Splunk Search

Community Activity

dbquery and outputlookup Hello, I'm running a dbquery and would like to save the results as a lookuptable.csv. \| dbquery mysearch \| outputlo... by HeinzWaescher Motivator in Splunk Search 06-04-2014 0 5	0	5
logical grouping of hosts - aggregate stats I have a situation where I want to report on events from 2 sets of servers where i can compare the aggregate counts. ... by desertpilotjc Explorer in Splunk Search 06-03-2014 0 1	0	1
"Unknown country" returned by iplocation? bug? iplocation bug? "UNKNOWN COUNTRY" is returned for ip addresses that actually have a known country? USA 208.65.40.98... by boris Path Finder in Splunk Search 06-03-2014 0 4	0	4
Different values of parameters Hi, I have below variations of uri patterns for a particular functionality. i want to list out query string paramete... by xvxt006 Contributor in Splunk Search 06-03-2014 0 4	0	4
Search to Pull Values from START log I have a search that monitor's failed PO's. Essentially the idea is to monitor the overall state of the txn, and whe... by _gkollias Builder in Splunk Search 06-03-2014 0 2	0	2
How to create an array of values from a field? Hello, I am trying to parse a field like the one below into an array of Key/Value pairs and access each array value ... by naveenurs Explorer in Splunk Search 06-03-2014 0 2	0	2
Two Search Heads One Indexer I have two Splunk instances, a development and a test platform. Can I have them both pointing to the same indexer wit... by kmattern Builder in Splunk Search 06-03-2014 0 7	0	7
Show source not available Hi. For some events in a particular index, users (including Admins) are getting an error of "Show Source not availab... by Sqig Path Finder in Splunk Search 06-03-2014 0 3	0	3
Top Limit 50000 results - Where to Change? In my local limits.conf file, on my Search Head, I have the following: [searchresults] maxresultrows = 100000 [s... by aferone Builder in Splunk Search 06-03-2014 1 5	1	5
splunk daemon error Hi All, whenever i am trying to search the query,i am getting following error. Splunkd daemon is not responding: ('... by mvaradarajam Path Finder in Splunk Search 06-03-2014 0 1	0	1
How to turn search '... \| extract access-extractions' into a props.conf file? Hey All, So i have some web logs, lets call them source type 'webbylogs'. If I search 'sourcetype=webbylogs \| extrac... by Pierceyuk Path Finder in Splunk Search 06-03-2014 0 4	0	4
Difference between input.conf and search results Hello, This is my input.conf on the iis server: [monitor://D:\IISLogs\W3SVC2] index=iis_db sourcetype=iis However,... by isaacyeo Engager in Splunk Search 06-02-2014 0 8	0	8
DB Connect - Oracle - Single quote in query I am have the following stanza in my inputs.conf. [dbmon-tail://DB/TABLE] interval = 1m query = SELECT SL_UID,SL_TIM... by johnoxley_liqui Engager in Splunk Search 06-02-2014 1 1	1	1
Is there a way to drilldown to two different dashboards depending on column i click? In my dashboard, it loads data into a table with 4 columns Now what i require is to drill down to Dashboard1 if any ... by adityapavan18 Contributor in Splunk Search 06-02-2014 1 2	1	2
How to pass a variable value from one search to another in advance xml? Hi, Following is the advance xml code, where I have defined a search command in a postprocess module and want to pas... by harshal_chakran Builder in Splunk Search 06-02-2014 0 3	0	3
Searches appearing in search results (yo dawg) When I search in the search application, my search terms are starting to appear in subsequent searches. So search fo... by bbegyperkspot Explorer in Splunk Search 06-02-2014 1 5	1	5
Joining multiple events via a common field. So I have three sources that i need to join together to view as one event. The three sources are NewWFL, MoneyNEW, an... by mgubser Explorer in Splunk Search 06-02-2014 0 5	0	5
Longer Period of Time showing Fewer Results?? Hi, I have a search which returns 37 results for one date (May 30), but 0 results for May 30-Jun2. I am failing to... by essklau Path Finder in Splunk Search 06-02-2014 0 3	0	3
Null iplocation data Hello, I have the following query: . . . \| iplocation ClientIP \| eval GeoLocation=case(Country="United States", "... by hagjos43 Contributor in Splunk Search 06-02-2014 0 1	0	1
Add fields to all events, derived from a static application name Our deployed application services have a static deployment name of this format: {service name}-{environment}-{the r... by nikekeen New Member in Splunk Search 06-02-2014 0 2	0	2
How do you extract multiple strings of text using rex? I have VPN access connect/disconnect events from a Meraki security appliance being fed into Splunk. They show up in S... by TechnicalRS Engager in Splunk Search 06-02-2014 0 3	0	3
rex command to regex in transforms.conf This rex statement works in search command: rex field=source "3......(?P.+?)rly" I would like to convert it into REGE... by ch_goh Explorer in Splunk Search 06-02-2014 0 3	0	3
Regex for extraction Hi, i want to extract account field and i have events in 2 patterns. One where account has boundaries of @account= ... by xvxt006 Contributor in Splunk Search 06-02-2014 0 4	0	4
Join two searches and draw them on the same chart Hello guys , I kinda need your help , i spend some time on this query and i don't really see how to do that ( tried... by baranova New Member in Splunk Search 06-02-2014 0 2	0	2
Calculate Difference Between Outputs of two Scheduled Searches I have two scheduled searches that each output a single numerical value to populate panels on a dashboard. I want to... by jodros Builder in Splunk Search 06-02-2014 2 3	2	3