Splunk Search

Community Activity

efficient way of comparing with historic events using percentile Hi, I have a query that is meant to compare longitudinal count of an event of a given day (e.g. today) with historic... by kundeng Path Finder in Splunk Search 06-19-2014 0 3	0	3
Extract Field Dear All, I have oracle error data i need to extract some fields from it here is the data [EntID: ] 17-Jun-2014, 07... by gajananh999 Contributor in Splunk Search 06-19-2014 0 6	0	6
How does rule based sourcetype works? In the below stanzas , both are having same source-type names, how the priority will be in assigning sourcetype? Has... by splunker12er Motivator in Splunk Search 06-19-2014 0 1	0	1
how to exclude a certain field value from results Search query: list the last known user (userid) on each host. sourcetype=syslog source=/var/log/secure "pam_unix(ssh... by ayenumula Explorer in Splunk Search 06-18-2014 2 4	2	4
Multiline Regex trouble - Can't get fields to be associated with keys Hi, I am in great troubles with a multilines events i'm trying to analyse, and associated required regex to extract ... by guilmxm Influencer in Splunk Search 06-18-2014 0 8	0	8
Use a Function without Running a Search Hey guys, is it possible to run an eval function in the search bar without piping a search to it? In an attempt to t... by pfernandez133 Explorer in Splunk Search 06-18-2014 0 4	0	4
How to get sum and charts of usage time values for corresponding fields? I'm using splunk 6.0.3 When I search for: "has been closed after being in use" I have a series of hits like shown i... by fziegler New Member in Splunk Search 06-18-2014 0 2	0	2
How to display timechart as area chart over last 4 hours with span of 1 hour? I will try my best to formulate my question as I couldn't find anything similar asked already. I am trying to displa... by ateterine Path Finder in Splunk Search 06-18-2014 0 9	0	9
Displaying the count of events over varying time spans All, I want to create a search that will return the count of events over the last 5 minutes, 30 minutes, hour, 6 hou... by bruceclarke Contributor in Splunk Search 06-18-2014 1 4	1	4
Report new users each month trended - large time range Hi, I have a request to trend new users on a web application by month over a two year period and produce this report... by DanielFordWA Contributor in Splunk Search 06-18-2014 0 2	0	2
Field extraction for logs with slightly different field position based on the servername Hi All Here are my sample logs _time prod-server-1234 web_access 10.11.12.13 "GET /json/some_search?asasa HTTP/1.1" ... by splunk_worker Path Finder in Splunk Search 06-18-2014 1 2	1	2
Overlapped events in summary index when using sitimechart Hi, i'm using splunk 6.1.1 I made this si- search and scheduled it to run "every hour" at period -1h@m to "now" .. ... by ejpulsar Path Finder in Splunk Search 06-18-2014 0 6	0	6
How to sort events by number of occurances? I'm trying to do "[Simple text search]" \| top limit=50 count To so the 50 highest occurrences of my search for whi... by letharion Engager in Splunk Search 06-18-2014 0 1	0	1
Error using lookup table Hello I am running the following search with the end aim of using the 'map' functionality to plot the results but wh... by ahogbin Communicator in Splunk Search 06-17-2014 0 1	0	1
How to rename _time column How to rename the _time to TIME in the below query: \|inputlookup currentesdorders.csv \| dedup ORDER_NUMBER \| where O... by webnair Explorer in Splunk Search 06-17-2014 2 3	2	3
How can I add new columns and name them by result or subsearch? Hi! I would like to draw a chart with stacked bars , but I don't know how to add columns depend on result. for exampl... by millie Engager in Splunk Search 06-17-2014 1 2	1	2
Limiting Forwarding Throughput Hi, We are trying to limit the maxKBps of a couple forwarders to 30 KBps. We are doing this because the app on those ... by AppServices Explorer in Splunk Search 06-17-2014 1 7	1	7
How to get sum for unique field values? Hi, I saw that there is dc so we can get the distinct count but what if I want to get the sum for unique field value... by xvxt006 Contributor in Splunk Search 06-17-2014 1 2	1	2
Chart column widths How do I specify a minimum width for columns in a column chart? The documentation very usefully says columnStyle sty... by chrmcq Explorer in Splunk Search 06-17-2014 2 9	2	9
Sorting the stats values results by count, and include count in results I am trying to get a search result that shows a single IP associated with all of its user agents, but I would like th... by soundchaos Path Finder in Splunk Search 06-17-2014 1 5	1	5
Return fields from subsearch but not used as filter in outer search Hi all, can I return fields from subsearch but not used as filter in outer sesarch? Assuming the log1 contains fiel... by stwong Communicator in Splunk Search 06-17-2014 0 1	0	1
variable fields - re-arrange (tranpose) variables fields into one field for data aggregation Hi, I have data indexed with variable fields (csv data indexed as csv by Splunk) such as: timestamp device1 device2... by guilmxm Influencer in Splunk Search 06-17-2014 1 10	1	10
Is there a way to email more than 10K results sendemail command limits to 10k events. This number makes my automates search emails imcomplete. Is there anywhere I ... by suhprano Path Finder in Splunk Search 06-17-2014 4 7	4	7
newlines in stats command failure with savedsearch I've discovered that if you have newlines in a stats command in a savedsearch like this: \| stats values(blah), lis... by sloshburch Ultra Champion in Splunk Search 06-17-2014 1 1	1	1
matching logs we have two log files one is ids logs and another is waf we want to check for source address which are common in bot... by somu2014 New Member in Splunk Search 06-17-2014 0 1	0	1