Splunk Search

Community Activity

How to delete a Value from a MultiValue field based on an eval calculation? I have a few multivalue fields which I created using stats list(A) as A_list, list(B) as B_list, list(_time) as time_... by singhbc Path Finder in Splunk Search 04-28-2015 2 7	2	7
… \| where like(src, “10.9.165.%”) OR cidrmatch(“10.9.165.0/25”, dst) What will this search return as a result? … \| where like(src, “10.9.165.%”) OR cidrmatch(“10.9.165.0/25”, dst) What will this search return as a result? An... by rashokciet New Member in Splunk Search 04-28-2015 0 5	0	5
Best way to add start time from external time to time field in searches I've got the start time for my events in a external xml-file. Is there a easy way to access this information in a sea... by seam0n Explorer in Splunk Search 04-28-2015 0 5	0	5
Javascript SDK (Nodejs) How should I write my search string to search based on host? Hi All, I have Splunk running on my machine. I am using Nodejs (Javascript sdk) to search a query. I am using onesho... by blazergun Engager in Splunk Search 04-27-2015 0 2	0	2
How to combine 2 log files that have the same date-time values, but different field names? Hello, I am basically stuck on this problem that I hope the Splunk community can help me with. I have 2 files. Tha... by anhtrantech Engager in Splunk Search 04-27-2015 0 1	0	1
Inline search is not working in a dashboard Hi I had a similar problem last month. I received a solution but now I encountered the same problem but the solution... by edrivera3 Builder in Splunk Search 04-27-2015 0 6	0	6
How to calculate moving average and graph it as an overlay on a bar chart of actual values? I am trying to calculate a moving average and overlay those values on a bar chart of actual values. This is what I h... by krwinters11 Path Finder in Splunk Search 04-27-2015 2 10	2	10
Once we get data into Splunk, what are basic searches we need to run for testing? Hi, Once we get data into splunk, what is the basic testing we have to do? What are the basic searches we need to ru... by luckymaddy Explorer in Splunk Search 04-27-2015 0 3	0	3
Why am I not getting all expected results when using time modifiers in my search in Splunk 5.0? I have a little confusion about how time stamp actually works. I want to do a very simple query to combine the result... by shengcow Explorer in Splunk Search 04-27-2015 0 6	0	6
understanding regex better I am trying to understand better how splunk regex works. I have the below example: This is a sample of the data I a... by HattrickNZ Motivator in Splunk Search 04-27-2015 0 7	0	7
How do I create a table or other output of total process durations with multiple subprocess durations I have log data like this: 2015-04-22 14:10:02,351 [ACTIVE] PerfLogger [CCID] - Message: subprocess.name.1; Duration:... by wjblazek Explorer in Splunk Search 04-27-2015 0 4	0	4
Automatically group events into transactions, or: reassemble lines (before indexing) based on shared field Hey folks, I have a web application that logs several log lines per request. Each line is tagged with the request id... by fw42 New Member in Splunk Search 04-27-2015 0 6	0	6
How to get 1 row per bucket in a timechart Currently, a log file is being written to every 5 minutes that displays each user logged in at that specific point in... by Splunkster45 Communicator in Splunk Search 04-27-2015 0 3	0	3
I extracted a new field and validated it from a csv file. How do I see and use it for searches? Hi, I am new to Splunk, but I already like its features. I was trying to extract a field from my loaded .csv file a... by skender27 Contributor in Splunk Search 04-27-2015 0 4	0	4
Why are fields showing as undefined with values of price, magic, and relevance from production apache access logs index? What is going on here? All fields are technically working correctly, as I can filter by them, use them in stats or e... by StevenPol Engager in Splunk Search 04-27-2015 3 1	3	1
Dedup duplicates Hi, what is the easiest way to filter out event duplicates without adding every field in the dedup command? Is \|... by HeinzWaescher Motivator in Splunk Search 04-27-2015 2 6	2	6
How do I join 2 or more search results together on fields with different names? For example, on one result I have a field 'Transactionid' equal to '12345' and on another result I have a field 'tran... by chrismeyer75 New Member in Splunk Search 04-27-2015 0 11	0	11
Is there internal Splunk data I can search to find the latest timestamp when an app from Splunkbase was installed? Is there a splunk search that I can use to find the latest timestamp when an app was installed? Is there an internal ... by nibinabr Communicator in Splunk Search 04-27-2015 0 2	0	2
how to get incomplete transactions Hi, I need small help from you, I am calculating duration of each transaction of on userid. My query: index=A sou... by Laya123 Communicator in Splunk Search 04-27-2015 0 9	0	9
How to compare data for a scheduled search for the past 1 hour with the previous 24 hours? Hi, I have two scheduled searches that run every 1 hour with retroactive time interval (earliest = -1h). I need to p... by rodrigorsilva Communicator in Splunk Search 04-27-2015 0 2	0	2
timechart bug? (placement of 'span' in the search bar) One of my users is having an issue with timechart ... (host=aaa6* OR host=bbb24*) "[string to filter search]" (E=005... by pkeller Contributor in Splunk Search 04-27-2015 1 6	1	6
Extract firewall ip as host instead of CLM name The app seems to extract the CLM hostname as the host field. I think it would be better to extract the firewall ip o... by PrinceOfEval Path Finder in Splunk Search 04-27-2015 0 4	0	4
How to use subsearch with eval to execute a search containing another subsearch? Hello, I would like create a search based on variables. My current search: \| stats count \| eval search="index=c... by Gchouane Engager in Splunk Search 04-27-2015 0 2	0	2
Is there a better way to filter on multiple values than my current search? Hello, I have the following event entries: NAME=A;VAL=15; NAME=A;VAL=5; NAME=B;VAL=15; NAME=C;VAL=15; NAME=C;VAL=15... by jebabin Engager in Splunk Search 04-27-2015 0 6	0	6
How to create a token from a field (email_id) and pass the token to the sendemail command in an inline search? Hi experts I have one search where I am extracting username from a Windows event and using a static lookup table to ... by jitendrasingh12 Explorer in Splunk Search 04-27-2015 0 2	0	2

