Splunk Search

Community Activity

How to get the details of a field value that does not appear in search results? How to get the details of field app=sencer, when it not shown in the values for the app field? by moiezuddin Explorer in Splunk Search 04-07-2015 0 5	0	5
How to Extract Fields from McAfee Vulnerability Manager The events collected from the MVM have multiline fields, I would like to extract vendor_description,vendor_observatio... by mzorzi Splunk Employee in Splunk Search 04-07-2015 0 4	0	4
Lookup led to repplication of results, why & how to avoid it? I had a query being called from my webApp which was getting XML results nicely. Query: search index="timedata" \| ... by mohitab Path Finder in Splunk Search 04-07-2015 1 2	1	2
How to join multiple child objects of a data model? We have a situation where we need to join multiple child objects of a data model. e.g. ProjectInformation (Datam... by sanjay_shrestha Contributor in Splunk Search 04-07-2015 0 1	0	1
Why am I unable to store a result into a new field using eval? Hai I tried following search: sourcetype="smaple12" OR sourcetype="sample22" OR sourcetype="sample32" Install_Mod... by vasavigangana Explorer in Splunk Search 04-07-2015 2 3	2	3
Need help gathering information from logs including first event timestamp and last event timestamp. I want to gather specific information out of unique sessions. There are 4 bits of information, I've been able to gath... by ferza Explorer in Splunk Search 04-06-2015 0 3	0	3
How to create multiple files from a single file? I’m analyzing events that may contain one or more file names. Extracting a file name when there’s only one per even... by lenafried New Member in Splunk Search 04-06-2015 0 2	0	2
Jobs not geting purged in dispatch In our dispatch directory jobs are getting purged though we didn't set any parameters explicitly,all are default only... by viswanathsd Path Finder in Splunk Search 04-06-2015 0 4	0	4
how to get the total row number of a search result I have a search string: sourcetype=databaseError "object is null" to get the total row number of the result. ne... by KShen New Member in Splunk Search 04-06-2015 0 3	0	3
Receiving an error of an unexpect symbol when running a script in R. This is the error I am receiving: command="r", R exited with code 1: Error: unexpected symbol in: "input <- read.csv... by krwinters11 Path Finder in Splunk Search 04-06-2015 0 3	0	3
Is it possible to get the first and last concurrent events by a field? Is it possible to get the first and last concurrent events by a field? I'm trying to use this with NAT translations ... by TaylorWhitt Path Finder in Splunk Search 04-06-2015 4 1	4	1
Splitting a multi value field in configuration files I have a JSON data source in which one of the fields contains a comma separated list of values. Is there a way to use... by asieira Path Finder in Splunk Search 04-06-2015 0 2	0	2
Subsearch: Returning the results from the subsearch and outer/primary search simultaneously. Is it possible to return the results from a subsearch alongside the results of the outer/primary search? [search ear... by metersk Path Finder in Splunk Search 04-06-2015 1 2	1	2
how to generate error count report I have several query.Each query I have the list of the result. But I just need to know the report of each of the tot... by KShen New Member in Splunk Search 04-06-2015 0 3	0	3
Help with TIME_PREFIX Hi, I need some help setting up a TIME_PREFIX for the following: INFO \| jvm 1 \| 2015/04/05 01:56:20 \| Sametime... by a212830 Champion in Splunk Search 04-06-2015 0 4	0	4
How To Concatenate String For Calculated Field? Hello everybody, sup? I need a little help for this, I have fields separated for a datetime, for example: day_ini =... by vtsguerrero Contributor in Splunk Search 04-06-2015 0 7	0	7
How can i get cpu time for each component in log files? Hai i have some installation logfiles and i want to caluculate cpu time for each components(success and falied c... by vasavigangana Explorer in Splunk Search 04-06-2015 0 3	0	3
How to only return values from a search where the percentage is greater than 5%? hi, my search is : index=* sourcetype=ABC host=ABC c_met="GET" c_u_s="mweb.dll" [search index=* sourcetype=ABC h... by Laya123 Communicator in Splunk Search 04-06-2015 0 10	0	10
How to search for text between 2 tags and exclude all results that have nothing? I have this string.. <a:StatusMessage i:nil="true"></a:StatusMessage> I have millions of these strings which do no... by skoelpin SplunkTrust in Splunk Search 04-05-2015 1 1	1	1
Automatically Connect to Failover? All of our SQLServer DBs have a primary and a fail-over. One the rare ocasion when we fail-over Splunk stops indexing... by rpattison Explorer in Splunk Search 04-04-2015 0 1	0	1
Can't connect to SQLite database I'm using the DB Connect V1 app in Splunk 6.2 on an Ubuntu Linux server. I have a local sqlite database. I can use ... by responsys_cm Builder in Splunk Search 04-04-2015 0 1	0	1
Calculate percentage of counts over events Hi I would like to get alerted about the percentage of extraction errors ( since there is no built-in function for t... by huaraz Explorer in Splunk Search 04-04-2015 0 5	0	5
How can we index real-time data directly from an Oracle database into splunk? Is there any way to index real-time data directly from an oracle database into the splunk? I want to index data from ... by saurabh7026 Engager in Splunk Search 04-03-2015 0 2	0	2
How to write the regex to extract the IP Address, but not CIDr notations from my sample data? Hello, I am trying to extract fields from a feed that I have, but the automated field extractor is not working for m... by j666gak Communicator in Splunk Search 04-03-2015 0 1	0	1
Chart Color Assignment (seriesColors) Not Working Properly This is the first time I've tried this, so I'm not sure if I've got something wrong. I'm trying to assign static colo... by David Splunk Employee in Splunk Search 04-03-2015 1 5	1	5