Splunk Search

Community Activity

DNS time stamp REGEX needed Here is my DNS raw data: Oct 17 19:47:09 ns1 named[15517]: 17-Oct-2013 19:47:09.314 queries: client xxx.xxx.xxx.xxx#... by hartfoml Motivator in Splunk Search 10-24-2013 1 4	1	4
peak time of log sources Hi , I have some forwarders installed in my environment and want to calculate the peak time in which log sources for... by lohit Path Finder in Splunk Search 10-24-2013 1 5	1	5
filtering errors based on two timestamps I have a site and errors on that site are being recorded in splunk. I basically need to filter out those error which ... by Nisha18789 Builder in Splunk Search 10-24-2013 0 6	0	6
Bug in convert ctime? Hi the following search eval test=7200 \| convert timeformat="%H:%M:%S" ctime(test) \| table test gives me 03:00:00 ... by nekb1958 Path Finder in Splunk Search 10-24-2013 0 4	0	4
Search to find Log Sources not reporting Hello everyone, I have around 20 forwarders (Universal) in my env and configued to forward data to Splunk Indexer. I... by lohit Path Finder in Splunk Search 10-24-2013 0 1	0	1
Problems indexing into zip files Hi All, I am monitoring files that land in the same directory that I wish to be considered as different source types... by tim9gray Explorer in Splunk Search 10-23-2013 0 13	0	13
Why am I unable to run dbinspect from cli for calculating compression? I'd like to run the following search on my indexer to calculate compression. It works in UI, but not in CLI. I have... by the_wolverine Champion in Splunk Search 10-23-2013 0 2	0	2
Character Encoding in log4j Setting up Splunk I'm getting rsyslog messages showing up fine but when I point a little test log4j app at it I start... by tscanlon Engager in Splunk Search 10-23-2013 0 2	0	2
Trimming the amount of data forwarded Background: We have an existing indexer, that we have added a lot of data to. We would like to cut down on the amount... by tnconners Explorer in Splunk Search 10-23-2013 0 3	0	3
Setting a field as a raw integer? This has been giving me headaches for a long time now, and it's pretty simple. So, for reference, this search works a... by tfitzgerald15 Explorer in Splunk Search 10-23-2013 0 3	0	3
Sorting Duration and Getting the Top 10 I have a duration field in seconds. I wanted the format to be D+hh:mm:ss, so I used this: eval dur_hhmmss=tostring(D... by splunknovice201 New Member in Splunk Search 10-23-2013 0 2	0	2
Filtering events out via props.conf and transforms.conf? The props.conf and transforms.conf files that should be modified are under /etc/system/local, correct? We have been ... by ejdavis Path Finder in Splunk Search 10-23-2013 0 13	0	13
How to count total hits by certain fields? I've been playing around with eval, transaction, and stats and I still can't figure this one out... so I'm asking for... by echojacques Builder in Splunk Search 10-23-2013 0 5	0	5
Error in 'join' command: Usage: join ()? [subsearch] I get the error "Error in 'join' command: Usage: join <options> (<join-fields>)? [subsearch]" when running the follow... by jeffreygaraygay Explorer in Splunk Search 10-23-2013 0 1	0	1
Best way to create a search time field extraction I've spent a long time reading, but am not sure the best way to do this. I have events, which contain username-xxx,... by bowesmana SplunkTrust in Splunk Search 10-23-2013 0 4	0	4
splunk diag command doesn't work with --exclude in splunk version 6.0 The flags such as exclude as explained in http://docs.splunk.com/Documentation/Splunk/6.0/Troubleshooting/ContactSplu... by jdastmalchi_spl Splunk Employee in Splunk Search 10-23-2013 1 1	1	1
track users logging in via SSO Hello, we are using SSO with LDAP based users for authentication on our search heads. On our search head; how do we ... by kaddupa1 Explorer in Splunk Search 10-23-2013 1 2	1	2
sorting date I have a query as source="C:\Data\acctdata\snm4-logger.log" "Customer has successfully retrieved file"\| rex "::\s(?\S... by srajanbabu Explorer in Splunk Search 10-23-2013 0 2	0	2
Count of Occurence of Operating System(OS) Hi all, I have around 8 hosts in my splunk and i searching for a report which will list out operating systems type... by lohit Path Finder in Splunk Search 10-23-2013 0 8	0	8
Seprating null and empty fields Hi All, I have multiple cases with my date: some have empty src value: e.g, id=abc src= lr=2 some does not have src ... by gimbil Explorer in Splunk Search 10-22-2013 0 1	0	1
How to have eval use results of accum I have a chicken and egg issue here which I am having trouble resolving. I have a search which returns data for each... by phoenixdigital Builder in Splunk Search 10-22-2013 0 6	0	6
User accounts privledges So I've created a plain user account to just run searches. When I log in as that user and run a search, the events s... by chrisslagel New Member in Splunk Search 10-22-2013 0 1	0	1
average for sucessfully requests Hi, I hava data in the log like the following: userId url status time 123 /abc success 1000 12... by chialin New Member in Splunk Search 10-22-2013 0 2	0	2
"Unable to distribute to peer" -- adjustable timeout? I'm getting quite a few "Unable to distribute to peer..." messages when searching in splunk. The reasons given tend... by batzel Engager in Splunk Search 10-22-2013 4 7	4	7
"All time" works OK; "All time (realtime)" shows nothing, eventually 'Invalid SID'? (Splunk 6) Whilst leaving a Splunk 6 search page open tailing incoming syslogs (with the default * search query), I realised it ... by christopherwood Explorer in Splunk Search 10-22-2013 2 5	2	5