Splunk Search

Discussions

Thread Info

Is there a way to email more than 10K results

sendemail command limits to 10k events. This number makes my automates search emails imcomplete. Is there anywhere I ...

by Path Finder in

newlines in stats command failure with savedsearch

I've discovered that if you have newlines in a stats command in a savedsearch like this: | stats values(blah), l...

by Splunk Employee in

matching logs

we have two log files one is ids logs and another is waf we want to check for source address which are common in b...

by New Member in

question regarding correlating two different device logs

hiii we are having waf and ids the ip passes from ids and waf so i need to correlate the ip address and name field...

by New Member in

Too many search jobs found in the dispatch directory (found=28834, warning level=2000). This could negatively impact Splunk's performance, consider removing some of the old search jobs.

The above warning message is displayed in th GUI with the following error message: [JobManager module] Splunkd dae...

by Path Finder in

find logs for IP Address

hello, I want to search proxy logs for 2 different area of ip address ? (like from x.x.x.x to y.y.y.y and from x1.x2....

by Explorer in

Reduce a result set using the foreach splunk search command

The result of a splunk query is the following: Result set 1: method success failures Over_method1 Over_m...

by Motivator in

Custom Search Lite app

I have an odd requirement where I want to limit the index, source or sourcetype for my end users. I have had a qui...

by Path Finder in

Ideas on a timechart with large volume

Hi! I have a timechart that run every ten minutes but the event volume is very high and sometimes the query won't com...

by Contributor in

Redefining MAX size for production indexes

Hello all, I am helping a partner who have a couple of indexes very closed to the MAX limit. They want to re-d...

by Splunk Employee in

Concatenate onto Regex

I'm trying to concatenate something onto one of my regex's. ie: index=eph | rex "EPH(?P<EPHID>\d+)" | table EPH...

by Path Finder in

operations on field values within multiple rows of the same source

I have one source and I need to use the field values from multiple rows to come up with an average. I have the data a...

by New Member in

Standardizing Account_Name for Event 4769 to match others?

I'm trying to use EventCode 4769 along with several other EventCodes in a search and am running into the problem that...

by SplunkTrust in

Search users who access url1, url2 but not url3

I am analyzing Apache web access log and want to search all clientip who accessed url1, url2 but not url3. Meanwhile,...

by New Member in

Is there a way to use wildcards or regex in lookup csv file?

Hello Following up on a previous question about lookups I am looking for a way to either use or simulate wildcards...

by Communicator in

lookup file not queried?

Hello I have a search which reports a field N_os (a string indicating an Operating System). I wanted values from t...

by Communicator in

props/transforms combination not working since switching from indexing locally forwarding

props.conf: [pbs:status] TRANSFORMS-pbs_set_host = pbs_set_host BREAK_ONLY_BEFORE = (^name1|^name2|^name3|^name4|^nam...

by Contributor in

Execute regex based on condition

I have to display the counters starting with # and also % if the sourcetype is "PerfmonMk:.Net CLR Exceptions" and fo...

by Explorer in

Specific time of the day search for the past 6 months

Hi There, Currently I'm using Splunk 4.3. Need help on how to write a query to specify a timeframe so that i ge...

by New Member in

Streamstats And Timechart

Hi - Trying to sort by highest URL count, limit to 12(prevent "other" in the time-chart) and then time-chart. Thanks...

by Contributor in

Merge Related Data From Two Different Sourcetypes Into One Row of A Table

Here's the query I have that is getting results from two sourcetypes: index=bro (sourcetype=bro_files OR sourcetyp...

by Explorer in

Regular Expression (RegEX) Extracting Field from String Contains

Hi, I'm trying to extract the third comma deliminated column with the string "ABC" in it. example data: QWE ...

by Explorer in

I need help regarding to search in splunk, I am new to splunk please help me.

by New Member in

Sum Total File Size By Year

I have the following data: TimeFileNameFileSize5/4/2010stuff.txt1517/15/2010whatever.txt2526/5/2011things.txt3536/...

by Path Finder in

How to print a static value to a single element panel?

Hi there, I am trying to use a single element panel as a key for understanding the other single element panels whi...

by Path Finder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Is there a way to email more than 10K results

newlines in stats command failure with savedsearch

matching logs

question regarding correlating two different device logs

Too many search jobs found in the dispatch directory (found=28834, warning level=2000). This could negatively impact Splunk's performance, consider removing some of the old search jobs.

find logs for IP Address

Reduce a result set using the foreach splunk search command

Custom Search Lite app

Ideas on a timechart with large volume

Redefining MAX size for production indexes

Concatenate onto Regex

operations on field values within multiple rows of the same source

Standardizing Account_Name for Event 4769 to match others?

Search users who access url1, url2 but not url3

Is there a way to use wildcards or regex in lookup csv file?

lookup file not queried?

props/transforms combination not working since switching from indexing locally forwarding

Execute regex based on condition

Specific time of the day search for the past 6 months

Streamstats And Timechart

Merge Related Data From Two Different Sourcetypes Into One Row of A Table

Regular Expression (RegEX) Extracting Field from String Contains

I need help regarding to search in splunk, I am new to splunk please help me.

Sum Total File Size By Year

How to print a static value to a single element panel?

Enterprise Security Content Update (ESCU) | New Releases

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

Improve Data Pipelines Using Splunk Data Management

Splunk DB connect add-on InfluxDB 2.6

openshift_events sourcetype suddenly missing in S...

Issue with StateSpaceForecast from the MLTK app

Notepad++ SPL syntax highlighting

How to splunk api to get statistics in python