Splunk Search

Community Activity

how to configure the section of a user on splunk ? hello I would like to configure splunk like so: When a user is inactive for 15 minutes, the session shoulds Origin Lo... by fdi01 Motivator in Splunk Search 05-30-2015 0 4	0	4
extract field value Hi, we have csv file in below format. PROJECT_NAME USER_NAME STATUS WEB_xxxx David PA... by iamniks Explorer in Splunk Search 05-29-2015 0 2	0	2
Alert when host sends different data in event Every day, a script runs on my Windows boxs that sends an event to Splunk. I'm looking for a search that will return ... by rtadams89 Contributor in Splunk Search 05-29-2015 0 4	0	4
timechart span starting at specified point I want to run a timechart 'overnight'... e.g. getting the minimum values of a field between midday and midday... 12-1... by vaijpc Communicator in Splunk Search 05-29-2015 0 1	0	1
Error Logs on Splunkd (Search Head) Hi, I'm having this error logs on my search heard splunkd. 01-15-2011 00:22:06.346 WARN NetUtils - Bad select for ... by mldaplin Engager in Splunk Search 05-29-2015 2 1	2	1
Index time field extraction from another field Hi, I have two fields. Let's say they are field1 and field2. I extract field2 from field1. I also remove some part o... by rahiparikh Explorer in Splunk Search 05-29-2015 0 1	0	1
How to join data from three sources without using join? I'm slowly digesting the posts that describe how to use stats to retrieve aligned data from multiple sources but I'm ... by kmcarrol Path Finder in Splunk Search 05-29-2015 0 6	0	6
field transformation not cpaturing anything I am trying the field tranformation feature. using the "Manager » Fields » Field transformations" UI I have defined t... by aviadr1 Explorer in Splunk Search 05-29-2015 0 1	0	1
How to extract key/value parameters and issue lookup? I have a log containing some commands like so: SWFCMD_DNLK_LOG: WHICHLOG = CMD_LOG_IMDCMD, TIMERANGESTRT = 0, TIMER... by vhwang New Member in Splunk Search 05-29-2015 0 1	0	1
combine two transaction results based on one value they share I have a transaction that includes a MAC address which doesn't change and an IP address which changes during the tran... by whistj Explorer in Splunk Search 05-29-2015 0 1	0	1
Dates cluttered in X-axis Hi, I've column chart which uses below query: index=test \| stats last(_time) AS time by customerid \| convert timefo... by freephoneid Path Finder in Splunk Search 05-29-2015 1 1	1	1
Convert Pie Chart to Timechart - Is it possible? Hi, I'm displaying Pie chart with below query. index=my_index sourcetype="my_log" keyword1 keyword2 "errorValue=" \|... by freephoneid Path Finder in Splunk Search 05-29-2015 0 1	0	1
Urgent !! Complex case statements in eval I have a field that captures the usage of every user. I want to write a case to get the usage of each user in that ho... by sushmitha_mj Communicator in Splunk Search 05-29-2015 0 13	0	13
Performing basic calculations, eval statement and wildcard I need some assistance in calculating latency values. I have many hosts, logging transformation latency in different ... by bcatwork Path Finder in Splunk Search 05-29-2015 0 4	0	4
What are recommendations for optimizing the performance of my current search? I have this search that is a very sparse search over 7 days and takes a long time to complete (more than ten hours) .... by hartfoml Motivator in Splunk Search 05-29-2015 0 2	0	2
Search app doesn't recognise the transformed search Hi, I tried to tansform unix app's data something like this -- [transforms.conf] [df] REGEX = ([^\s]+)\s+([^\s]+)\... by rahiparikh Explorer in Splunk Search 05-29-2015 0 6	0	6
Rounding Currency to Two Digits After Decimal I am attempting to round my currency figures to two decimal places whether or not the amount ends with zeros (e.g., $... by msettipane Splunk Employee in Splunk Search 05-29-2015 1 2	1	2
How to extract data from event? I have a bunch of events and within the events, I have the following: "Back Garage took Time In MilliSeconds: 1621 ... by mrchariybrown New Member in Splunk Search 05-29-2015 0 2	0	2
How do I remove a null field? Sometimes Splunk has extra null fields floating around (e.g., after fields nosuchfield *). Is there a command which a... by tlagatta_splunk Splunk Employee in Splunk Search 05-29-2015 0 3	0	3
Transaction Command Broken when using non-default index? Good Day, New to splunk, using version 4.2.3 Imported some zipped log files into splunk. I can search them just fin... by lokival Explorer in Splunk Search 05-29-2015 0 2	0	2
trouble with regex Hello I have sone trouble with regex I want build a table or a chart wirh the following content: I started with this... by nicolay_koecher Explorer in Splunk Search 05-29-2015 0 2	0	2
Passing a value from one search to another (map? subsearch? join?) Hi, This is my first question - usually I've been able to figure it out following posts on here but I'm struggling w... by chris24747 Explorer in Splunk Search 05-29-2015 0 8	0	8
Search in XML file Hi, I am new in splunk world. I have an XML file that contains following data. <TargetMachines> <TargetMac... by adityaanand Explorer in Splunk Search 05-29-2015 0 5	0	5
How do I display a blank map using geostats? When I run a search to be displayed on a map using geostats that does not include any returned data, the map doesn't ... by dzilk Engager in Splunk Search 05-29-2015 0 5	0	5
When is props.conf applied for search-time field extraction? We have a setup where Universal Forwarders send data to indexers and dedicated search heads search those indexers. Th... by chris Motivator in Splunk Search 05-28-2015 0 1	0	1