Splunk Search

Community Activity

Add a new count field to a table I have a log file of logins to a system by username. I can product a report of the logins by time host="daily" \| ta... by bowesmana SplunkTrust in Splunk Search 10-16-2013 0 3	0	3
how to correlate Application log and Server logs Hi, We are trying to create a chart containing application error logs and the logs of the corresponding server to re... by aaru New Member in Splunk Search 10-16-2013 0 5	0	5
Most of searches are getting deferred Hi all, We are using SoS app for monitoring our schedules. We are working on reducing the schedules which are being s... by Rukmani_Splunk Path Finder in Splunk Search 10-16-2013 2 3	2	3
Replace comma with the dot Hi, I have evaluated a field count with value 10000. Then I converted it with fieldformat to include a thousand sepa... by lrudolph Path Finder in Splunk Search 10-16-2013 1 3	1	3
How can I use the value of one field as name of another field? Splunk 5.0.2 Example: windows "Perfmon:Free Disk Space" Each check is actually two events, one with the free space ... by JoeIII Path Finder in Splunk Search 10-16-2013 0 6	0	6
how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare to user index data ? how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare ... by appensure New Member in Splunk Search 10-16-2013 0 2	0	2
Creating a simple chart from extracting specific string Hi This should be nice and easy for you lot. I have an application producing thousands of logs a day. In some of th... by philallen1 Path Finder in Splunk Search 10-16-2013 1 7	1	7
Can't make geostats return multiple locations Hi, I tried using the geostats feature. I got some logs where I have some network timings per client. I wanted to sh... by TroelsJensen New Member in Splunk Search 10-16-2013 0 8	0	8
Define a variable/constant in configuration/setup file for app I am building a few apps and have users requesting an easy way to change the default index name the app searches thro... by mikaelbje Motivator in Splunk Search 10-16-2013 0 4	0	4
Splitting eval results by week - can't get timechart or bucket to work for me Hi - I am measuring how many days in a week users are returning to our site, and calculating the ratio of users who r... by fuzzy_rocks Explorer in Splunk Search 10-15-2013 0 2	0	2
Combine counts from 2 separate searches using subsearches I'm trying to combine two separate searches using the join command, but it's not working. The inner search counts th... by john_byun Path Finder in Splunk Search 10-15-2013 0 11	0	11
How to chart a percentage from derived search result? I am new to splunka and have a question on charting percentage field that is derived from search/query result. Splun... by annalwins Engager in Splunk Search 10-15-2013 0 1	0	1
Clean the Dispatch Directory command error I am trying to clean out the dispatch directory on our search head. I am using the command: splunkd clean-dispatch ... by mookiie2005 Communicator in Splunk Search 10-15-2013 0 1	0	1
Only 30 days searchable on any index Hi, I'm having an issue where any search will only return data from the previous 30 days. I'm not aware of any reten... by cdstealer Contributor in Splunk Search 10-15-2013 0 4	0	4
Time Stamp May seem trivial but it is alluding me! What would I add in the search to extract the time of the event? host=server... by wrays New Member in Splunk Search 10-15-2013 0 2	0	2
Transaction time Query used: index=[server]\| transaction Extract startswith="Value Extract Starting." endswith="extraction completed.... by sanyonhhh New Member in Splunk Search 10-14-2013 0 1	0	1
Measuring search performance mesurement Hi! Does anybody know any tool that can measure the search performance per pipeline? Purpose is to detect the portio... by yuwtennis Communicator in Splunk Search 10-14-2013 1 1	1	1
Proper command_line format for perfdata log files Hey All, Just going through getting Splunk for Nagios installed and I followed the instructions as provided and all ... by kultar Engager in Splunk Search 10-14-2013 0 1	0	1
using tstats with a datamodel I'm trying to use tstats from an accelerated data model and having no success. I took a look at the Tutorial pivot r... by rettops Path Finder in Splunk Search 10-14-2013 1 1	1	1
Comparing regex and print result if a specific condition is met Hi, I've searched through the Answers section, with not much help. What I'd like to do is to parse a log entry, to ... by mtanadsk Explorer in Splunk Search 10-14-2013 0 1	0	1
Multi value regex Hello I am trying to extract multiple values of single field name. SysStatsUtilizationDiskSpace=17.58% /, SysStat... by theouhuios Motivator in Splunk Search 10-14-2013 0 1	0	1
Inline field extraction with rex I'm not a big regex power yet, I know this is easy, but since it is not on a system I can't test and figure out mysel... by lukejadamec Super Champion in Splunk Search 10-14-2013 0 4	0	4
Can I use search on lookupfields for earliestTime instead of hardcoding them? Hi I want to use lookupfield search to extract value for earliesTime and latestTime. Can I use as in example below? ... by manish31383 New Member in Splunk Search 10-14-2013 0 1	0	1
Comparing 2 fields Hi, I have 2 fields that are already extracted uri and referer. I want to right a search based on if uri value =re... by xvxt006 Contributor in Splunk Search 10-14-2013 0 7	0	7
get the unique count from the list of numbers Hi, I want to get the unique count of the numbers available in the log. for e,g, I have used the list query to get ... by harshal_chakran Builder in Splunk Search 10-14-2013 0 1	0	1