Splunk Search

Community Activity

where clause issues/stripping out extraneous characters Hi, I need to do a where clause on a value that includes a % in the result, how can I strip off the percentage chara... by a212830 Champion in Splunk Search 05-07-2015 0 1	0	1
Transaction with Multiple events I am using the transaction command to group transactions on the field tx_id. Each successful transaction will begin ... by JoeSco27 Communicator in Splunk Search 05-07-2015 1 8	1	8
Stats for unique users encountering an error by all users Example: Return the count of users/ total users, encountering error by page, error So the X axis would be the rows f... by Cuyose Builder in Splunk Search 05-07-2015 0 10	0	10
join command in splunk Hi , I need to extract the host list which are belonging to certain applications ( Listed in my Lookup table ) Need ... by splunkn Communicator in Splunk Search 05-07-2015 0 3	0	3
Best method for multiple inputs for a search Hi, I have a search that is going to require a fair amount of inputs (4 hosts, and 5 or 6 filesystems per host) to m... by a212830 Champion in Splunk Search 05-07-2015 0 1	0	1
Useragent regex is not working Hello, I am trying to create a regex to capture different types of browsers and I found that I need to have useragent... by puneetkharband1 Path Finder in Splunk Search 05-07-2015 0 2	0	2
getting vice-versa hostnames from events Hi all, I'm getting in events looking like this from host srv01.dev.web.env env_web_dev_srv01.cpu-0.cpu-idle 97.380... by schose Builder in Splunk Search 05-07-2015 0 1	0	1
Extract help... Hi, We log our filesystem utilization to Splunk, and I'd like to extract percentage used field, but the formats for ... by a212830 Champion in Splunk Search 05-07-2015 0 9	0	9
How to create a stat table that has columns that represent the same time range per week. I have this basic query and would like to create a stat table that shows the result for the last 3 weeks for the same... by DandeGuzman New Member in Splunk Search 05-07-2015 0 5	0	5
streamstats sum() by not functioning as expected Hi, I have the following search, which is attempting to add up the number of dropped and processed syslog messages i... by brettw10 Explorer in Splunk Search 05-06-2015 0 2	0	2
Compare multi value field with an external file I have a multi value field that looks similar to below [a,b] [a,b,c] [b,c] .... so on For each event , I want to co... by visa87 Explorer in Splunk Search 05-06-2015 1 1	1	1
Get Percentage of Network bandwidth I'm looking to define a query that allows me to query the Network Interface for all my machines and create a percenta... by tysonjhayes Explorer in Splunk Search 05-06-2015 0 9	0	9
get size/bytes of log events and the number events by direction (request/response) I am trying to get the number of requests/response that we send/receive to/from one application and the combined size... by edookati Path Finder in Splunk Search 05-06-2015 0 2	0	2
Why is the markup all jacked? It seems to be switching my valid lessthan/greater than symbols to html entities even when marked as code! example: <myfield> by rsennett_splunk Splunk Employee in Splunk Search 05-06-2015 0 1	0	1
How can I create a third field based on unique combinations of two other fields Hello all, I am really new to Splunk and cannot for the life of me figure this one out. Unfortunately, Googling arou... by cmontonen Explorer in Splunk Search 05-06-2015 0 2	0	2
Date Parsing Dear all, I am collecting some application logs as below. Splunk can parse my log very well if the timestamp shows ... by simontam Explorer in Splunk Search 05-06-2015 0 2	0	2
Customize sourcetype display Im monitoring 2 harddrive usage from a server. This is my query : index="perfmon7days" earliest=-60m sourcetype="W... by jeanfrederic New Member in Splunk Search 05-06-2015 0 4	0	4
Why does _time bucket give different results depending on how the data is sorted? The following search returns two values (yesterday (1430780400) and today(1430866800)): earliest=-d@d index=_in... by manus Communicator in Splunk Search 05-06-2015 0 2	0	2
Search Top Field If exists I'm very new to Splunk, and I'm trying to figure out a way to search by different top fields, depending on whether th... by MDClayton Engager in Splunk Search 05-06-2015 0 1	0	1
Why fields from CSV are not being extracted? I'm getting data from forwarders that are polling a CSV file. However the fields from the CSV are not being extracte... by rbacon Path Finder in Splunk Search 05-06-2015 0 5	0	5
Subquery Event count in not work i need to count sub query i create query in which i search unique no of values of one field and that unique value join to other query they work... by nitesh218ss Communicator in Splunk Search 05-06-2015 0 2	0	2
How to pass one field from a real-time search result as variable on a dashboard? Hello Splunkers! I have a dashboard (with js) with some real-time search. This search always returns only one result... by ryastrebov Communicator in Splunk Search 05-06-2015 0 4	0	4
DBConnect Events Truncate Despite props.conf It seems that DBConnect inputs does no respect the props.conf configuration for event truncation. Example props: [e... by graememeyer Explorer in Splunk Search 05-06-2015 1 5	1	5
Best Practices to join two child objects of a data model We have a situation where we need to join two child objects of a data model. Both child objects have separate index ... by sanjay_shrestha Contributor in Splunk Search 05-06-2015 0 4	0	4
use subsearch hi every one, I want to make a search that could give me the same result of SQL Querie select id_product from prod... by otman01 Communicator in Splunk Search 05-06-2015 0 2	0	2