Splunk Search

Community Activity

Have Multiple REGEX in Transforms Hi All, I was wondering how you go about sending different criteria to the null que and whether the below would work... by Scarecrowddb Explorer in Splunk Search 10-14-2014 2 3	2	3
Multiple matchs (AND) in transform.conf REGEX Hi, I want to filter some events based on the occurence of multiple matchs, for instance, I want to match all (Windo... by arabii Engager in Splunk Search 10-14-2014 1 3	1	3
Search cluster operator drill down issue I searched the error events and use the "cluster" operator as below: error \| cluster \| table cluster_count _raw I... by liyiou New Member in Splunk Search 10-14-2014 0 4	0	4
How to reference a string variable in a search to avoid retyping it? This is the search that I'm trying to do but it does not return anything. I'm trying to create a string variable and ... by rpolanco New Member in Splunk Search 10-14-2014 0 6	0	6
How to group events by host name and display the most recent "Message" field value from each group? If I have fields such as: _time = timestamphost = the host nameMessage = either "up" or "down" How do I group by th... by ardave Explorer in Splunk Search 10-14-2014 1 2	1	2
How to get statistics on user log in duration I have two types of logs in my files that record when a user logs in and logs out. They are of the form: Session <nu... by Splunkster45 Communicator in Splunk Search 10-14-2014 0 1	0	1
transforms.conf extract part of sourcepath Hello Splunkers! My eventdata places on folders: /folder1/subfolder1/123/log1.log /folder1/subfolder1/234/log2.log ... by ryastrebov Communicator in Splunk Search 10-14-2014 0 4	0	4
How to search if a user in Log A also appears in Log B? Hi community, propably a simple question, but I still hanging. I need a search over two logfiles, which shows me all... by eichfuss Path Finder in Splunk Search 10-14-2014 0 2	0	2
Combine 2 searches that have a subsearch I want to get all events related to dnis=27159866 I can perform this by getting all the events with a sessionid or pa... by ludowillemans Explorer in Splunk Search 10-14-2014 0 3	0	3
How to build a drop-down with a default automatic span for a timechart in a simple XML dashboard in Splunk 4.3.6? I'm building a drop-down menu for picking the timechart span in simple dashboard. By default I'd like to have automat... by giovere Path Finder in Splunk Search 10-14-2014 0 1	0	1
How to update a lookup table using REST API? Hi all Hope someone can help me with this. I am building a custom application, which extracts data from a db and sa... by polymorphic Communicator in Splunk Search 10-14-2014 0 1	0	1
Why search query works in Search app, but is not working in a dashboard? Hi My search : index="abc" (source="tac.log" DebugLevelSrc=xxx "ccc") OR (source="crt.log" DebugLevelSrc=xxx "*... by prad18 Path Finder in Splunk Search 10-13-2014 1 4	1	4
Setting fields from logs with different row values Hello everybody, I have a question that might have been responded before but I have a log file from a server that lo... by juancarlos_pola Explorer in Splunk Search 10-13-2014 0 3	0	3
Splunk SPL help... I hope someone can point me in the right direction because I really need help. SPL transforms are anything but easy a... by jtelep New Member in Splunk Search 10-13-2014 0 1	0	1
SearchTemplate + RealTime search to SearchPostProcess Hi. We are trying to create a dashboard in which all the panels use the same information about the current (real tim... by arturoduran Engager in Splunk Search 10-13-2014 0 1	0	1
Grouping similar HI All, Im have a search and its working great for calculating averages based on the domain, the problem is that I w... by brywilk_umich Path Finder in Splunk Search 10-13-2014 0 6	0	6
Is there any way to set a higher default "bins=xxx" for timechart setting? I know I can override the default bins=100 in any particular search. Is there any way to set something slightly high... by Richfez SplunkTrust in Splunk Search 10-13-2014 1 2	1	2
Why is the conversion of duration from seconds to hours in a search automatically adding 18 hours to the value? I'm looking to change the format of the useful duration tool from seconds to hours. I found out how to do this via so... by Splunkster45 Communicator in Splunk Search 10-13-2014 2 4	2	4
Why is virtual index search showing no results found after installing Hunk? Hello guys, I installed hunk and followed its tutorial. I have checked the HDFS location and it seems fine. Hadoop v... by rameez Engager in Splunk Search 10-13-2014 0 1	0	1
Why Splunk query returns values when run as separate search, but is not working as a subsearch? My actual search sourcetype="xyz" Operation=q \| eval msg=if(Status == "fail",[search sourcetype="xyz" Operation="p" ... by tehale New Member in Splunk Search 10-13-2014 0 1	0	1
How Can I Save Three Count Searches Separated And Then Use Them Together Later? I have some conditions for each search as follows: Search A index=users Channel=40 \| eval Token = User."-".Channel... by vtsguerrero Contributor in Splunk Search 10-13-2014 0 10	0	10
Match several sub-urls, regexp I have a set of URLs in a log like so: url1:"POST /stuff/test/" url2: "GET /stuff/test-type?" url:3"POST /stuff/tes... by atanasmitev Path Finder in Splunk Search 10-13-2014 0 2	0	2
Search query for permon counter Hi All, we had configured splunk to get the perfmon counter data from server (every 5mins). The counter value gets r... by rsathish47 Contributor in Splunk Search 10-12-2014 0 2	0	2
How to identify users (UID) that use program A, but have never used program B? I've got users using 2 apps that I'm pulling from, and I'm looking at login reports. Given that the users have unique... by Cox_JoshS Explorer in Splunk Search 10-12-2014 1 4	1	4
piping events from a custom generating command into timechart results in irregular buckets when not using all-time I have 26 days of events (Monday 9/15 through Friday 10/10) piped to a timechart span=7d. I'd like to have 3 buckets... by ruman Splunk Employee in Splunk Search 10-11-2014 2 13	2	13