Splunk Search

Community Activity

count by percentage Hi, we're trying to find out windows XP users with some rules: if mod=syn, get client ip (cli)if mod=syn+ack, get se... by stwong Communicator in Splunk Search 06-19-2014 0 6	0	6
Search time field extraction not showing in available fields I am attempting to perform a search time field extraction via the rex command. I use the default field of _raw and g... by dkichline Engager in Splunk Search 06-19-2014 0 3	0	3
inline stats without subsearch This is a recurring problem for me in SPL. I want to assign some stats command results to a variable name and pop th... by proletariat99 Communicator in Splunk Search 06-19-2014 0 1	0	1
metadata: how to find the most recent event for each host in each index? i have 50 indexes and i want to find out the last most recent event for each host in each index. i can do this for e... by robf Path Finder in Splunk Search 06-19-2014 1 6	1	6
how to get the value of field if another field has same value in particular time period HI, I have data like below, Source_Address Event_Code Time User 10.10.10.010 4625 6/17/2014 0... by thambisetty SplunkTrust in Splunk Search 06-19-2014 0 14	0	14
efficient way of comparing with historic events using percentile Hi, I have a query that is meant to compare longitudinal count of an event of a given day (e.g. today) with historic... by kundeng Path Finder in Splunk Search 06-19-2014 0 3	0	3
Extract Field Dear All, I have oracle error data i need to extract some fields from it here is the data [EntID: ] 17-Jun-2014, 07... by gajananh999 Contributor in Splunk Search 06-19-2014 0 6	0	6
How does rule based sourcetype works? In the below stanzas , both are having same source-type names, how the priority will be in assigning sourcetype? Has... by splunker12er Motivator in Splunk Search 06-19-2014 0 1	0	1
how to exclude a certain field value from results Search query: list the last known user (userid) on each host. sourcetype=syslog source=/var/log/secure "pam_unix(ssh... by ayenumula Explorer in Splunk Search 06-18-2014 2 4	2	4
Multiline Regex trouble - Can't get fields to be associated with keys Hi, I am in great troubles with a multilines events i'm trying to analyse, and associated required regex to extract ... by guilmxm Influencer in Splunk Search 06-18-2014 0 8	0	8
Use a Function without Running a Search Hey guys, is it possible to run an eval function in the search bar without piping a search to it? In an attempt to t... by pfernandez133 Explorer in Splunk Search 06-18-2014 0 4	0	4
How to get sum and charts of usage time values for corresponding fields? I'm using splunk 6.0.3 When I search for: "has been closed after being in use" I have a series of hits like shown i... by fziegler New Member in Splunk Search 06-18-2014 0 2	0	2
How to display timechart as area chart over last 4 hours with span of 1 hour? I will try my best to formulate my question as I couldn't find anything similar asked already. I am trying to displa... by ateterine Path Finder in Splunk Search 06-18-2014 0 9	0	9
Displaying the count of events over varying time spans All, I want to create a search that will return the count of events over the last 5 minutes, 30 minutes, hour, 6 hou... by bruceclarke Contributor in Splunk Search 06-18-2014 1 4	1	4
Report new users each month trended - large time range Hi, I have a request to trend new users on a web application by month over a two year period and produce this report... by DanielFordWA Contributor in Splunk Search 06-18-2014 0 2	0	2
Field extraction for logs with slightly different field position based on the servername Hi All Here are my sample logs _time prod-server-1234 web_access 10.11.12.13 "GET /json/some_search?asasa HTTP/1.1" ... by splunk_worker Path Finder in Splunk Search 06-18-2014 1 2	1	2
Overlapped events in summary index when using sitimechart Hi, i'm using splunk 6.1.1 I made this si- search and scheduled it to run "every hour" at period -1h@m to "now" .. ... by ejpulsar Path Finder in Splunk Search 06-18-2014 0 6	0	6
How to sort events by number of occurances? I'm trying to do "[Simple text search]" \| top limit=50 count To so the 50 highest occurrences of my search for whi... by letharion Engager in Splunk Search 06-18-2014 0 1	0	1
Error using lookup table Hello I am running the following search with the end aim of using the 'map' functionality to plot the results but wh... by ahogbin Communicator in Splunk Search 06-17-2014 0 1	0	1
How to rename _time column How to rename the _time to TIME in the below query: \|inputlookup currentesdorders.csv \| dedup ORDER_NUMBER \| where O... by webnair Explorer in Splunk Search 06-17-2014 2 3	2	3
How can I add new columns and name them by result or subsearch? Hi! I would like to draw a chart with stacked bars , but I don't know how to add columns depend on result. for exampl... by millie Engager in Splunk Search 06-17-2014 1 2	1	2
Limiting Forwarding Throughput Hi, We are trying to limit the maxKBps of a couple forwarders to 30 KBps. We are doing this because the app on those ... by AppServices Explorer in Splunk Search 06-17-2014 1 7	1	7
How to get sum for unique field values? Hi, I saw that there is dc so we can get the distinct count but what if I want to get the sum for unique field value... by xvxt006 Contributor in Splunk Search 06-17-2014 1 2	1	2
Chart column widths How do I specify a minimum width for columns in a column chart? The documentation very usefully says columnStyle sty... by chrmcq Explorer in Splunk Search 06-17-2014 2 9	2	9
Sorting the stats values results by count, and include count in results I am trying to get a search result that shows a single IP associated with all of its user agents, but I would like th... by soundchaos Path Finder in Splunk Search 06-17-2014 1 5	1	5