Splunk Search

Community Activity

Find group using client IP in lookup of network ranges What I am trying to do is find what group a client IP belongs to. I have some existing assets (lookup csv) which ide... by ccsfdave Builder in Splunk Search 01-28-2015 0 10	0	10
How can I filter out unique values from a shared field across multiple queries using subsearch? Hello, I currently have two queries which both have the same field. Is there a way, using subsearch, to filter out a... by rlough Path Finder in Splunk Search 01-28-2015 0 8	0	8
How to write the regex to extract multiple values into a single field? I have a log file containing information logged in the below format: Response Received from ABC service for Submit T... by visa87 Explorer in Splunk Search 01-28-2015 0 2	0	2
How to chart raw Windows perfmon values over time? I'm attempting to chart some raw windows perfmon values on a chart over time, and I can't seem to find a way. I've be... by tmarlette Motivator in Splunk Search 01-28-2015 0 7	0	7
How to optimize a search performance of a slow, composite search I'd like to have some opinions on the following search. We're not thrilled with it's performance, and I'm sure theres... by d044160 Explorer in Splunk Search 01-28-2015 4 7	4	7
Why is my configuration causing a search for field=value to return only single line events, not multiline? I have a log, broken to fields, where the free text field is the last field and can be multiline. After defining the ... by avilandau Path Finder in Splunk Search 01-28-2015 0 1	0	1
Convert Date to Day of Week I have a Field that contains values in the YYYY-MM-DD. What's the best way to convert it to the day of week? For exam... by Splunkster45 Communicator in Splunk Search 01-28-2015 0 1	0	1
PCRE_ERROR_RECURSIONLIMIT for regex on transforms.conf For a sourcetype nginx log error, I would like to index everything except data that contains : unlink text. Eg: 2015... by fabiocaldas Contributor in Splunk Search 01-28-2015 1 11	1	11
multiple eval and count in the pipe Hi, I have a table with header line like: stepName stepStatus time additional_sub_4 PASS ... by milande Path Finder in Splunk Search 01-28-2015 0 10	0	10
How to get an external lookup that returns results containing non-english charsets to decode properly? Hi, I've been trying to create an external lookup that returns results that contain non-English characters, and Spl... by kuchinoh New Member in Splunk Search 01-28-2015 0 3	0	3
Can eval if match be used with inputlookup? So what I'm trying trying to achieve is searching a field for contained in a CSV file, not an exact match. I can do t... by chrisfrigo Path Finder in Splunk Search 01-27-2015 1 3	1	3
How to compute concurrent members in events? Say, I have a series of jobs involving a certain number of members, _time MemberCount JobRunTime (min) JobNa... by yuanliu SplunkTrust in Splunk Search 01-27-2015 0 11	0	11
Help writing generic standard deviation query So I'm trying to build a generic search to show a timeline and standard deviation. Basically, pull the count of even... by dhorn Path Finder in Splunk Search 01-27-2015 0 4	0	4
Splunk(x) globe app? Hi all, wondering if anyone knows where or even if the globe app exists. I'm talking about the rotating globe with l... by dondky Path Finder in Splunk Search 01-27-2015 0 2	0	2
Find Consecutive Results in a Time Span Hello I have created a search that monitors a queue and the number of transactions in a 10 minute span: index=tt L... by tkwaller Builder in Splunk Search 01-27-2015 0 2	0	2
Counting number of characters in a Splunk field Is it possible to count number of characters in a splunk field? I can only seem to find a way to count specific inst... by metersk Path Finder in Splunk Search 01-27-2015 0 2	0	2
query in fast mode showing incorrect data and generate wrong result in chart Hi, I have two fields in events, with which I am preparing line chart both the fields information 1. All the events... by shreyans Path Finder in Splunk Search 01-26-2015 1 7	1	7
How to extract a field that can possibly have null values? I have managed to create many field extractions, but my latest has me stumped. My events are formatted by a vendor, ... by chengka Explorer in Splunk Search 01-26-2015 0 2	0	2
Problem with DB Connect and hive query on float or double fields Hi, I am currently working with Hunk and DB connect, I have connected it to a hive database and after lots of search ... by wandrilleD Engager in Splunk Search 01-26-2015 0 1	0	1
is it possible to force a particular node to be the captain in a search head cluster? by phelyar Engager in Splunk Search 01-26-2015 2 4	2	4
How to execute a search and extract fields from _raw using Splunk's REST API? Ref : http://dev.splunk.com/view/basic-tutorial/SP-CAAADQT End business Need Using REST API, execute the searchInpu... by ronak Path Finder in Splunk Search 01-26-2015 0 3	0	3
Best way(s) to track changes in count of IPs Every night we scan our external systems for two reasons: 1) To see if unauthorized systems pop up 2) To see if ther... by jwalzerpitt Influencer in Splunk Search 01-26-2015 0 3	0	3
How to extract a key value pair, convert it to a JSON format and assign it to a variable using eval? Hi Guys, I have a log event like the following 2015-01-08T08:56:30.835Z "Name:John"="21","Name:Sam"="29","Name:Jim"... by nibinabr Communicator in Splunk Search 01-26-2015 0 3	0	3
How do I find the date/time that a field last changed? I'm using Splunk to provide dashboards on a document workflow for a publishing company. The data from the workflow sy... by jamesgeldart Engager in Splunk Search 01-26-2015 0 2	0	2
How to remove blank cells in the statistics table? Greetings, I am running the search attached in the image (I'll paste the text below as well). index=security sour... by ccsfdave Builder in Splunk Search 01-26-2015 0 2	0	2