Get Updates on the Splunk Community!

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games Think you have what it takes to beat the clock? ...

Data Management Digest – June 2026

Welcome to the June 2026 edition of Data Management Digest! This month’s update is short and sweet, with a ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Splunk Search

How to delete a Value from a MultiValue field based on an eval calculation?

… | where like(src, “10.9.165.%”) OR cidrmatch(“10.9.165.0/25”, dst) What will this search return as a result?

Best way to add start time from external time to time field in searches

Javascript SDK (Nodejs) How should I write my search string to search based on host?

How to combine 2 log files that have the same date-time values, but different field names?

Inline search is not working in a dashboard

How to calculate moving average and graph it as an overlay on a bar chart of actual values?

Once we get data into Splunk, what are basic searches we need to run for testing?

Why am I not getting all expected results when using time modifiers in my search in Splunk 5.0?

understanding regex better

How do I create a table or other output of total process durations with multiple subprocess durations

Automatically group events into transactions, or: reassemble lines (before indexing) based on shared field

How to get 1 row per bucket in a timechart

I extracted a new field and validated it from a csv file. How do I see and use it for searches?

Why are fields showing as undefined with values of price, magic, and relevance from production apache access logs index?

Dedup duplicates

How do I join 2 or more search results together on fields with different names?

Is there internal Splunk data I can search to find the latest timestamp when an app from Splunkbase was installed?

how to get incomplete transactions

How to compare data for a scheduled search for the past 1 hour with the previous 24 hours?

timechart bug? (placement of 'span' in the search bar)

Extract firewall ip as host instead of CLM name

How to use subsearch with eval to execute a search containing another subsearch?

Is there a better way to filter on multiple values than my current search?

How to create a token from a field (email_id) and pass the token to the sendemail command in an inline search?

Casting Call: Compete in Cyber Games

Data Management Digest – June 2026

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation