Splunk Search

Community Activity

Best practice to keep track of current service state Hi folks I'm logging the state of services in a log when they're getting started or stopped, nothing special. From y... by Simon Contributor in Splunk Search 12-16-2013 0 2	0	2
Incorrect Event Date Issue We have Splunk free version protected by IBM Tivoli Access Manager. SPlunk indexes the access logs from access manage... by usdreamz New Member in Splunk Search 12-15-2013 0 6	0	6
Parsing events within a transaction Here's my search string: host=abc* source="/log...*" \| rex "^[\d\|-]+ [\d\|:\|,]+ (?P<Identifier>[\w\w\|_]+)\s" \| transa... by gwu New Member in Splunk Search 12-14-2013 0 2	0	2
How do I find then number of elements in a comma delimited list? Given the following log entry how would a find the number of host entries and assign it to a field? Thanks! FINEST\|... by mklunder Explorer in Splunk Search 12-14-2013 0 2	0	2
joining across field matrix Hi - I am trying to wrap my head around the following search - looking at join, appendcols and map commands to get th... by rizzo75 Path Finder in Splunk Search 12-14-2013 0 1	0	1
Search and filter by fieldname I have a simple search query that is collecting data from XML. The search query is below; sourcetype=someSourceType... by OldManEd Builder in Splunk Search 12-13-2013 0 4	0	4
Using lookup tables Having trouble getting a lookup table to replace my results. I have a lookup file that contains the following info: ... by jbouch03 Path Finder in Splunk Search 12-13-2013 1 2	1	2
How do you chart a single data field? I'm trying to just chart the NTP offsets from the Loopstats file. Here is a sample of the data source: Day Seconds... by albyva Communicator in Splunk Search 12-13-2013 0 2	0	2
Transaction and Duration Hi all! Does transaction calculate duration per "transaction" or from the first event in the transaction to the last... by ctripod Explorer in Splunk Search 12-13-2013 0 2	0	2
Compare dates in splunk Hi, I have the below query to compare the date I am extracting from logs with the current date: (sourcetype="XYZ") ... by sriva6 New Member in Splunk Search 12-13-2013 0 3	0	3
Help with regex Greetings, I am trying to write a regex but am not successful as of yet. I am trying to match the: Bot: Mariposa Co... by ccsfdave Builder in Splunk Search 12-13-2013 0 4	0	4
Timecharts, distinct count and Total distinct count This may be simple, but I am pretty new to splunk in general and my attempts have not proved fruitful yet. So I have... by jerwood New Member in Splunk Search 12-13-2013 0 2	0	2
setting asa in order to get data via upd 514 Can anybody tellme how should my asa be configured in order to receive data into splunk ? what I mean is... my splunk... by stimpfl New Member in Splunk Search 12-13-2013 0 1	0	1
Compare field values between two different sourcetypes Hi, I have two different sourcetypes and I am extrating two fields from the first sourcetype sourcetype1 and I need ... by sriva6 New Member in Splunk Search 12-13-2013 0 7	0	7
How to accelerate search in forms? Is there any way to accelerate searches which are being used in forms. Since,we cannot save form searches as they con... by dishasaxena Path Finder in Splunk Search 12-13-2013 0 2	0	2
Can real time remove/add the warm db? Just for my interest. Hope some one can answer my question and with thanks. ^^ Can i remove or add the warm database... by lsmkelvin New Member in Splunk Search 12-12-2013 0 2	0	2
splunk search for index's maximum configured size Hi all, I found an answer here on the Splunk forums that shows a good search to list the current size of indexes as ... by w531t4 Path Finder in Splunk Search 12-12-2013 0 8	0	8
splunk real-time search does not scan incoming data Hi,all, I made a real-time search with my own index,it looks like it can only scan event once, after one scan,splun... by tonytang Explorer in Splunk Search 12-12-2013 2 1	2	1
Summary stats for a search Hi All - I'm working on creating a summary report and I am having difficulty discerning the various addtotals or addc... by lehrfeld Path Finder in Splunk Search 12-12-2013 0 2	0	2
Transaction by source, sourcetype, day Following query has been used to calculate duration for individual source (input files) for last 5 days: index="my_i... by sanjay_shrestha Contributor in Splunk Search 12-12-2013 0 5	0	5
showing alerts on the primary search head Hello, We have a primary alerting server that only us admins manage to setup alerts which sends out snmp traps of tr... by aaronkorn Splunk Employee in Splunk Search 12-12-2013 0 2	0	2
Data anonymizing and index routing Hi! I am considering to implement two separate indexes containing non-anonymized data and anonyimized on the other. ... by yuwtennis Communicator in Splunk Search 12-12-2013 0 5	0	5
Need Help With Simple NOT Search I can't beleive I'm coming to Answers to ask this as I've done it many times before but I must be missing something t... by andrewkenth Communicator in Splunk Search 12-12-2013 0 10	0	10
Dispatch Directory question We keep getting the message: "WARN DispatchReaper - Too many search jobs found in the dispatch directory (found=3575... by rmorlen Splunk Employee in Splunk Search 12-12-2013 0 3	0	3
Using result of one search in another search I have two logs: Log 1: 12/5/13 3:29:14.000 peter is a dog 12/5/13 3:30:14.000 paul is a cat Log 2: 12/5/13 3:30:14... by vinorama Explorer in Splunk Search 12-12-2013 0 6	0	6

Get Updates on the Splunk Community!

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

55 Days to Go: Secure Your Seat at Splunk University in Denver

Your .conf26 Experience Starts Before Opening Keynote If Denver is known for its mile-high elevation, Splunk ...

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...

Splunk Search

Best practice to keep track of current service state

Incorrect Event Date Issue

Parsing events within a transaction

How do I find then number of elements in a comma delimited list?

joining across field matrix

Search and filter by fieldname

Using lookup tables

How do you chart a single data field?

Transaction and Duration

Compare dates in splunk

Help with regex

Timecharts, distinct count and Total distinct count

setting asa in order to get data via upd 514

Compare field values between two different sourcetypes

How to accelerate search in forms?

Can real time remove/add the warm db?

splunk search for index's maximum configured size

splunk real-time search does not scan incoming data

Summary stats for a search

Transaction by source, sourcetype, day

showing alerts on the primary search head

Data anonymizing and index routing

Need Help With Simple NOT Search

Dispatch Directory question

Using result of one search in another search

Splunk Asynchronous Forwarding Explained

55 Days to Go: Secure Your Seat at Splunk University in Denver

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation