Splunk Search

Community Activity

When searching for status errors, how to remove the most frequent error from results to properly display the others in a visualization? I'm creating dashboards for the error status. We currently have 3 different statuses (200,404, and 0). The '200' stat... by skoelpin SplunkTrust in Splunk Search 02-10-2015 0 4	0	4
Is it possible to pass variables in props.conf with my current configuration? I was wondering if it was possible to write a props.conf something similar to the following: props: [sourcetype = m... by ltrand Contributor in Splunk Search 02-10-2015 0 2	0	2
How to change existing stats search output for aggregate counts based on a field? Jesse, Wondering if I could throw another question at you... I have the following query: source="mysource" Immediat... by jwalzerpitt Influencer in Splunk Search 02-10-2015 0 2	0	2
What special characters are available for use with rex and regex and what are their functions? I see a variety of letters being used like w,n,d,s etc. pls help me to understand what characters are available to us... by satya2p Path Finder in Splunk Search 02-10-2015 0 5	0	5
Extracting date from datetime field Hi I have field named as "extract_datetime" and it has the following values; 2015-02-08 02:15:24 2015-02-08 02:18:3... by rogerbinny Explorer in Splunk Search 02-10-2015 0 10	0	10
How to set up a csv lookup file I update daily to be referenced by searches without having to redefine it? Hello Splunkers, Question: I have a lookup working properly on a .csv file but I appear to have correctly assumed tha... by lbogle Contributor in Splunk Search 02-10-2015 0 5	0	5
Why scheduled search with "stats first()" returns different results from running it from the search bar and how to fix this? Hi, I'm currently setting up an aggregation via a scheduled search. Running the query for this in the search bar obt... by anthonycopus Path Finder in Splunk Search 02-10-2015 1 3	1	3
How to create a dual transaction where 'startswith' should start with A or B condition and 'endswith' should be C or D condition? Hi, I am trying to transaction a scenario here where startswith should start with A or B condition and endswith sho... by Venkat_16 Contributor in Splunk Search 02-10-2015 0 1	0	1
Is it possible to consolidate all results from my search for all processes in my infrastructure and generate a summary? Hi, I have this request from my beloved client where he needs to have a dashboard that shows the availability ... by ryantzj Explorer in Splunk Search 02-10-2015 0 2	0	2
Windows Events with Null Message Splunk is reporting a majority of my windows events are being returned with "Null" in the message field. However, Wh... by richnavis Contributor in Splunk Search 02-10-2015 1 4	1	4
Why is the condition tag in my drilldown not working as expected and how do I fix this behavior? Hi All I have a dashboard as following: Panel 2 is a table I am enabling drilldown on column "general_exception_type"... by adityapavan18 Contributor in Splunk Search 02-09-2015 0 2	0	2
Add Data: Input Settings: Regular expression on path/filename to create Host field I'm adding a CSV using the "Add Data" GUI in Splunk 6.2. When I get to the Input Settings page, I have the option to ... by masonmorales Influencer in Splunk Search 02-09-2015 0 1	0	1
How to do a basic plot of network traffic by minute? I'm trying to do a basic plot of network traffic (bps) by minute over three days. I uploaded a .csv file that has the... by jwalzerpitt Influencer in Splunk Search 02-09-2015 1 17	1	17
How to set up an alert to send a certain field value based on a set of extracted values from an xml log file? Hi All, I'm very new to Splunk. I would like to create an alert from my log file wherein i will first search for a s... by imsiva New Member in Splunk Search 02-09-2015 0 1	0	1
What does the "\1/" do in the regex of this Splunk search? index=xxx sourcetype=yyy CSI_ID="1234"\| rex field=COMPONENT_ID mode=sed "s/(.)(\..){4}/\1/"\| table COMPONENT_ID I... by Madhan45 Path Finder in Splunk Search 02-09-2015 0 2	0	2
How to get stats count results broken down per field? I have some logs where there are actions and a site associated with that action, for example CREATE, site_1. I am tr... by Volto Path Finder in Splunk Search 02-09-2015 1 2	1	2
Merge Multiple Events into a Single Event In Splunk, I have a Delivery Schedule call which lists the date and gives a true or false to see if its available for... by skoelpin SplunkTrust in Splunk Search 02-09-2015 0 1	0	1
How to extract all values for a single field using rex? Hi, I have a log file from which I am trying to extract a value of the specific term "Security ID". My data is divid... by harshal_chakran Builder in Splunk Search 02-09-2015 1 5	1	5
How to search multiple indexes and display results in a single table? Hello, I am looking for a way to play in a single table the results of two different indexes. The two searches are: ... by carlpier Explorer in Splunk Search 02-09-2015 0 2	0	2
Replace '&' with ',' I want to replace the character '&' with the character ',' in the below field. field = {call DB2GIPS.GIP_IP_SMRY_BRO... by Jananee_iNautix Path Finder in Splunk Search 02-09-2015 0 3	0	3
Web service requests by user I am trying to understand what method to be used to map a web userid="*"" to the specific service they are using at t... by bcarnot Path Finder in Splunk Search 02-08-2015 0 2	0	2
Eval for known and unknown field values I am using a search command to rename ip address output to device names something like below: sourcetype=syslog \| ev... by ashabc Contributor in Splunk Search 02-07-2015 0 4	0	4
My automatic lookup field is not searchable unless I pipe search for it. I am trying to run the following search in Splunk: index=index1 sourcetype=sourcetype1 bldg=XI The bldg field is an... by katelynengel Explorer in Splunk Search 02-07-2015 0 3	0	3
Possible to place a graphic on a map in real-time every time an event occurs? I would like to use a map to pop a graphic up on a map for each time an event occurs in real-time. I have use iplook... by djconroy Path Finder in Splunk Search 02-07-2015 0 4	0	4
Uptime Graph for Multiple Objects I've searchs Splunk Answers and I have gotten two search strings, where if combined, would give me the results I woul... by TaylorWhitt Path Finder in Splunk Search 02-07-2015 1 2	1	2

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Splunk Search

When searching for status errors, how to remove the most frequent error from results to properly display the others in a visualization?

Is it possible to pass variables in props.conf with my current configuration?

How to change existing stats search output for aggregate counts based on a field?

What special characters are available for use with rex and regex and what are their functions?

Extracting date from datetime field

How to set up a csv lookup file I update daily to be referenced by searches without having to redefine it?

Why scheduled search with "stats first()" returns different results from running it from the search bar and how to fix this?

How to create a dual transaction where 'startswith' should start with A or B condition and 'endswith' should be C or D condition?

Is it possible to consolidate all results from my search for all processes in my infrastructure and generate a summary?

Windows Events with Null Message

Why is the condition tag in my drilldown not working as expected and how do I fix this behavior?

Add Data: Input Settings: Regular expression on path/filename to create Host field

How to do a basic plot of network traffic by minute?

How to set up an alert to send a certain field value based on a set of extracted values from an xml log file?

What does the "\1/" do in the regex of this Splunk search?

How to get stats count results broken down per field?

Merge Multiple Events into a Single Event

How to extract all values for a single field using rex?

How to search multiple indexes and display results in a single table?

Replace '&' with ','

Web service requests by user

Eval for known and unknown field values

My automatic lookup field is not searchable unless I pipe search for it.

Possible to place a graphic on a map in real-time every time an event occurs?

Uptime Graph for Multiple Objects

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation