Splunk Search

Community Activity

How to use regex in field extraction? I can't seem to get my regex to work as a field extraction. below is an example string and the regex I'm trying to u... by digital_alchemy Path Finder in Splunk Search 06-11-2014 1 2	1	2
Splunk/eval ignores real numbers less than 1.0 Splunk seems to be ignoring numbers less than 1.0 regardless of incoming precision. If my tField value is 1.000 or g... by nysoitsmiket Explorer in Splunk Search 06-11-2014 0 4	0	4
Show only NON distinct values for a given field. I am looking to compare a list of non unique usernames with unique IP's, and specifically analyze the occurences wher... by soundchaos Path Finder in Splunk Search 06-11-2014 1 2	1	2
how to add a string to a table element? Hello I have two fields field1 and field2 extracted from my search and I would like to present then in a table, with... by wsw70 Communicator in Splunk Search 06-11-2014 1 1	1	1
Asset Discovery I've noticed on the dashboard that the scan isn't detecting any particular OS - leaving it as unknown for most of the... by tmccool New Member in Splunk Search 06-11-2014 0 1	0	1
How to compute time range spread over multiple files. Hi Everyone, I want to calculate availability time range of each employee based on the records present in two files (... by sanjeevdixit Explorer in Splunk Search 06-11-2014 1 2	1	2
not all real-time-alert emails are being sent Hi, I have very odd situation, all but one realtime alert are working fine. One alert which flags up the 404s works... by michal_centralw Explorer in Splunk Search 06-11-2014 0 3	0	3
handle ' as field delimiter in logs I have logs that are generally fine and log in key=value pairs - however it uses a strage format Sample: rmIP='195.1... by dominiquevocat SplunkTrust in Splunk Search 06-11-2014 0 3	0	3
How to get "duration" without use transaction transaction関数を使用すれば、グルーピングしたログの間隔（duration）を取得出来ますが、transactionを使用しない場合のduration取得方法をご教授頂けますでしょうか。下記のログを用いてPCの操作時間の... by pisc Explorer in Splunk Search 06-11-2014 0 3	0	3
Change orientation of X axis labels in simple XML chart Hi, I have a simple XML dashboard which displays a line chart. Because of large data set, the X axis labels of chart... by harshal_chakran Builder in Splunk Search 06-11-2014 0 2	0	2
calculate last 1 hr events for last one week Hi I want to calculate the last 1 hour events for the past week at any given point of time. Support now the time is ... by jayannah Builder in Splunk Search 06-11-2014 0 8	0	8
Filed transformation / regex help I could use some help creating a field transform. A sample log entry: 192.168.2.1 Bubba Joe [10/Jun/2014:13:34:26 -... by jdziedzic New Member in Splunk Search 06-11-2014 0 1	0	1
Join 2 search - Want to display both common and non-common values index=abc earliest=-7d@d latest=-6d@d action=commit_success \| stats count as SUCCESS by user Gives the result: user ... by jayannah Builder in Splunk Search 06-10-2014 0 1	0	1
Count occurrences of values for a field For below, I'd like to list the number of times a 'type' exists, that is, 1 PDF, 1 GIF, 2 JPG and 6 PNG. There is mo... by RB5 Path Finder in Splunk Search 06-10-2014 0 1	0	1
Adding python script to search app I have python script I want to add to the search app in splunk 5.0.3, I found some documentation: http://docs.splunk... by bkirk Path Finder in Splunk Search 06-10-2014 0 3	0	3
How to perform search among multiple instances based on instance name? I run multiple instances of the same application on a server. Each instance generates its own set of log files, and ... by cdavistt New Member in Splunk Search 06-10-2014 0 1	0	1
Splunk 6 :: Form search query is running on form load ?? Hi All, Not Sure why this has been running in Splunk 6 like this. I have a form with a timepicker and search button.... by rakesh_498115 Motivator in Splunk Search 06-10-2014 1 4	1	4
Timing inner transactions I Have transactions within transactions, namely something like the following: PlanId, [OPEN PLAN START] Action="AAA"... by RVDowning Contributor in Splunk Search 06-10-2014 0 3	0	3
Chart - show rows only where one field is greater than zero Hi, I'm building a chart of customers and what operating system they're using: chart count(_raw) by customer,ua_pla... by robertlabrie Path Finder in Splunk Search 06-10-2014 1 2	1	2
Count per minute over 7 day period, graphed I am trying to graph distinct count per minute over a 7-day period. I have a search that will give me the correct res... by pontorito Explorer in Splunk Search 06-10-2014 0 3	0	3
How to remove using regex in field extraction Hi, I have to do field extraction on the following data. **2014/02/02 10:10:10 level - test Can please help to g... by reach2tushar Explorer in Splunk Search 06-10-2014 0 1	0	1
Detecting attacks on web sites/applications We have number of external facing web sites/applications which are often being targeted, using different attacks. I w... by Kishorebk New Member in Splunk Search 06-10-2014 0 3	0	3
Transitive Transaction attributes Hi there, I'm doing analysis on file transfer logs from different transfer system. I want to follow the file through... by bleinfelder Path Finder in Splunk Search 06-10-2014 0 1	0	1
how to take timestamp from this Dear all, I need your help to how to remove timestamp from this field. 2014-05-19T03:25:26.000-04:00 There is TO w... by gajananh999 Contributor in Splunk Search 06-10-2014 0 4	0	4
Find index retention stats Hi, I would like to get the following stats in a distributed index setup: index name, current size of index (sum all... by shankern Explorer in Splunk Search 06-10-2014 0 3	0	3