Splunk Search

Community Activity

How to write a search to use regex to extract multiple fields from a log line and find the total count of all matched patterns? I've looked through several of the other questions related to this one, but they were either unanswered, or answered ... by sugitime Explorer in Splunk Search 11-14-2014 0 4	0	4
How to truncate a field value after a regex pattern? How can I truncate a field value after a given pattern. For example, if I am looking at web page logs, how can I tru... by mbolostk Explorer in Splunk Search 11-14-2014 0 4	0	4
How to write the regex to break before my multiline event? I have two types of events. The first type is one-line: Aug 17 2014 00:03:17 IBRA-S-CX600-2 HWCM/4/CFGCHANGE:OID 1.3... by agnonchik Engager in Splunk Search 11-14-2014 0 7	0	7
Regex to remove single quote index=whatever* sourcetype=server earliest=-3d \| table USERNAME CLIENT_VERSION_IN \|where NOT isnull(SU_USERNAME_IN... by allladin101 Explorer in Splunk Search 11-14-2014 0 5	0	5
case and isnull for multiple fields HI, Working on a query that if one field is null then it uses another field and if that field isnull it uses another... by subtrakt Contributor in Splunk Search 11-14-2014 0 4	0	4
Excels' Networkdays equivalent in Splunk Is there an equivalent or something like Networkdays from excel in Splunk?? I want to calculate the duration between ... by jhlopez Explorer in Splunk Search 11-14-2014 0 5	0	5
How to set the color of bars in a bar chart? I need a help. For the below mentioned bar chart, I want to change the colors of bar. Like: No_of_Mod_Ops = 1 and... by santosh_hb Explorer in Splunk Search 11-14-2014 0 1	0	1
Why is the same search query used before & after the appendcols command producing different results in those 2 columns? When I run "index=abc \| table bytes \| head 10", it returns: bytes 1665 1369 2252 893 3920 356 1803 1718 2833 533 Ho... by kelvin56887 Explorer in Splunk Search 11-14-2014 0 1	0	1
How can I get actual host names or IPs for Rapid7 Nexpose data in Splunk? The Nexpose app uses the API to get data into Splunk. The problem is that the vulnerability events don't have actual ... by dshpritz SplunkTrust in Splunk Search 11-13-2014 1 2	1	2
How to sort by row totals from highest to lowest? Hi Folks, I'm having problems sorting a chart. I want to take the overall totals in one row and sort by that. Here's ... by jravida Communicator in Splunk Search 11-13-2014 0 9	0	9
How to display a table with bandwidth by category for Cisco WSA data? Hi everyone, I have a Splunk server receiving Cisco WSA data. I need to display in a table bandwidth by category, fo... by rubeniturrieta Communicator in Splunk Search 11-13-2014 0 4	0	4
How to search multiple indexes and join field values that don't exactly match? Hi, I need to search in multiple indexes but the field values won't match exactly so a straight join will not produc... by StormTrooper New Member in Splunk Search 11-13-2014 0 5	0	5
How to build a regex for a field extraction that will match a portion of the domain for the field? I'm looking at sendmail logs and I'm trying to pull out a portion of the domain name based on the relay. I've testi... by matoch New Member in Splunk Search 11-13-2014 0 6	0	6
Is there a way to determine if transactions overlap? Is there a way to determine if transactions overlap, and if so which transactions? If so, can any interesting things... by RVDowning Contributor in Splunk Search 11-13-2014 1 2	1	2
What are the benefits of the KV store vs a traditional lookup table in Splunk 6.2? I've been reading over the 6.2 documentation for the KV store and I'm not entirely clear on what the benefits are com... by responsys_cm Builder in Splunk Search 11-13-2014 7 5	7	5
Using a subsearch to match a string and a field. Hi, In one of my indexes I've got a series of pipe separated fields which has one value expressed as so: 31.22:88.9... by howyagoin Contributor in Splunk Search 11-13-2014 0 3	0	3
Reusable knowledge objects Fields created using the below methods will persist as a knowledge objects and are reusable in multiple searches ? ... by splunker12er Motivator in Splunk Search 11-13-2014 0 7	0	7
Piping/nesting Transactions - is it possible? Problem: I need to carry out a time-based correlation across three chained sourcetypes, sourcetype A and sourcetype ... by malat_UoM Explorer in Splunk Search 11-12-2014 0 3	0	3
Find like strings to detect phishing I would like to run a search on my logs so they detect fuzzy like strings. So in my current example we received a phi... by jmsiegma Path Finder in Splunk Search 11-12-2014 0 1	0	1
Field Extractions off host name Hello, Our naming convention has a relatively strict set of rules on it. e.g. datacenter+envionmentnumber+securit... by daniel333 Builder in Splunk Search 11-12-2014 0 2	0	2
How to write a search to return hosts that have no results in a map search? I have a search, lets say: sourcetype=foo earliest=-1d@d \| map search="search host=$host$ earliest=@d sourcetype=bar... by ollie920049 Path Finder in Splunk Search 11-12-2014 0 2	0	2
How can I extract a field value from a folder name? I have a file that Splunk monitors stored in F:/xxx/2014/file.csv. Is there any way to dynamically take the 2014 fold... by jamesvz84 Communicator in Splunk Search 11-12-2014 0 1	0	1
How to search for and remove indexes in Splunk that are not being used/searched by users? Ideally I'd like to search Splunk to determine if anyone is searching a particular index. My use case is that I'd li... by biff09 Engager in Splunk Search 11-12-2014 0 3	0	3
How do you anonymize two recognized fields in Splunk? Hello Splunkers, I am trying to follow the logic from the below URL to anonymize some field data on the fly. http://... by dmacgillivray Communicator in Splunk Search 11-12-2014 0 3	0	3
How to extract a complex field I have a log that has the following: Blah blah bloh HandleBusInfoMessage=31951592=460892.509; nextcommand Blah Handle... by mfscully Explorer in Splunk Search 11-12-2014 0 4	0	4

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Splunk Search

How to write a search to use regex to extract multiple fields from a log line and find the total count of all matched patterns?

How to truncate a field value after a regex pattern?

How to write the regex to break before my multiline event?

Regex to remove single quote

case and isnull for multiple fields

Excels' Networkdays equivalent in Splunk

How to set the color of bars in a bar chart?

Why is the same search query used before & after the appendcols command producing different results in those 2 columns?

How can I get actual host names or IPs for Rapid7 Nexpose data in Splunk?

How to sort by row totals from highest to lowest?

How to display a table with bandwidth by category for Cisco WSA data?

How to search multiple indexes and join field values that don't exactly match?

How to build a regex for a field extraction that will match a portion of the domain for the field?

Is there a way to determine if transactions overlap?

What are the benefits of the KV store vs a traditional lookup table in Splunk 6.2?

Using a subsearch to match a string and a field.

Reusable knowledge objects

Piping/nesting Transactions - is it possible?

Find like strings to detect phishing

Field Extractions off host name

How to write a search to return hosts that have no results in a map search?

How can I extract a field value from a folder name?

How to search for and remove indexes in Splunk that are not being used/searched by users?

How do you anonymize two recognized fields in Splunk?

How to extract a complex field

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Event Series: Telemetry Pipeline Management

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation