Splunk Search

Community Activity

How can I search for an exact match in the raw text of an event? I currently have a search that kinda works for what I need but it returns a lot of false positives. Example: Say I ... by digital_alchemy Path Finder in Splunk Search 07-30-2014 1 3	1	3
How to exclude equal values at the same field? Hello Splunkers, I need a little help to exclude similar values at the same field in a search: ....\| search Comput... by iabreu New Member in Splunk Search 07-30-2014 0 6	0	6
Search and rename as permanent fields in index? I would like to extract and store data in a new fields so that I don't have to define a conditional statement each ti... by david_rundle_fi Explorer in Splunk Search 07-30-2014 0 10	0	10
How to put field values in a table to call in a search instead of using OR boolean directive? I am currently using the below query... index=a field1="ABC" \| join id [Search index=a AND (field2="B" OR field2="C" ... by edookati Path Finder in Splunk Search 07-30-2014 0 1	0	1
How to extract string in a field that spans multiple lines? I'm trying to extract a string in a field that spans multiple lines. See example below. 03/09/2014 07:10:38 AM - Pro... by jedatt01 Builder in Splunk Search 07-30-2014 1 5	1	5
Average Timespan I have a large amount of logs in the following format: 2014-07-30 14:23:51,802 - MyApp - 6 - INFO - Performance - pr... by RagtimeWilly Explorer in Splunk Search 07-30-2014 1 6	1	6
Transaction not providing all events in target range. Howdy: I'm a new Splunker so this may be a dumb question. I have looked around splunk>Answers and couldn't find a sol... by jlacal Explorer in Splunk Search 07-30-2014 0 1	0	1
Grouping and counting by field Hey, I'm looking for a little advice. I'm trying to produce a report showing how many events of a particular type (w... by mjmcloughlin Engager in Splunk Search 07-30-2014 1 2	1	2
inputlookup - Is it possible to pass lookup table size to return command? Hi everyone, I am trying to find a way count the lines inside a lookup table and pass it to the return command. For... by rolaso Explorer in Splunk Search 07-30-2014 1 2	1	2
Error in 'lookup' command: The lookup table 'test_lookup' does not exist. Below is the transforms.conf at $SPLUNK_HOME/etc/local: [test_lookup] filename=test.csv And I uploaded test.csv (a... by zliu Splunk Employee in Splunk Search 07-29-2014 5 2	5	2
How to populate a dropdown with file extensions extracted from a search? I want my users to be able to chose a file extension from a drop down that is populated with a search. I was thinking... by dreamwork801 Path Finder in Splunk Search 07-29-2014 1 5	1	5
Find Transaction time with same startswith log string. Hi, I need to find the transaction time between these 2 statements which has same startswith Log strings(different e... by sethuk555 Engager in Splunk Search 07-29-2014 0 1	0	1
Create a gauge where the maximum references count in one database and needle references count in 2nd database? Hello Splunkers, I'm processing results of an asset database search. I have one database that is the 'reference' data... by lbogle Contributor in Splunk Search 07-29-2014 0 5	0	5
What is the command/syntax to specify a day of the week for searching? What is the proper command/syntax to specify a day of the week for searching (converting date/timestamp)? example: i... by jlkokko Path Finder in Splunk Search 07-29-2014 1 7	1	7
Creating Pivot Chart with two sums? I am feeling more and more like the new Pivot UI functionality is way too limiting. Can anyone help me to do a query ... by EricLloyd79 Builder in Splunk Search 07-29-2014 0 2	0	2
How to join 2 searches and control table output to remove rows with null field values? I am using the below query to join 2 searches, but the table is showing me duplicate rows with only common_fields and... by edookati Path Finder in Splunk Search 07-28-2014 1 4	1	4
How to graph a line chart of two field values over time from a csv log file? Hello Splunkers, I feel like I have the most basic of questions here but I can't get it to work. I have a .csv log fi... by lbogle Contributor in Splunk Search 07-28-2014 1 2	1	2
How to combine results of a Distinct Count with a ctable query in a table? I have sendmail logs which have an action field which can be DELIVER, DROP or QUARANTINE. What I am trying to do is ... by dabunn Engager in Splunk Search 07-28-2014 1 3	1	3
Cant get line break \n to create new lines between results when emailed? I know I must be missing something simple and have searched here trying multiple things but still can't get this to w... by dlespron Path Finder in Splunk Search 07-28-2014 1 1	1	1
Errors feeding Arcsight with Splunk search results using Splunk Real-Time Output app I am trying to feed Arcsight with the results of a Splunk search using the real time output app. I get the following... by Thuan Explorer in Splunk Search 07-28-2014 0 1	0	1
Field Extraction to Modify Key in Key Value Pair at Search Time How can I create a field extraction to modify a key in a key value pair? I have a new file that I am indexing. The ke... by ezajac Path Finder in Splunk Search 07-28-2014 0 3	0	3
LogFile Troubleshooting - read file issue I am working in a single node environment (indexer is also deployment-server)and I am having trouble determining why ... by JoeSco27 Communicator in Splunk Search 07-28-2014 0 3	0	3
How do I control returned fields from a join? This issue continually bites me and there's something I'm just not understanding. If I search like so: sourcetype=... by LordVoldemort Explorer in Splunk Search 07-28-2014 0 5	0	5
How to group events by the same field value? Hello, I hope there is someone who can help me solve this problem. I'd like to know how to group events shown as fo... by TBo123 Path Finder in Splunk Search 07-28-2014 1 2	1	2
DBQUERY correlation -- How to join results from DB Hi, I get the user_id info from web log and would like to enrich data from the connected DB in Splunk. I tried the... by shangshin Builder in Splunk Search 07-28-2014 1 5	1	5