Splunk Search

Community Activity

Eval a string as an expression I have a table that I want to extract an expression from. The expression is quoted string with some fields in it. i... by fk319 Builder in Splunk Search 03-14-2015 1 11	1	11
Query for monthly usage of index I am very new to Splunk I am trying to figure out how to do a query of monthly usage of index of Splunk. I have tri... by rickdi Engager in Splunk Search 03-13-2015 1 4	1	4
Extracting field with a guid as an end anchor For some reason I have not been able to get a field extraction to work where the end anchor will be a GUID. Basicall... by Cuyose Builder in Splunk Search 03-13-2015 0 7	0	7
Find Maximum Time Period Between Occurences of a Specified Condition Hello, I'd like to find a way to return the longest stretch of time where a condition did not occur. Specifically,... by essklau Path Finder in Splunk Search 03-13-2015 0 1	0	1
How to add a 3rd column to my table to display "match" next to a value in column 2 that matches any value in column 1? My current search looks like this: index=myfood \| table Sunday, Monday Which results in: Sunday Monday Egg... by dineshp Explorer in Splunk Search 03-12-2015 1 3	1	3
Why does a comma in Regex break the serverclass in the Splunk GUI? When editing server classes in the Splunk GUI, it cannot handle a comma in a regex. EG: \w{3}\d{1,3}\w Ends up bei... by JeremyHagan Communicator in Splunk Search 03-12-2015 1 4	1	4
How to add fields from subsearch ? Used Join but didnt work ... I have a subsearch which returns a table with 2 columns 'input' and 'Time'. Table from subsearch looks like this. in... by kshanky143 Path Finder in Splunk Search 03-12-2015 0 2	0	2
Displaying several fields, some with aggregate data Hi all - new here but the answers I've seen so far on stats (ie http://answers.splunk.com/answers/106497/add-a-new-co... by razlani Explorer in Splunk Search 03-12-2015 0 6	0	6
How to write a search to get a daily count of each fieldB by fieldA for 30 days? The events, each contain fieldA and fieldB (as well as other stuff). Currently, the search below works for 1 day, but... by mattbirk Explorer in Splunk Search 03-12-2015 1 6	1	6
Using rex to extract a field from transactioned event Hi, I'm trying to extract 2 fields from a transacted search, one for the max and one for the usage. looks like; 201... by markthompson Builder in Splunk Search 03-12-2015 0 1	0	1
How to edit my current search to find the average? Hello guys! Sup? Can anyone help me to get the average of all current search events and not only the first ones. I ha... by vtsguerrero Contributor in Splunk Search 03-11-2015 0 1	0	1
Is the time format in my sample data correct and how do I filter my search to see events within a certain time range? We have logs that are like below: 11 Mar 2015 17:22:49,539 INFO [pool-11-thread-4] timestamp=1426119768843 : abc=12... by seedaffodil New Member in Splunk Search 03-11-2015 0 1	0	1
How to keep the same value of a field in each row until the value of the field changes? Hi all, I'd like to keep value on a field until the value of this field changes. Please see the following example: ... by ludoz13 Path Finder in Splunk Search 03-11-2015 0 4	0	4
Simple syntax to filter data by _raw value Hi all - I'm new here (literally an hour old) so go easy. I've read through parts of the docs and am currently using... by razlani Explorer in Splunk Search 03-11-2015 0 4	0	4
How to extract the count from below tabular form of logs -------------------------------------------------------------- \| R u n C o n t r o l D i s p l a y ... by muguniya Explorer in Splunk Search 03-11-2015 0 3	0	3
How to configure Splunk to index PSV files and extract field names from the header/first row? We are trying to index a psv file into Splunk with sourcetype as "psv", but its not extracting fields from the PSV's ... by dhavamanis Builder in Splunk Search 03-11-2015 0 2	0	2
Regex optional groups Hi guys, i'm trying to get this (simplified) regex running (for several days now): ^(?P<message>.+)(?:\s*SIP/2.0\s+(... by f1dot4 Explorer in Splunk Search 03-11-2015 0 3	0	3
How to display cities by color based on severity level in Splunk 6 maps and display city name and severity level in tooltip? Hi. I am working on displaying cities with different severity levels. Cities with sev1 should be in red, sev2 in ambe... by Venkat_16 Contributor in Splunk Search 03-11-2015 0 2	0	2
What is causing my dashboards to throw error "The search job terminated unexpectedly" when choosing a large time range? Hello, I am having a problem when loading my dashboards for long time ranges. The error "The search job terminated ... by DavidHourani Super Champion in Splunk Search 03-11-2015 1 3	1	3
What is the best practice to paste regular expressions on Splunk Answers without the site removing special characters? Could someone please let me know what is the best practice to paste regex in the response to any question? Answers po... by satishsdange Builder in Splunk Search 03-10-2015 1 1	1	1
How to search logins for users with administrator rights from Windows event logs? We have captured Windows events, but have no idea how to identify the event to alert when a user with administrator r... by chungangus New Member in Splunk Search 03-10-2015 0 2	0	2
How to iterate a value in ColumnA through all values in ColumnB doing an eval division with the output in ColumnC? Hello folks, I have a stats result with two columns: Column A - only one result in the first line Column B - 8 lin... by mrncst Engager in Splunk Search 03-10-2015 0 2	0	2
In a chart, how can i copy values from coalesce values under different (3) columns? This is to do reporting in 2 columns at most. Hello I have a chart which looks like this .. src InQueueForX InQueueForY InQueueForZ X ------... by kshanky143 Path Finder in Splunk Search 03-10-2015 0 3	0	3
Count unique users visiting each url per day Sorry for newbie question but in a real rush. I'd like to count the number of unique users per day that are visiting... by Alimantado New Member in Splunk Search 03-10-2015 0 2	0	2
How to control the number of top results shown from a search in Splunk 6.1.2? I am trying to control how many of the top results are shown. I have the following search stats max(c1693801001) as... by HattrickNZ Motivator in Splunk Search 03-10-2015 0 4	0	4

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...

Splunk Search

Eval a string as an expression

Query for monthly usage of index

Extracting field with a guid as an end anchor

Find Maximum Time Period Between Occurences of a Specified Condition

How to add a 3rd column to my table to display "match" next to a value in column 2 that matches any value in column 1?

Why does a comma in Regex break the serverclass in the Splunk GUI?

How to add fields from subsearch ? Used Join but didnt work ...

Displaying several fields, some with aggregate data

How to write a search to get a daily count of each fieldB by fieldA for 30 days?

Using rex to extract a field from transactioned event

How to edit my current search to find the average?

Is the time format in my sample data correct and how do I filter my search to see events within a certain time range?

How to keep the same value of a field in each row until the value of the field changes?

Simple syntax to filter data by _raw value

How to extract the count from below tabular form of logs

How to configure Splunk to index PSV files and extract field names from the header/first row?

Regex optional groups

How to display cities by color based on severity level in Splunk 6 maps and display city name and severity level in tooltip?

What is causing my dashboards to throw error "The search job terminated unexpectedly" when choosing a large time range?

What is the best practice to paste regular expressions on Splunk Answers without the site removing special characters?

How to search logins for users with administrator rights from Windows event logs?

How to iterate a value in ColumnA through all values in ColumnB doing an eval division with the output in ColumnC?

In a chart, how can i copy values from coalesce values under different (3) columns? This is to do reporting in 2 columns at most.

Count unique users visiting each url per day

How to control the number of top results shown from a search in Splunk 6.1.2?

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation