Splunk Search

Community Activity

The value changes between in search result and dashboard Hello, I created this search, and the result is 37. However, when I put it on dashboard, the result turns out to be ... by appleman Contributor in Splunk Search 12-06-2013 0 3	0	3
multi-value field display I have a search i'm attempting, and I'm trying to find a specific event, and eval the difference, then display that v... by tmarlette Motivator in Splunk Search 12-06-2013 0 6	0	6
combined timecharts Hi, I'm trying to combine 2 timecharts into just single graph index=xxx (MTYP=0 RESL=0) OR (MTYP=1 RESL=0) OR (MTYP=... by adomila Explorer in Splunk Search 12-06-2013 0 3	0	3
How to remove all references to an errant host? Hi. I'm running a single splunk6 indexer. It is being fed by approx 20 linux and windows UniversalForwarders. One of... by fziegler New Member in Splunk Search 12-06-2013 0 1	0	1
Merging results from two different searches in one fill chart My company is currently trying to archive a large amount of older files; however, new files are coming in daily. We w... by jbouch03 Path Finder in Splunk Search 12-06-2013 0 2	0	2
Create a field from a string Hi users, I have a big string in one field from which I want to extract specific values such as user and IP address ... by evang_26 Communicator in Splunk Search 12-06-2013 0 5	0	5
Skipping Index after transformation I have certain logs in which I had to change the format of the logs.For this a custom sourcetype containing the trans... by kkamatchisundar New Member in Splunk Search 12-06-2013 0 1	0	1
how to run a python file in splunk? Hi, I have created a python file "newapp.py", which does the normal search operation. I run it on console and get th... by harshal_chakran Builder in Splunk Search 12-06-2013 0 2	0	2
The alarm time statistics Now that there is such a demand, I set up an alarm, when I CPU use rate of more than 90% began to alarm, when the CPU... by laiyongmao Path Finder in Splunk Search 12-06-2013 0 3	0	3
Evaluate json boolean value with if statement Hi all, I am trying to run this simple search: SourceType=FooMonitoring \|eval isSuccess=if(Test.TestIsSuccessful=="t... by itaigev New Member in Splunk Search 12-05-2013 0 1	0	1
List of properties aggregated by event Hi there, I am new to Splunk. I have data with the following structure, where each entry has an event name and a vari... by turkamit New Member in Splunk Search 12-05-2013 0 1	0	1
The lookup table '...' does not exist After installing the Windows App 5.0.2 on our splunk 5.0.3 i get these errors when doing a search: The lookup table ... by marco_stiegeman Engager in Splunk Search 12-05-2013 1 3	1	3
twice as many counts as matching events? I need help figuring out this one This is the search: host="myhost" \| spath \| top agent.browser I get 311 matchi... by malukisses Engager in Splunk Search 12-05-2013 1 6	1	6
\| pivot and eval Hi there, is there any way to combine table creation using an eval expression in combination with the accelerated pi... by anjafischer Path Finder in Splunk Search 12-05-2013 2 6	2	6
copy sourcetype and regex from one index to other index how i can copy sourcetype and regex from one index to other index? by felipesewaybric Contributor in Splunk Search 12-05-2013 0 2	0	2
Append showing result in new row If I understood correctly append returns the result in the same row as the previous query. Anyone knows why I get 2 s... by mcamilleri Path Finder in Splunk Search 12-05-2013 0 3	0	3
Percentage change in event counts I need to calculate the percentage increase/decrease in the number of events in the last 5 minutes compared to the pr... by mcamilleri Path Finder in Splunk Search 12-05-2013 1 4	1	4
Count Command Hi, I'm experiencing some difficulties when using count, the below search query works by listing sip (source ip) aga... by sukhgillz Explorer in Splunk Search 12-05-2013 0 6	0	6
Can timestamp be conditional according to data content My csv data contains a number of timestamps. I want the timestamp field to be conditional on the result of another f... by bowesmana SplunkTrust in Splunk Search 12-05-2013 0 10	0	10
Filtering with dedup depending on number of results I got a search that monitores my Netbackup jobs in real time. search = index=Infra_NB sourcetype="NbJobs" site=$site... by timmalos Communicator in Splunk Search 12-04-2013 0 5	0	5
Filter fields per role access? Hi! I would like to ask question whether its possible to filter certain fields per role. For example, If I have a ... by yuwtennis Communicator in Splunk Search 12-04-2013 0 3	0	3
Webknight Field Extractions and Header Exclusions If anybody uses WebKnight ISAPA filter in your environment you will probably have spotted that the log file formal ca... by hughroberts Explorer in Splunk Search 12-04-2013 0 1	0	1
Search is truncating results to a smaller result set after completion Hello, I'm running a fairly complex search using transactions in order to identify an error occurring in a distinct ... by erikross Explorer in Splunk Search 12-04-2013 0 2	0	2
Indexing internals Hi, I'm planning the event sources for Splunk and I'd like to know (if someone could give an answer) how does splun... by egutesman Engager in Splunk Search 12-04-2013 0 2	0	2
dbx query timeout Is there a flag in the dbx app that times out a query if it exceeds a certain time? We have an SLA that our queries c... by aaronkorn Splunk Employee in Splunk Search 12-04-2013 2 1	2	1