Splunk Search

Community Activity

When I am in default search app and click on an index name the query executed has garbage whitespace embedded. How do I fix this? I have multiple indexes setup. Most user queries go to my default index however my users typically execute a search o... by treyka Path Finder in Splunk Search 02-02-2014 0 3	0	3
How to write this query when variable names instead of constants need to be used to automate the query Here is a simplified version of my issue. I have csv file as below named Q.csv Q1avg, Q2avg100 , ... by iTechEvent Explorer in Splunk Search 02-02-2014 0 2	0	2
Need help when using variable instead of constant in splunk query construct within where and eval I have a query Q1 which is used to collect avg over 10 days.Say the average is AvgQ1 100. I have another query Q2 whi... by iTechEvent Explorer in Splunk Search 02-02-2014 1 3	1	3
Is there a way to run a batch of savedqueries using splunk rather than python or REST? \| savedquery Q1 -> this runs okay \| savedquery Q1 \| savedquery Q2 -> not okay. splunk error. \| savedquery Q1, Q2... by iTechEvent Explorer in Splunk Search 02-01-2014 0 5	0	5
Subsearch returning 2 fields and evaluation needed on one Hi Guys, I am trying to do this scenario where a subsearch is called to retrieve 2 fields using regex out of which o... by ramanjain1983 Path Finder in Splunk Search 02-01-2014 1 4	1	4
are search language keywords case-sensitive? Are all these OK? * \| STATS COUNT * \| stats count * \| STATS count * \| stats COUNT Conclusion: search lang keywords... by V_at_Splunk Splunk Employee in Splunk Search 01-31-2014 5 7	5	7
Detecting keywords from another search in a field from other search Hi Guys, I have a requirement like this. In a search I am getting a field like ExtraInfo Count User-... by tirusplunk Engager in Splunk Search 01-31-2014 0 5	0	5
How to combine information from 2 different sources? Hi! I have a small problem here.. I have two different sourcetypes named 'server' and 'metrics'. Server-sourcetype h... by Susannajuurinen Explorer in Splunk Search 01-31-2014 0 3	0	3
refer to first bucket values to compute more data Hi Folks, Here's what I have, index=blah \| bucket span=1d _time \| chart count(id) over _time by src Chart: _time... by theeven Explorer in Splunk Search 01-31-2014 0 4	0	4
Join Same Saved Search Hi, I created generic saved search and it is running fine individually as below \|savedsearch PausedTime_SS index_na... by sanjay_shrestha Contributor in Splunk Search 01-31-2014 1 1	1	1
appendpipe variable Hi Guys, appendpipe [stats avg() as ], adds a new row with the average of all the rows of the respective column.... by daktapaal Path Finder in Splunk Search 01-31-2014 0 2	0	2
Extract Fields Using RegEx I am having trouble trying to parse data from a raw event line. The raw event come in 2 different ways further below... by kramsay Engager in Splunk Search 01-30-2014 0 4	0	4
How to search for possible missing sections when logs did not come in from a given host? So we spot checked a random time in splunk for a sourcetype(made up of 2 hosts sending in data). The data was missing... by Pierceyuk Path Finder in Splunk Search 01-30-2014 0 4	0	4
Efficient searches using boolean operators I'm currently trying to optimize my searches to keep my Splunk searches as quick as possible. Is there any appreciabl... by petermuller Explorer in Splunk Search 01-30-2014 1 2	1	2
How can I compare the average of values across all events with specific values in events? I have the following in my query index=_internal source=*license_usage.log \| eval sizemb=b/1024/1024 timechart span... by daktapaal Path Finder in Splunk Search 01-30-2014 0 7	0	7
search of user logon count using lookup table to return all users Hi, I have a search like this to return the number of times users have logged in over a week. source="mysource" "lo... by lindsley Engager in Splunk Search 01-30-2014 0 2	0	2
Question index csv with field contain comma I have issue with index field which contain comma. Below is my csv input "28650096","2013-12-02 20:30:30","blocked"... by duenguyen Explorer in Splunk Search 01-30-2014 0 4	0	4
Query Modification I have a search that tables project name, the group it belongs to, and the total count of deployment types: index=e... by _gkollias Builder in Splunk Search 01-30-2014 0 2	0	2
How to use FORMAT search command in a subsearch Hi, I have a BlueCoat Proxy log in main index if I run index="main" sourcetype="bcoat_proxysg" cn="*" \| head 10 ... by dmlee Communicator in Splunk Search 01-30-2014 0 6	0	6
Timechart count roll up To the powers that be, here is my dilemma. I have a simple query that reviews data in 15 minute blocks and prints ou... by OldManEd Builder in Splunk Search 01-30-2014 0 7	0	7
Summing of row in a column on condition I have three columns ColumnA ColumnB ColumnC vin 1 1 vin 1 2 vin ... by vinay_ks04 New Member in Splunk Search 01-29-2014 0 6	0	6
Hashtable Functionality OR lookup Tables Hi All, I have a lookup table that looks like: Key,value cat1,val1 cat2,val2 cat3,val3 this is in a lookup file c... by daktapaal Path Finder in Splunk Search 01-29-2014 0 5	0	5
How can I plot bounce rate over time? Hi  I have a search that calculates the Bounce Rate for a web site: source="web" configuration.client.company=foo ... by lukeh Contributor in Splunk Search 01-29-2014 1 5	1	5
Function to fetch a part of a field value A field called username has values INPUT: kesia@abc.bgf.hf:123 gefuf@ef.eff.gre:872 .I want to take the string bef... by Jananee_iNautix Path Finder in Splunk Search 01-29-2014 0 5	0	5
multi_threaded_setup parameter in limits.conf We are currently looking at improving CPU optimization on the Splunk environment. We have found that the limits.conf ... by splunkIT Splunk Employee in Splunk Search 01-29-2014 2 5	2	5

Get Updates on the Splunk Community!

test 2

test 222222

test

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Splunk Search

When I am in default search app and click on an index name the query executed has garbage whitespace embedded. How do I fix this?

How to write this query when variable names instead of constants need to be used to automate the query

Need help when using variable instead of constant in splunk query construct within where and eval

Is there a way to run a batch of savedqueries using splunk rather than python or REST?

Subsearch returning 2 fields and evaluation needed on one

are search language keywords case-sensitive?

Detecting keywords from another search in a field from other search

How to combine information from 2 different sources?

refer to first bucket values to compute more data

Join Same Saved Search

appendpipe variable

Extract Fields Using RegEx

How to search for possible missing sections when logs did not come in from a given host?

Efficient searches using boolean operators

How can I compare the average of values across all events with specific values in events?

search of user logon count using lookup table to return all users

Question index csv with field contain comma

Query Modification

How to use FORMAT search command in a subsearch

Timechart count roll up

Summing of row in a column on condition

Hashtable Functionality OR lookup Tables

How can I plot bounce rate over time?

Function to fetch a part of a field value

multi_threaded_setup parameter in limits.conf

test 2

test

Join the Hackathon at .conf26 and build a No-Code AI agent

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation