Splunk Search

Community Activity

Is there a way to run a batch of savedqueries using splunk rather than python or REST? \| savedquery Q1 -> this runs okay \| savedquery Q1 \| savedquery Q2 -> not okay. splunk error. \| savedquery Q1, Q2... by iTechEvent Explorer in Splunk Search 02-01-2014 0 5	0	5
Subsearch returning 2 fields and evaluation needed on one Hi Guys, I am trying to do this scenario where a subsearch is called to retrieve 2 fields using regex out of which o... by ramanjain1983 Path Finder in Splunk Search 02-01-2014 1 4	1	4
are search language keywords case-sensitive? Are all these OK? * \| STATS COUNT * \| stats count * \| STATS count * \| stats COUNT Conclusion: search lang keywords... by V_at_Splunk Splunk Employee in Splunk Search 01-31-2014 5 7	5	7
Detecting keywords from another search in a field from other search Hi Guys, I have a requirement like this. In a search I am getting a field like ExtraInfo Count User-... by tirusplunk Engager in Splunk Search 01-31-2014 0 5	0	5
How to combine information from 2 different sources? Hi! I have a small problem here.. I have two different sourcetypes named 'server' and 'metrics'. Server-sourcetype h... by Susannajuurinen Explorer in Splunk Search 01-31-2014 0 3	0	3
refer to first bucket values to compute more data Hi Folks, Here's what I have, index=blah \| bucket span=1d _time \| chart count(id) over _time by src Chart: _time... by theeven Explorer in Splunk Search 01-31-2014 0 4	0	4
Join Same Saved Search Hi, I created generic saved search and it is running fine individually as below \|savedsearch PausedTime_SS index_na... by sanjay_shrestha Contributor in Splunk Search 01-31-2014 1 1	1	1
appendpipe variable Hi Guys, appendpipe [stats avg() as ], adds a new row with the average of all the rows of the respective column.... by daktapaal Path Finder in Splunk Search 01-31-2014 0 2	0	2
Extract Fields Using RegEx I am having trouble trying to parse data from a raw event line. The raw event come in 2 different ways further below... by kramsay Engager in Splunk Search 01-30-2014 0 4	0	4
How to search for possible missing sections when logs did not come in from a given host? So we spot checked a random time in splunk for a sourcetype(made up of 2 hosts sending in data). The data was missing... by Pierceyuk Path Finder in Splunk Search 01-30-2014 0 4	0	4
Efficient searches using boolean operators I'm currently trying to optimize my searches to keep my Splunk searches as quick as possible. Is there any appreciabl... by petermuller Explorer in Splunk Search 01-30-2014 1 2	1	2
How can I compare the average of values across all events with specific values in events? I have the following in my query index=_internal source=*license_usage.log \| eval sizemb=b/1024/1024 timechart span... by daktapaal Path Finder in Splunk Search 01-30-2014 0 7	0	7
search of user logon count using lookup table to return all users Hi, I have a search like this to return the number of times users have logged in over a week. source="mysource" "lo... by lindsley Engager in Splunk Search 01-30-2014 0 2	0	2
Question index csv with field contain comma I have issue with index field which contain comma. Below is my csv input "28650096","2013-12-02 20:30:30","blocked"... by duenguyen Explorer in Splunk Search 01-30-2014 0 4	0	4
Query Modification I have a search that tables project name, the group it belongs to, and the total count of deployment types: index=e... by _gkollias Builder in Splunk Search 01-30-2014 0 2	0	2
How to use FORMAT search command in a subsearch Hi, I have a BlueCoat Proxy log in main index if I run index="main" sourcetype="bcoat_proxysg" cn="*" \| head 10 ... by dmlee Communicator in Splunk Search 01-30-2014 0 6	0	6
Timechart count roll up To the powers that be, here is my dilemma. I have a simple query that reviews data in 15 minute blocks and prints ou... by OldManEd Builder in Splunk Search 01-30-2014 0 7	0	7
Summing of row in a column on condition I have three columns ColumnA ColumnB ColumnC vin 1 1 vin 1 2 vin ... by vinay_ks04 New Member in Splunk Search 01-29-2014 0 6	0	6
Hashtable Functionality OR lookup Tables Hi All, I have a lookup table that looks like: Key,value cat1,val1 cat2,val2 cat3,val3 this is in a lookup file c... by daktapaal Path Finder in Splunk Search 01-29-2014 0 5	0	5
How can I plot bounce rate over time? Hi  I have a search that calculates the Bounce Rate for a web site: source="web" configuration.client.company=foo ... by lukeh Contributor in Splunk Search 01-29-2014 1 5	1	5
Function to fetch a part of a field value A field called username has values INPUT: kesia@abc.bgf.hf:123 gefuf@ef.eff.gre:872 .I want to take the string bef... by Jananee_iNautix Path Finder in Splunk Search 01-29-2014 0 5	0	5
multi_threaded_setup parameter in limits.conf We are currently looking at improving CPU optimization on the Splunk environment. We have found that the limits.conf ... by splunkIT Splunk Employee in Splunk Search 01-29-2014 2 5	2	5
Is this a linebreaking issue? I'm collecting events from a logfile that look like this : 270929.542: [GC 270929.542: [ParNew Desired survivor size... by wardallen Path Finder in Splunk Search 01-29-2014 0 8	0	8
Query Help: Sorting Results by Group I have a search that gives me the date and total number of projects: index=eis_continuous_integration sourcetype=eis... by _gkollias Builder in Splunk Search 01-29-2014 0 5	0	5
Can I use kv_mode = auto AND kv_mode = XML for sourcetype? I have an application sourcetype that is a mix of normal informational data and also houses a subset of web requests ... by tyronetv Communicator in Splunk Search 01-29-2014 0 1	0	1

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

Is there a way to run a batch of savedqueries using splunk rather than python or REST?

Subsearch returning 2 fields and evaluation needed on one

are search language keywords case-sensitive?

Detecting keywords from another search in a field from other search

How to combine information from 2 different sources?

refer to first bucket values to compute more data

Join Same Saved Search

appendpipe variable

Extract Fields Using RegEx

How to search for possible missing sections when logs did not come in from a given host?

Efficient searches using boolean operators

How can I compare the average of values across all events with specific values in events?

search of user logon count using lookup table to return all users

Question index csv with field contain comma

Query Modification

How to use FORMAT search command in a subsearch

Timechart count roll up

Summing of row in a column on condition

Hashtable Functionality OR lookup Tables

How can I plot bounce rate over time?

Function to fetch a part of a field value

multi_threaded_setup parameter in limits.conf

Is this a linebreaking issue?

Query Help: Sorting Results by Group

Can I use kv_mode = auto AND kv_mode = XML for sourcetype?

Splunk Auto Ingestion Parallel Pipeline Scaling

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation