Splunk Search

Community Activity

Accelerating searches over data with millions of logs Hi, Each day I receive millions of events of type "video_view". These logs are taken for hundreds of thousands of vi... by anthonycopus Path Finder in Splunk Search 12-16-2013 0 6	0	6
Combine multiple events for reporting Hi, I'm using splunk for caching the log and reporting, now I need to query in splunk for user action and generate a... by ndkhoiits Explorer in Splunk Search 12-16-2013 0 6	0	6
Need help top 2 division Hello I am a newbie on Splunk. I need to create an alert if #1 IP generated >2X of the #2 IP and this is my search ... by duenguyen Explorer in Splunk Search 12-16-2013 0 1	0	1
Best practice to keep track of current service state Hi folks I'm logging the state of services in a log when they're getting started or stopped, nothing special. From y... by Simon Contributor in Splunk Search 12-16-2013 0 2	0	2
Incorrect Event Date Issue We have Splunk free version protected by IBM Tivoli Access Manager. SPlunk indexes the access logs from access manage... by usdreamz New Member in Splunk Search 12-15-2013 0 6	0	6
Parsing events within a transaction Here's my search string: host=abc* source="/log...*" \| rex "^[\d\|-]+ [\d\|:\|,]+ (?P<Identifier>[\w\w\|_]+)\s" \| transa... by gwu New Member in Splunk Search 12-14-2013 0 2	0	2
How do I find then number of elements in a comma delimited list? Given the following log entry how would a find the number of host entries and assign it to a field? Thanks! FINEST\|... by mklunder Explorer in Splunk Search 12-14-2013 0 2	0	2
joining across field matrix Hi - I am trying to wrap my head around the following search - looking at join, appendcols and map commands to get th... by rizzo75 Path Finder in Splunk Search 12-14-2013 0 1	0	1
Search and filter by fieldname I have a simple search query that is collecting data from XML. The search query is below; sourcetype=someSourceType... by OldManEd Builder in Splunk Search 12-13-2013 0 4	0	4
Using lookup tables Having trouble getting a lookup table to replace my results. I have a lookup file that contains the following info: ... by jbouch03 Path Finder in Splunk Search 12-13-2013 1 2	1	2
How do you chart a single data field? I'm trying to just chart the NTP offsets from the Loopstats file. Here is a sample of the data source: Day Seconds... by albyva Communicator in Splunk Search 12-13-2013 0 2	0	2
Transaction and Duration Hi all! Does transaction calculate duration per "transaction" or from the first event in the transaction to the last... by ctripod Explorer in Splunk Search 12-13-2013 0 2	0	2
Compare dates in splunk Hi, I have the below query to compare the date I am extracting from logs with the current date: (sourcetype="XYZ") ... by sriva6 New Member in Splunk Search 12-13-2013 0 3	0	3
Help with regex Greetings, I am trying to write a regex but am not successful as of yet. I am trying to match the: Bot: Mariposa Co... by ccsfdave Builder in Splunk Search 12-13-2013 0 4	0	4
Timecharts, distinct count and Total distinct count This may be simple, but I am pretty new to splunk in general and my attempts have not proved fruitful yet. So I have... by jerwood New Member in Splunk Search 12-13-2013 0 2	0	2
setting asa in order to get data via upd 514 Can anybody tellme how should my asa be configured in order to receive data into splunk ? what I mean is... my splunk... by stimpfl New Member in Splunk Search 12-13-2013 0 1	0	1
Compare field values between two different sourcetypes Hi, I have two different sourcetypes and I am extrating two fields from the first sourcetype sourcetype1 and I need ... by sriva6 New Member in Splunk Search 12-13-2013 0 7	0	7
How to accelerate search in forms? Is there any way to accelerate searches which are being used in forms. Since,we cannot save form searches as they con... by dishasaxena Path Finder in Splunk Search 12-13-2013 0 2	0	2
Can real time remove/add the warm db? Just for my interest. Hope some one can answer my question and with thanks. ^^ Can i remove or add the warm database... by lsmkelvin New Member in Splunk Search 12-12-2013 0 2	0	2
splunk search for index's maximum configured size Hi all, I found an answer here on the Splunk forums that shows a good search to list the current size of indexes as ... by w531t4 Path Finder in Splunk Search 12-12-2013 0 8	0	8
splunk real-time search does not scan incoming data Hi,all, I made a real-time search with my own index,it looks like it can only scan event once, after one scan,splun... by tonytang Explorer in Splunk Search 12-12-2013 2 1	2	1
Summary stats for a search Hi All - I'm working on creating a summary report and I am having difficulty discerning the various addtotals or addc... by lehrfeld Path Finder in Splunk Search 12-12-2013 0 2	0	2
Transaction by source, sourcetype, day Following query has been used to calculate duration for individual source (input files) for last 5 days: index="my_i... by sanjay_shrestha Contributor in Splunk Search 12-12-2013 0 5	0	5
showing alerts on the primary search head Hello, We have a primary alerting server that only us admins manage to setup alerts which sends out snmp traps of tr... by aaronkorn Splunk Employee in Splunk Search 12-12-2013 0 2	0	2
Data anonymizing and index routing Hi! I am considering to implement two separate indexes containing non-anonymized data and anonyimized on the other. ... by yuwtennis Communicator in Splunk Search 12-12-2013 0 5	0	5

Get Updates on the Splunk Community!

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26 With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us. The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Splunk Search

Accelerating searches over data with millions of logs

Combine multiple events for reporting

Need help top 2 division

Best practice to keep track of current service state

Incorrect Event Date Issue

Parsing events within a transaction

How do I find then number of elements in a comma delimited list?

joining across field matrix

Search and filter by fieldname

Using lookup tables

How do you chart a single data field?

Transaction and Duration

Compare dates in splunk

Help with regex

Timecharts, distinct count and Total distinct count

setting asa in order to get data via upd 514

Compare field values between two different sourcetypes

How to accelerate search in forms?

Can real time remove/add the warm db?

splunk search for index's maximum configured size

splunk real-time search does not scan incoming data

Summary stats for a search

Transaction by source, sourcetype, day

showing alerts on the primary search head

Data anonymizing and index routing

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation