Splunk Search

Community Activity

Parsing events within a transaction Here's my search string: host=abc* source="/log...*" \| rex "^[\d\|-]+ [\d\|:\|,]+ (?P<Identifier>[\w\w\|_]+)\s" \| transa... by gwu New Member in Splunk Search 12-14-2013 0 2	0	2
How do I find then number of elements in a comma delimited list? Given the following log entry how would a find the number of host entries and assign it to a field? Thanks! FINEST\|... by mklunder Explorer in Splunk Search 12-14-2013 0 2	0	2
joining across field matrix Hi - I am trying to wrap my head around the following search - looking at join, appendcols and map commands to get th... by rizzo75 Path Finder in Splunk Search 12-14-2013 0 1	0	1
Search and filter by fieldname I have a simple search query that is collecting data from XML. The search query is below; sourcetype=someSourceType... by OldManEd Builder in Splunk Search 12-13-2013 0 4	0	4
Using lookup tables Having trouble getting a lookup table to replace my results. I have a lookup file that contains the following info: ... by jbouch03 Path Finder in Splunk Search 12-13-2013 1 2	1	2
How do you chart a single data field? I'm trying to just chart the NTP offsets from the Loopstats file. Here is a sample of the data source: Day Seconds... by albyva Communicator in Splunk Search 12-13-2013 0 2	0	2
Transaction and Duration Hi all! Does transaction calculate duration per "transaction" or from the first event in the transaction to the last... by ctripod Explorer in Splunk Search 12-13-2013 0 2	0	2
Compare dates in splunk Hi, I have the below query to compare the date I am extracting from logs with the current date: (sourcetype="XYZ") ... by sriva6 New Member in Splunk Search 12-13-2013 0 3	0	3
Help with regex Greetings, I am trying to write a regex but am not successful as of yet. I am trying to match the: Bot: Mariposa Co... by ccsfdave Builder in Splunk Search 12-13-2013 0 4	0	4
Timecharts, distinct count and Total distinct count This may be simple, but I am pretty new to splunk in general and my attempts have not proved fruitful yet. So I have... by jerwood New Member in Splunk Search 12-13-2013 0 2	0	2
setting asa in order to get data via upd 514 Can anybody tellme how should my asa be configured in order to receive data into splunk ? what I mean is... my splunk... by stimpfl New Member in Splunk Search 12-13-2013 0 1	0	1
Compare field values between two different sourcetypes Hi, I have two different sourcetypes and I am extrating two fields from the first sourcetype sourcetype1 and I need ... by sriva6 New Member in Splunk Search 12-13-2013 0 7	0	7
How to accelerate search in forms? Is there any way to accelerate searches which are being used in forms. Since,we cannot save form searches as they con... by dishasaxena Path Finder in Splunk Search 12-13-2013 0 2	0	2
Can real time remove/add the warm db? Just for my interest. Hope some one can answer my question and with thanks. ^^ Can i remove or add the warm database... by lsmkelvin New Member in Splunk Search 12-12-2013 0 2	0	2
splunk search for index's maximum configured size Hi all, I found an answer here on the Splunk forums that shows a good search to list the current size of indexes as ... by w531t4 Path Finder in Splunk Search 12-12-2013 0 8	0	8
splunk real-time search does not scan incoming data Hi,all, I made a real-time search with my own index,it looks like it can only scan event once, after one scan,splun... by tonytang Explorer in Splunk Search 12-12-2013 2 1	2	1
Summary stats for a search Hi All - I'm working on creating a summary report and I am having difficulty discerning the various addtotals or addc... by lehrfeld Path Finder in Splunk Search 12-12-2013 0 2	0	2
Transaction by source, sourcetype, day Following query has been used to calculate duration for individual source (input files) for last 5 days: index="my_i... by sanjay_shrestha Contributor in Splunk Search 12-12-2013 0 5	0	5
showing alerts on the primary search head Hello, We have a primary alerting server that only us admins manage to setup alerts which sends out snmp traps of tr... by aaronkorn Splunk Employee in Splunk Search 12-12-2013 0 2	0	2
Data anonymizing and index routing Hi! I am considering to implement two separate indexes containing non-anonymized data and anonyimized on the other. ... by yuwtennis Communicator in Splunk Search 12-12-2013 0 5	0	5
Need Help With Simple NOT Search I can't beleive I'm coming to Answers to ask this as I've done it many times before but I must be missing something t... by andrewkenth Communicator in Splunk Search 12-12-2013 0 10	0	10
Dispatch Directory question We keep getting the message: "WARN DispatchReaper - Too many search jobs found in the dispatch directory (found=3575... by rmorlen Splunk Employee in Splunk Search 12-12-2013 0 3	0	3
Using result of one search in another search I have two logs: Log 1: 12/5/13 3:29:14.000 peter is a dog 12/5/13 3:30:14.000 paul is a cat Log 2: 12/5/13 3:30:14... by vinorama Explorer in Splunk Search 12-12-2013 0 6	0	6
extract multi lines fields We are logging the following application network statistics. I want to be able to index the data into splunk so we ca... by lgmnemesis Explorer in Splunk Search 12-11-2013 0 5	0	5
Calculating the sum for unique ID within each transaction Hello Splunkers, I have two different sourcetypes that can be grouped by a unique id where one sourcetype has some n... by 104K Engager in Splunk Search 12-11-2013 0 2	0	2

Get Updates on the Splunk Community!

Index This | What has goals but no motivation?

June 2026 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

Parsing events within a transaction

How do I find then number of elements in a comma delimited list?

joining across field matrix

Search and filter by fieldname

Using lookup tables

How do you chart a single data field?

Transaction and Duration

Compare dates in splunk

Help with regex

Timecharts, distinct count and Total distinct count

setting asa in order to get data via upd 514

Compare field values between two different sourcetypes

How to accelerate search in forms?

Can real time remove/add the warm db?

splunk search for index's maximum configured size

splunk real-time search does not scan incoming data

Summary stats for a search

Transaction by source, sourcetype, day

showing alerts on the primary search head

Data anonymizing and index routing

Need Help With Simple NOT Search

Dispatch Directory question

Using result of one search in another search

extract multi lines fields

Calculating the sum for unique ID within each transaction

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation