Splunk Search

Community Activity

[beginner] Provide simple stat with different string from the field _raw Hi, if I have some logs like this: ID DATE _RAW 1 10/06/2015 text .. ERROR text... 2 10/06/2015 text ..... by chrispappo Explorer in Splunk Search 06-11-2015 0 8	0	8
How to join two search events that have a common field without using Join? Hi All, I am looking for options to use to join two searches which has a common field. I have already tried the JOI... by Murali2888_bad New Member in Splunk Search 06-10-2015 0 13	0	13
How to table the count of each instance of fieldA, but also show fieldB as an additional column next to it for reference? Hi all, I am trying to search some logs that have event_name and event_number. I want to produce a table that shows... by stage1v8 Engager in Splunk Search 06-10-2015 0 1	0	1
New to Splunk and its alternatives Hi there, How is it possible to analyze windows log, lotus notes file and sample sap log files in the system. The pu... by xracerx New Member in Splunk Search 06-10-2015 0 2	0	2
Difference between NOT and != Operators index="aws-cloudtrail" errorCode!=success returns the results I expect, i.e., events that have error codes other than... by jli001 Explorer in Splunk Search 06-10-2015 0 2	0	2
Why does my autolookup definition produce unexpected results with different search strings? I am having an odd issue. I created an autolookup definition that seems to be working under certain circumstances. ... by Cuyose Builder in Splunk Search 06-10-2015 0 3	0	3
Using eval to change text color in single value module. I am trying to create a single value visualization where the text changes colors based on its value. The criteria for... by donfarland Explorer in Splunk Search 06-10-2015 0 1	0	1
Why doesn't Splunk believe that date_mday = today_mday? (5 is equal to 5, right?) So, I need to compare counts over multiple days, but I also need to filter the results to only show the count differe... by masonmorales Influencer in Splunk Search 06-10-2015 0 13	0	13
tonumber command returns a null value why does the tonumber command return a null value when the string being evaluated contains a space? example: string ... by rphillips_splk Splunk Employee in Splunk Search 06-10-2015 1 1	1	1
Count based on extracted field Hi I have an event which has something like /getproxy..... size:1 /getproxy..... size:10 /getproxy..... si... by athorat Communicator in Splunk Search 06-10-2015 0 2	0	2
DBConnect - Is there a way to limit first-time data read volume? Hi, We are using DBConnect version 1.1.6 to fetch data from an Oracle Database. We have a huge amount of data presen... by SwatiApte Path Finder in Splunk Search 06-10-2015 0 1	0	1
how to set priority for each server based on their performance Hi all, Currently I can search out the tablet name which has no data sent for more than 24 hours with below command ... by tenyang New Member in Splunk Search 06-10-2015 0 3	0	3
How to find five most common used categories specific to my data Hi guys, So I am trying to pull out the five most commonly used categories, and five most commonly used subcategorie... by splunkman341 Communicator in Splunk Search 06-10-2015 0 9	0	9
How to reassemble indexed multiline events that were not split properly using either join or another search-time option? I have multiline events that were split by the default 256 line limit (MAX_EVENTS). While I have read all on how to f... by drodman29 Path Finder in Splunk Search 06-10-2015 0 3	0	3
why is Streamstats not working ? Hi, I am trying to find cumulative sum of unique IPAddress by IsManuallyInstalled monthly. IsManuallyInstalled has t... by adityaanand Explorer in Splunk Search 06-10-2015 0 7	0	7
How does the searchtxn command work? Hello i have a problem with searchtxn: "Error in 'searchtxn' command: This command must be the first command of a se... by kozhin New Member in Splunk Search 06-10-2015 0 3	0	3
Why is parsing taking so long even with basic searches and filters? I am having an issue with our Splunk Server. Every search you run, no matter all the filters, or if you create it ba... by rdschmidt Explorer in Splunk Search 06-10-2015 4 6	4	6
Splunk DB Connect 1: How to improve my dbquery search to speed up my dashboard load time? Hi, I am looking for some help on the best way to speed up my dashboard load time. Currently, the searches I have e... by crossap Path Finder in Splunk Search 06-10-2015 0 1	0	1
Using Eval for calculated Metrics Hi, I have the following search which returns the number of users logging onto a system for the previous month and g... by DanielFordWA Contributor in Splunk Search 06-10-2015 0 4	0	4
Very odd timestamp - how can I extract? Hi all - I need to "build" a timestamp from an event. The events are fixed format, meaning timestamp variables will a... by himynamesdave Contributor in Splunk Search 06-10-2015 0 5	0	5
How to expand macro arguments in eval subsearch Hi, I'm struggling with using subsearches in eval statements, but got most of it worked out. Now I want to put the s... by Sloefke Path Finder in Splunk Search 06-10-2015 0 8	0	8
how to retrive data from symantec end point protection Hi, Does any one know how to get data from symantec endpoint protection server, so the "Symantec Endpoint Protection... by johnbenayun New Member in Splunk Search 06-09-2015 0 4	0	4
job timeout error - what to do without increasing the receiveTimeout in distsearch.conf 06-08-2015 15:41:47.050 ERROR HttpClientRequest - HTTP client error: Read Timeout (while accessing https://ip.1:p... by splunk_zen Builder in Splunk Search 06-09-2015 0 1	0	1
The lookup table 'msdhcp_signature_lookup' does not exist. It is referenced by configuration 'DhcpSrvLog'. Getting this error when searching. The lookup table 'msdhcp_signature_lookup' does not exist. It is referenced by co... by daryl_fallin Engager in Splunk Search 06-09-2015 1 3	1	3
ip address in non usual format Hi all. I have a mcafee logging in a SQL database with a field: sourceip=739840322 How i can traslate this Ip to a ... by changux Builder in Splunk Search 06-09-2015 0 7	0	7

Get Updates on the Splunk Community!

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Unlocking Data-In-Place Search Across Splunk and Snowflake Enterprise data is increasingly distributed across ...

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust ...

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...

Splunk Search

[beginner] Provide simple stat with different string from the field _raw

How to join two search events that have a common field without using Join?

How to table the count of each instance of fieldA, but also show fieldB as an additional column next to it for reference?

New to Splunk and its alternatives

Difference between NOT and != Operators

Why does my autolookup definition produce unexpected results with different search strings?

Using eval to change text color in single value module.

Why doesn't Splunk believe that date_mday = today_mday? (5 is equal to 5, right?)

tonumber command returns a null value

Count based on extracted field

DBConnect - Is there a way to limit first-time data read volume?

how to set priority for each server based on their performance

How to find five most common used categories specific to my data

How to reassemble indexed multiline events that were not split properly using either join or another search-time option?

why is Streamstats not working ?

How does the searchtxn command work?

Why is parsing taking so long even with basic searches and filters?

Splunk DB Connect 1: How to improve my dbquery search to speed up my dashboard load time?

Using Eval for calculated Metrics

Very odd timestamp - how can I extract?

How to expand macro arguments in eval subsearch

how to retrive data from symantec end point protection

job timeout error - what to do without increasing the receiveTimeout in distsearch.conf

The lookup table 'msdhcp_signature_lookup' does not exist. It is referenced by configuration 'DhcpSrvLog'.

ip address in non usual format

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation