Splunk Search

Community Activity

How to join two sets of data on a field and get the results that don't have corresponding matching data? I have two sets of data, both sets have a common field with common value, when i use join command i am able to find t... by mohankesireddy Path Finder in Splunk Search 10-21-2014 1 2	1	2
Can the universal forwarder monitor event logs and filter out events using regex in whitelist? Can the universal forwarder monitor event logs and filter out events using REGEX in whitelist for eg: [WinEventLog://... by menonmanish Path Finder in Splunk Search 10-21-2014 0 1	0	1
how to replace a multiple character to one character Hi, I want to replace all ":*" character means :: ::: :::: and so on with only singel ":" character. for Location fi... by abhayneilam Contributor in Splunk Search 10-21-2014 2 6	2	6
How to combine and chart data from multiple files in the same folder, but only if a certain type of file exists? Hi, I am new to splunk and need help with my use case below. Whenever a request is made to my application, it will c... by avinashreddy539 New Member in Splunk Search 10-21-2014 0 3	0	3
Searching transactions for field/values set in the same event I have records of 3 forms: {<!-- --> "event": "START\|MIDDLE\|END", "wasSuccessful": true/false, "trans_id": <int>... by abelnation Explorer in Splunk Search 10-21-2014 1 2	1	2
How to write a search for the most occurring field value per record and calculate their probability percentage? Device Table1 Table2 Table3 Table4 Table5 Name1 XP XP XP XP XP Name2 7 7 XP Null ... by sshkaya3344 Engager in Splunk Search 10-21-2014 2 3	2	3
How to create an eval column in a table that says "yes" or "no" if the value in another column has changed from the previous row? I have a table which stores updates done on a database (see my previous questions for more details). I want to create... by sjanwity Communicator in Splunk Search 10-21-2014 1 5	1	5
Which is a faster search strategy for filters on multiple columns? I have a table which returns multiple columns and I want to implement a text filter on each of these columns. Current... by sjanwity Communicator in Splunk Search 10-21-2014 0 4	0	4
Creating a search to take id values from one day, and search for them in the following days Hi, I currently need to create a search which takes the id values from a new_user event on 1 day, then searches for ... by anthony_copus Explorer in Splunk Search 10-21-2014 0 1	0	1
How to convert decimal time to a human readable format in a search? Hello, I've a decimal time in my logs like 1.51 that equal 1h30/1:30 or 4.3 equal 4h20/4:20 So i try to get a norma... by vince2010091 Path Finder in Splunk Search 10-21-2014 0 2	0	2
How to calculate set flags in a numeric value in a search? I have a numeric value representing flags. It is the value in userAccountControl defined as follows: typedef enum {... by dominiquevocat SplunkTrust in Splunk Search 10-21-2014 1 2	1	2
What features will be disabled in trial version of Splunk after 60 days? What features will be disabled in trial version of Splunk after 60 days? And What are the features which Enterprise h... by mrabbani New Member in Splunk Search 10-21-2014 0 1	0	1
I am trying to get a bar chart to display a stats count of each violation split by the request status, so for it to display both, how much was blocked or alerted. What am i doing wrong index="bigip-asm" web_application_name=HTTPCLASS_PROD_SOAENTRYPOINT_EXTERNAL_LIVE request_status=alerted OR blocked \|... by james_westwood Engager in Splunk Search 10-21-2014 0 4	0	4
rex n replace or rex and optional find cs_username field contains multiple formats of username in the form of: username domain\usernam username@domain.com ... by TobiasBoone Communicator in Splunk Search 10-20-2014 0 3	0	3
Calculate Average for multiple fields My logs currently capture transaction summaries. The transaction summaries can have 0 to n number of integration. Fo... by Brittany_Carr Explorer in Splunk Search 10-20-2014 0 3	0	3
How to mask both index and search time data and how to verify if it is masked? How to mask index and search time data? How to verify if it is masked? by ginger8990 Explorer in Splunk Search 10-20-2014 0 2	0	2
Is it possible to tell Splunk to group events based on a column? This is an extension of the question http://answers.splunk.com/answers/171571/using-splunk-to-create-and-view-table-m... by sjanwity Communicator in Splunk Search 10-20-2014 1 11	1	11
Combine searches through field I have a query that pulls up IPs' but with no hostname. I have a separate query that can correlate each IP to a host ... by bigrichie90 Path Finder in Splunk Search 10-20-2014 0 4	0	4
How to search for the most popular purchased item X AND which other item was purchased most often with item X? I would like to search for common product-packages. So I want to look for one item (AAA) and find out which other ite... by upuc Explorer in Splunk Search 10-19-2014 1 7	1	7
WIndows Software Installation: Extract from Message Field Hello, everone. I am new to regular and perl expressions and attempting to extract the Product Name, Product Version... by rmsit Communicator in Splunk Search 10-19-2014 0 2	0	2
Does the time range picker apply the same range to both a primary search and subsearch? If yes, can I override the subsearch time range? I want to know about the scope of time range chosen by time range picker/ In my case, I have two sourcetypes and all ... by oraclebox Explorer in Splunk Search 10-19-2014 1 5	1	5
Compare two fields and select value from 3rd filed if the comparison match I am very new to splunk and need your help in resolving below issue. I have two CSV files uploaded in splunk instanc... by Jayadevanprabha New Member in Splunk Search 10-19-2014 0 1	0	1
Multivalue field combining and dynamic field creation from extraction of values Starting with the data in an event: Lines in Single Event: PosTransactionProperties[1].PosTransactionPropertyCode[1... by jmsiegma Path Finder in Splunk Search 10-18-2014 0 1	0	1
Sum latest entries from multiple sources & timechart as a single line Hello, I have multiple remote performance monitors sources, namely WMI:FOO1, WMI:FOO2 etc. up to and including WMI:F... by justingawn New Member in Splunk Search 10-17-2014 0 4	0	4
How to extract one field combining different substrings of another field I have a pattern in my raw field " ..... SPLIT: 11111:22222 ........." which says master id was split to id1:id2. But... by bharathreddyp Engager in Splunk Search 10-17-2014 0 2	0	2

