Splunk Search

Community Activity

How to write a search to return events with a variable field value greater than a certain number? Hi, I've this log entry: "2014-11-22 02:42:10,545 .. - average:2.74425 , min:1.43 , max:4.007..." i want to create... by snabel Path Finder in Splunk Search 11-25-2014 1 5	1	5
How to extract language field Converted from http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html Hi, ... by martin_mueller SplunkTrust in Splunk Search 11-25-2014 1 1	1	1
How to dynamically set earliest time to the first instance of a particular event for a timechart? I want to dynamically set the earliest time to the first instance of a particular event. Is there a way to do that?... by pde7 Explorer in Splunk Search 11-25-2014 0 4	0	4
How can I edit my regex to exclude the words "query" and "in" from a string? I'm trying to exclude the word query and in from my string to create a new field called query. I'm not having any luc... by ashnet16 Path Finder in Splunk Search 11-25-2014 0 2	0	2
What's the best way to extract key value pairs from the following log? Hello Experts, I am trying to extract key-value pairs from the following. Here's the sample log. I have tried using ... by Raghav2384 Motivator in Splunk Search 11-24-2014 0 6	0	6
How much I/O is used for indexing and searching in a clustered environment? What resources are there for guidance? Hi Splunkers, I'm considering about splunk clustering in VM env, 1 Search Head, 3 Search Peers, 1 Cluster Master. An... by sunrise Contributor in Splunk Search 11-24-2014 1 2	1	2
Find a distinct count using a priority system. :: my search :: \| stats count dc(player) by result Let’s say the result field has two possible values, Win and Los... by JWBailey Communicator in Splunk Search 11-24-2014 0 7	0	7
Create a lookup with search queries and have another search search those queries Is there a way i can have a search look at a lookup that has predefined search queries in each row and then run a sea... by subtrakt Contributor in Splunk Search 11-24-2014 0 3	0	3
Filter out outliers in stats command So I am trying to filter out outliers using the 3 sigma rule across some transactions. My search is as follows: blah... by nterry Path Finder in Splunk Search 11-24-2014 0 3	0	3
Cumulative count of new users over all time (or custom range) I have a field "LYC_USERNAME" that shows up in our logs. In order to determine the total number of distinct users of... by adewinter Explorer in Splunk Search 11-24-2014 0 5	0	5
How to overlay 2 searches to generate linechart and area chart? Using 6.1, I would like to create a horizontal line with area chart. I have read so many examples and my search comm... by mmouse88 Path Finder in Splunk Search 11-24-2014 0 8	0	8
Is there a way to get my saved search to sort the resulting table properly when run on my dashboard? I am using a search cloned from the SoS app. I modified it to sort in the search itself. Though the search does run... by dolfantimmy Path Finder in Splunk Search 11-24-2014 0 6	0	6
How do I change the color of a pie graphic for each unique value? I have a Risk field with this possible values (Critical, High, Medium, Low) and I want to be red when critical, high ... by bruno_eduardo Path Finder in Splunk Search 11-24-2014 0 4	0	4
Is there a guide or map to understand Splunk's internal indexes and their log content? Does there exist some sort of map or guide to understanding Splunk's internal indexes (_internal, _audit, _introspect... by feickertmd Communicator in Splunk Search 11-24-2014 3 5	3	5
count based on time range I have search result of last 10 days. Can we get the count based on time range, like "count(Alert) as Total count w... by harish_ka Communicator in Splunk Search 11-24-2014 1 4	1	4
How to Join fields from 2 indexes Hello! I am trying to make a dashboard with fields from 2 indexes using the command "join". I wrote a search source="... by r2r2 Explorer in Splunk Search 11-24-2014 0 6	0	6
Is there a way to capture a value before a matching pattern that comes after a keyword in a different line of a log file ? Hi, i am desperately seeking help as I am a beginner Splunk user and I am struggling to extract the data I need from ... by hbenaicha Engager in Splunk Search 11-23-2014 0 4	0	4
Aggregate rate for entire cluster from individual hosts data I have cluster of more than 100 hosts which getting data over network from multiple source. I can calculate rate of i... by abhisawa Explorer in Splunk Search 11-23-2014 0 6	0	6
timechart with delta command using by clause Hi, I have a query like : index=XXX sourcetype=YYY \|search AGE = "*" NAME="CIA" OR NAME="FIA" \|timechart span=1... by abhayneilam Contributor in Splunk Search 11-23-2014 0 5	0	5
How to chart elapsed time performance data from dbquery? I've got a db query that returns an activity name and then the elapsed time of the activity that I would like to char... by danoconnl Explorer in Splunk Search 11-23-2014 0 1	0	1
Speed up a duration search? Here is my search. I'm trying to get a report on the duration between an ESXi host sync task in vCenter logs. The s... by mark_chuman Path Finder in Splunk Search 11-22-2014 0 7	0	7
How to include all results from a joined lookup table, even if the search does not return all matching fields? Case: 1. Lookup table (ex below) name, day example1,1 example2,2 2. Search that joins the lookup ta... by kobie New Member in Splunk Search 11-21-2014 0 7	0	7
using EVAL I have a form that prompts user for a 4 digit number representing a location. I want to insert that location number i... by mikefoti Communicator in Splunk Search 11-21-2014 0 6	0	6
How can I override or offset the x-axis values in a Timechart? I am working with Qualys Vulnerability reporting in Splunk and I'm building out a timechart of aging Vulns (Active Vu... by klawman Explorer in Splunk Search 11-21-2014 0 2	0	2
Is there a way to do a Splunk query on data spread across different splunk instances? Is there a way to do a Splunk query on data spread across different splunk instances? I guess not. If not, is there a... by manus Communicator in Splunk Search 11-21-2014 0 3	0	3

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

How to write a search to return events with a variable field value greater than a certain number?

How to extract language field

How to dynamically set earliest time to the first instance of a particular event for a timechart?

How can I edit my regex to exclude the words "query" and "in" from a string?

What's the best way to extract key value pairs from the following log?

How much I/O is used for indexing and searching in a clustered environment? What resources are there for guidance?

Find a distinct count using a priority system.

Create a lookup with search queries and have another search search those queries

Filter out outliers in stats command

Cumulative count of new users over all time (or custom range)

How to overlay 2 searches to generate linechart and area chart?

Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

How do I change the color of a pie graphic for each unique value?

Is there a guide or map to understand Splunk's internal indexes and their log content?

count based on time range

How to Join fields from 2 indexes

Is there a way to capture a value before a matching pattern that comes after a keyword in a different line of a log file ?

Aggregate rate for entire cluster from individual hosts data

timechart with delta command using by clause

How to chart elapsed time performance data from dbquery?

Speed up a duration search?

How to include all results from a joined lookup table, even if the search does not return all matching fields?

using EVAL

How can I override or offset the x-axis values in a Timechart?

Is there a way to do a Splunk query on data spread across different splunk instances?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation