Splunk Search

Community Activity

Need Solution to Edit Lookup Files via Web Form We are creating a solution to monitor servers that are behind a network load balancer (NLB). The NLB sends health pro... by mjshoaf New Member in Splunk Search 06-11-2015 0 1	0	1
How to edit my search to determine IP Segment using a lookup? Splunk newbie here.... Looking to determine IP Segment Name using a lookup table. I have a csv file that has three f... by wtaylor149 Explorer in Splunk Search 06-11-2015 0 4	0	4
How to search the latest timestamp each user received their last email? Hi, I need to search when (timestamp) each user has received the last email. Is this possible? I tried to="<*@domain.... by Mufu Engager in Splunk Search 06-11-2015 0 4	0	4
[beginner] Provide simple stat with different string from the field _raw Hi, if I have some logs like this: ID DATE _RAW 1 10/06/2015 text .. ERROR text... 2 10/06/2015 text ..... by chrispappo Explorer in Splunk Search 06-11-2015 0 8	0	8
How to join two search events that have a common field without using Join? Hi All, I am looking for options to use to join two searches which has a common field. I have already tried the JOI... by Murali2888_bad New Member in Splunk Search 06-10-2015 0 13	0	13
How to table the count of each instance of fieldA, but also show fieldB as an additional column next to it for reference? Hi all, I am trying to search some logs that have event_name and event_number. I want to produce a table that shows... by stage1v8 Engager in Splunk Search 06-10-2015 0 1	0	1
New to Splunk and its alternatives Hi there, How is it possible to analyze windows log, lotus notes file and sample sap log files in the system. The pu... by xracerx New Member in Splunk Search 06-10-2015 0 2	0	2
Difference between NOT and != Operators index="aws-cloudtrail" errorCode!=success returns the results I expect, i.e., events that have error codes other than... by jli001 Explorer in Splunk Search 06-10-2015 0 2	0	2
Why does my autolookup definition produce unexpected results with different search strings? I am having an odd issue. I created an autolookup definition that seems to be working under certain circumstances. ... by Cuyose Builder in Splunk Search 06-10-2015 0 3	0	3
Using eval to change text color in single value module. I am trying to create a single value visualization where the text changes colors based on its value. The criteria for... by donfarland Explorer in Splunk Search 06-10-2015 0 1	0	1
Why doesn't Splunk believe that date_mday = today_mday? (5 is equal to 5, right?) So, I need to compare counts over multiple days, but I also need to filter the results to only show the count differe... by masonmorales Influencer in Splunk Search 06-10-2015 0 13	0	13
tonumber command returns a null value why does the tonumber command return a null value when the string being evaluated contains a space? example: string ... by rphillips_splk Splunk Employee in Splunk Search 06-10-2015 1 1	1	1
Count based on extracted field Hi I have an event which has something like /getproxy..... size:1 /getproxy..... size:10 /getproxy..... si... by athorat Communicator in Splunk Search 06-10-2015 0 2	0	2
DBConnect - Is there a way to limit first-time data read volume? Hi, We are using DBConnect version 1.1.6 to fetch data from an Oracle Database. We have a huge amount of data presen... by SwatiApte Path Finder in Splunk Search 06-10-2015 0 1	0	1
how to set priority for each server based on their performance Hi all, Currently I can search out the tablet name which has no data sent for more than 24 hours with below command ... by tenyang New Member in Splunk Search 06-10-2015 0 3	0	3
How to find five most common used categories specific to my data Hi guys, So I am trying to pull out the five most commonly used categories, and five most commonly used subcategorie... by splunkman341 Communicator in Splunk Search 06-10-2015 0 9	0	9
How to reassemble indexed multiline events that were not split properly using either join or another search-time option? I have multiline events that were split by the default 256 line limit (MAX_EVENTS). While I have read all on how to f... by drodman29 Path Finder in Splunk Search 06-10-2015 0 3	0	3
why is Streamstats not working ? Hi, I am trying to find cumulative sum of unique IPAddress by IsManuallyInstalled monthly. IsManuallyInstalled has t... by adityaanand Explorer in Splunk Search 06-10-2015 0 7	0	7
How does the searchtxn command work? Hello i have a problem with searchtxn: "Error in 'searchtxn' command: This command must be the first command of a se... by kozhin New Member in Splunk Search 06-10-2015 0 3	0	3
Why is parsing taking so long even with basic searches and filters? I am having an issue with our Splunk Server. Every search you run, no matter all the filters, or if you create it ba... by rdschmidt Explorer in Splunk Search 06-10-2015 4 6	4	6
Splunk DB Connect 1: How to improve my dbquery search to speed up my dashboard load time? Hi, I am looking for some help on the best way to speed up my dashboard load time. Currently, the searches I have e... by crossap Path Finder in Splunk Search 06-10-2015 0 1	0	1
Using Eval for calculated Metrics Hi, I have the following search which returns the number of users logging onto a system for the previous month and g... by DanielFordWA Contributor in Splunk Search 06-10-2015 0 4	0	4
Very odd timestamp - how can I extract? Hi all - I need to "build" a timestamp from an event. The events are fixed format, meaning timestamp variables will a... by himynamesdave Contributor in Splunk Search 06-10-2015 0 5	0	5
How to expand macro arguments in eval subsearch Hi, I'm struggling with using subsearches in eval statements, but got most of it worked out. Now I want to put the s... by Sloefke Path Finder in Splunk Search 06-10-2015 0 8	0	8
how to retrive data from symantec end point protection Hi, Does any one know how to get data from symantec endpoint protection server, so the "Symantec Endpoint Protection... by johnbenayun New Member in Splunk Search 06-09-2015 0 4	0	4