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community, What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Splunk Search

How to join two sets of data on a field and get the results that don't have corresponding matching data?

Can the universal forwarder monitor event logs and filter out events using regex in whitelist?

how to replace a multiple character to one character

How to combine and chart data from multiple files in the same folder, but only if a certain type of file exists?

Searching transactions for field/values set in the same event

How to write a search for the most occurring field value per record and calculate their probability percentage?

How to create an eval column in a table that says "yes" or "no" if the value in another column has changed from the previous row?

Which is a faster search strategy for filters on multiple columns?

Creating a search to take id values from one day, and search for them in the following days

How to convert decimal time to a human readable format in a search?

How to calculate set flags in a numeric value in a search?

What features will be disabled in trial version of Splunk after 60 days?

I am trying to get a bar chart to display a stats count of each violation split by the request status, so for it to display both, how much was blocked or alerted. What am i doing wrong

rex n replace or rex and optional find

Calculate Average for multiple fields

How to mask both index and search time data and how to verify if it is masked?

Is it possible to tell Splunk to group events based on a column?

Combine searches through field

How to search for the most popular purchased item X AND which other item was purchased most often with item X?

WIndows Software Installation: Extract from Message Field

Does the time range picker apply the same range to both a primary search and subsearch? If yes, can I override the subsearch time range?

Compare two fields and select value from 3rd filed if the comparison match

Multivalue field combining and dynamic field creation from extraction of values

Sum latest entries from multiple sources & timechart as a single line

How to extract one field combining different substrings of another field

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

MLTKC how should i check jupyter notebook func in ...

ITSI thresholds: adaptive vs static

Splunk Search

Are you a member of the Splunk Community?