Splunk Search

Community Activity

Time extraction from string? I have following values in a field +000 00:00:00.00 +000 00:00:00.03 +000 00:00:43.18 +000 00:00:20.69 +000 00:... by asifhj Path Finder in Splunk Search 04-21-2014 0 1	0	1
Filter search result to only include events that has top N largest values Hi - I am building a query as below: sourcetype=my-data \| eventstats count(request-id) as requestCountByService by... by Findekano Engager in Splunk Search 04-19-2014 0 1	0	1
Dynamically extract field names from multiline event I've got some log data that has a multi-line event this format: 2011-04-28 11:40:00\|ACTION\|1304005199906869\|stuff\|st... by frink Explorer in Splunk Search 04-18-2014 0 7	0	7
simple xml for table display I am using the simple xml example from the "UI Examples" APP in the example the output is a count field. I would li... by hartfoml Motivator in Splunk Search 04-18-2014 0 1	0	1
Use subsearch results for dbquery I have a subsearch that finds destination IP's like this [search sourcetype=ids sid=xxxx \| dedup dst \| table dst] I... by hartfoml Motivator in Splunk Search 04-18-2014 0 8	0	8
Finding/displaying date range I have a process running on 50 servers that processes 4 files into a SQL DB and then writes to a log file the name of... by jsmith39 Path Finder in Splunk Search 04-18-2014 0 4	0	4
How can i get ip address from postfix logs Hi, How can i get ip address from like under log?? --- Sep 13 23:55:42 mailhost1 postfix/smtpd[15824]: [ID 197553 m... by saito0910 Engager in Splunk Search 04-18-2014 0 2	0	2
How to pass a parameter from one search query to another as a search argument? Hello, I have a situation where I want to do the following: search field_1 from (index_1 and sourcetype_1) and then ... by pramit46 Contributor in Splunk Search 04-17-2014 0 8	0	8
Multiprocessing funcion "Pool()" cannot be used in my lookup external python script on Linux. Hello, I cannot use one of multiprocessing functions, "Pool()" in my lookup external python script on CentOS 6.3 wit... by Suda Communicator in Splunk Search 04-17-2014 0 3	0	3
Trying to get the first 10 events based on sourcetype I'm trying to get the first 10 or so events per sourcetype but the methodology is escaping me. You can't simply use t... by Runals Motivator in Splunk Search 04-17-2014 0 2	0	2
how to retrieve the IE version using splunk I have a farm of Windows Boxes, and it's a pain to figure which versions of IE they are running on. The only place I ... by mataharry Communicator in Splunk Search 04-17-2014 2 2	2	2
Search for multiple hosts in parameterized search I have a saved search that will take a 'host' parameter, like the following: \|savedsearch "searchName" host="hostName... by petermuller Explorer in Splunk Search 04-17-2014 0 6	0	6
How to debug in Splunk python sdk?? Hi, Can anybody please tell me , how I can debug a python file in Splunk python SDK. Which IDE should I use? by harshal_chakran Builder in Splunk Search 04-17-2014 2 2	2	2
Performance issue on index Hi Guys, I get the following error below: Any ideas on what may be causing it? The list of indexes to be searched ... by tbalouch Path Finder in Splunk Search 04-17-2014 1 1	1	1
How to count field with string and empty string and draw a chart ? I have below format of data. I would like to count email with empty string as anonymous and email with any string as ... by annalwins Engager in Splunk Search 04-17-2014 0 3	0	3
特定の時間のstatus=successより一つ前のstatus=successをとる方法時間を指定して、その時間帯に出ているオペレーションに対するステータスが成功（status=success）に対し、その時間よりも前でstatus=successが出ているのを抽出しその間の時間を出したい時にどのようなサーチ文を組めばよ... by appleman Contributor in Splunk Search 04-16-2014 0 2	0	2
age group report from birth year data I have a raw data and its contains the user birth Year, city and registered date, how to calculate the age group repo... by dhavamanis Builder in Splunk Search 04-16-2014 1 3	1	3
Using searches to get a percentage or, Daily uniques as a percentage of monthly uniques. I can easily come up with searches to find the number of daily unique users and monthly unique users. But, someone wa... by cvervais Path Finder in Splunk Search 04-16-2014 0 2	0	2
Eval if function with 2 arguments ... \| eval totalVolumeGB=if(totalVolumeGB=="0",maxTotalDataSizeMB*23/1024,totalVolumeGB) How would I add in another... by bleung93 Path Finder in Splunk Search 04-16-2014 0 4	0	4
Sort values of a field with double digit How do I sort this single field properly? I already tried \| sort - field_name. I tried creating a rex and then sortin... by bleung93 Path Finder in Splunk Search 04-16-2014 0 2	0	2
Subnet collection I want to be able to find the most vulnerable subnet. I know how to verify if an ip is in a subnet by using the cirdm... by splunkinmcsplun New Member in Splunk Search 04-16-2014 0 2	0	2
Use db results in splunk search Hello, I want to use the results of my dbquery as search strings in the log files. Currently I am running two differ... by dfredell Explorer in Splunk Search 04-16-2014 0 3	0	3
In what format should the rising_column be? I'm using DB Connect to extract McAfee ePO events from a MS SQL database and I'm using an auto-increment field as the... by joshua_hart Explorer in Splunk Search 04-16-2014 0 7	0	7
How to create a search that compares two lists of field values? Hello, I'm looking for a possibility to compare two lists of field values from two different sourecetypes. For that ... by C_Sparn Communicator in Splunk Search 04-16-2014 0 12	0	12
Can we change the character code in export format ? （検索結果ダウンロード時の文字コード変更について） Splunkでは検索結果をCSVやrawフォーマットでダウンロードすることが出来ますが、その際、文字コードをデフォルトのUTF-8から別のもの（SJIS, EUC, MS932等）へと変更することは可能でしょうか？ Splunkが取... by sunrise Contributor in Splunk Search 04-15-2014 1 2	1	2