users who get disconnected from our application on a monthly basis? I would like to view the top 5 users who get disconnected from our application on a monthly basis. I ran the search b... by mishradb New Member in Splunk Search 06-12-2015 0 2	0	2
Joining two logs by two common fields and output the values as a table Hi - I would like to join two logs and get specific result as table. I want to join by two common fields. Been work... by rajadatta New Member in Splunk Search 06-12-2015 0 2	0	2
Counting the Total Number of Days for all Time Hello. I'm trying to create a search that averages a sum of payments and counts the total number of days for all tim... by TJemisonIpacc Explorer in Splunk Search 06-12-2015 0 11	0	11
How to grab a count of logs over a field while excluding specific logs. I have a search query that has a field called "message_text" that I run a stats command, counting the number of log e... by Splunkster45 Communicator in Splunk Search 06-12-2015 0 2	0	2
cidrmatch function not working I have imported two Cisco firewall configurations and I am trying to extract IP addresses for our local machines. Th... by Ronvgraham Engager in Splunk Search 06-12-2015 0 3	0	3
I get results for metadata searches, but why do I get 0 search results running regular searches on my new Splunk 6.2.3 search head? Hello Splunkverse, I've recently set up a new Search Head to test 6.2.3 and it looks awesome. I do have one major i... by ltrand Contributor in Splunk Search 06-12-2015 0 4	0	4
How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access? In my data model, I have a number of calculated fields that are derived from an Eval Expression. As the same expressi... by therockhead Path Finder in Splunk Search 06-12-2015 0 2	0	2
Splunk DB Connect 1: Is it possible to use an eval before dbquery? Hi everybody, I want to know if it's possible to use an eval before [dbquery "select blablabla"] For example: inde... by sfatnass Contributor in Splunk Search 06-12-2015 0 4	0	4
How to block access to the search bar for users in an app? Hello, I would like to create an app where users can only check out the existing dashboards, but cannot run searches... by DavidHourani Super Champion in Splunk Search 06-12-2015 1 8	1	8
List All Lookups in An App? Is there a way to list all of the lookups in a given app (w/o using Sideview utils)? Or, how can I use sideview look... by andrewkenth Communicator in Splunk Search 06-12-2015 2 9	2	9
Search to determine what is missing in Lookup table I have a lookup tabled defined with two columns Host and Source. I am trying to do a search to determine which hosts... by tmurray3 Path Finder in Splunk Search 06-11-2015 3 5	3	5
Rename a column name to yesterday's date in 'dd-mon-yy' format Hi All, I want to rename a column name to yesterday's date written in 'dd-mon-yy' format. Search: sourcetype=shma... by kabiraj Path Finder in Splunk Search 06-11-2015 0 2	0	2
using eval on a field after using the predict function I have the follwoing search that does prediction, and what I want to do is add another column to this graph, in this ... by HattrickNZ Motivator in Splunk Search 06-11-2015 0 4	0	4
Removing duplicate substrings from a multivalue field? Hello everyone, I am creating a custom asset inventory and am combining data from multiple sources. These sources do... by smlrwd Explorer in Splunk Search 06-11-2015 1 7	1	7
Table showing highest usage by host where usage is comma separated Here is the search I'm using: index="_internal" source="*metrics.log" per_host_thruput series NOT splunk \| eval kb ... by jeck11 Path Finder in Splunk Search 06-11-2015 0 3	0	3
How to make transactions that keep groupings in chronological order I am working with time-series data, and I want to groups events based on the same values in three fields: field1, fie... by rjthibod Champion in Splunk Search 06-11-2015 1 7	1	7
hunk search-time field extraction not working Hunk v6.2.2 to hortonworks hadoop v2.2.4.2. My search-time field extraction for client_host is not consistent. It w... by suarezry Builder in Splunk Search 06-11-2015 1 5	1	5