Splunk Search

Community Activity

Using field values as paramaters for macros bis Hi! I have the need to write a "macro" that takes field values as parameters. I have understood from this thread tha... by guilhem Contributor in Splunk Search 03-07-2013 0 4	0	4
Unable to extract IP Address and Port number with reg I have an event that I want to extract the IP Address and Port number. Mar 6 13:59:59 192.168.140.215 %ASA-4-106023... by RNB Path Finder in Splunk Search 03-07-2013 0 3	0	3
Use "Splunk" relative times for custom fields?@ Hi, i have records like this: 2013-03-05 01:02:03.456Z foo=bar value=key start="2013-03-05 05:00:00.000Z" end="2013... by JensT Communicator in Splunk Search 03-07-2013 0 2	0	2
Metadata Command Alerting Here's my command: \| metadata type=hosts index= \| sort lastTime \| convert ctime(lastTime) as Latest_Time \| sort -la... by ryangibson99 Explorer in Splunk Search 03-07-2013 0 1	0	1
addcoltotal name? Hi, I have a table that gives me connections, and I want to show those connections, plus a total. The search works, ... by a212830 Champion in Splunk Search 03-07-2013 0 3	0	3
Problem with the summation in chart command in SPLUNK Hi, I want to find out how what is the total number of "Exit" and "Entry" for the particular CARD_NUMBER for a parti... by abhayneilam Contributor in Splunk Search 03-07-2013 0 6	0	6
How does automatic key=value extraction works? Hello, we have a logfile that contains key=value pairs. Usually Splunks automatic field extraction is working fine ... by tpaulsen Contributor in Splunk Search 03-07-2013 1 2	1	2
Counts and sum of counts I'm sure this is obvious but I'm not seeing it I've a search endiing in "chart count by UserName, host" which gives... by alnapp Engager in Splunk Search 03-07-2013 1 2	1	2
problem with lookup command Hi, I have a master .csv file in which I have 10 rows, now I have one more child file which contains only 4 rows, no... by abhayneilam Contributor in Splunk Search 03-07-2013 0 1	0	1
How do I display the average processing time after the total count? Fellow Splunkers, I have a chart that displays my Apache processing times as such Seconds count 0 1919... by ten_yard_fight Path Finder in Splunk Search 03-06-2013 0 3	0	3
Find Avg Diff two Date fields Splunkers, I have events from our Helpdesk ticketing system that have two date fields, DateOpen and DateClosed, both... by I-Man Communicator in Splunk Search 03-06-2013 0 2	0	2
How to add lookups that don't have matching fields on the log entries Let's say I have log entries as follows: sourcetype-syslog: time, event_id, host I want to be able to incorporate t... by sa_splunk New Member in Splunk Search 03-06-2013 0 2	0	2
How to display matching lookup definitions in a search Is there a way to display lookup definition name or lookup table file name that contains matching value in a search? ... by thipsz Explorer in Splunk Search 03-06-2013 0 2	0	2
Timechart multiple events by a field Hi, I have multiple events that I wish to timechart the top 20, the events look like this: s.d.r.rrm.0.TIME.Range[1,... by nirt Path Finder in Splunk Search 03-06-2013 1 10	1	10
Timestamp Regex need help here! Good Day Splunkers Can you help me to define this in regex format?? Sat Mar 2 01:02:02 2013 +08:00 Thanks in ad... by christantoy Path Finder in Splunk Search 03-06-2013 0 6	0	6
Regex for multiline events I have a file with multiline events. Though there is no structured data in the events, the events themselves can be i... by sansri7680 Path Finder in Splunk Search 03-06-2013 0 4	0	4
Saved Search Start and End Time Hi, I would like to run a daily report at 3 AM and the time range should be Start Time 00:00:00 Finish Time 23:59:... by shangshin Builder in Splunk Search 03-05-2013 0 2	0	2
Efficient way to look for values across many millions (hundreds of, or, billions) of events? Hi, I've got a sourcetype which has around 100,000 values to a field across 225,000,000 events per day, and another ... by howyagoin Contributor in Splunk Search 03-05-2013 0 2	0	2
Group by responseCode Hi I have the following query that creates a report of the major transactions for a website with their count and aver... by tamnor Explorer in Splunk Search 03-05-2013 0 1	0	1
Need to correlate two different data sources Alright, so I am trying to correlate a call data record (essentially the billing part of a telephone call) with a med... by msarro Builder in Splunk Search 03-05-2013 0 1	0	1
Passing a field from a database query to another search DB Connect Hi, I was playing around with DB connect and it is quite cool. However, when I was trying to make a dashboard out ... by stephenho Path Finder in Splunk Search 03-05-2013 0 4	0	4
Local database name Just commenting here because I'm not sure that the documentation is really clear on the point: when adding a local da... by pehlke Splunk Employee in Splunk Search 03-05-2013 0 2	0	2
troublesome double-quotes in macro/subsearch expansion I have a complex macro that works in 4.3 (build 115073) but not 5.0.2 (build 149561). here is an example search: `jo... by jrstear Path Finder in Splunk Search 03-05-2013 0 4	0	4
Creating unique file name for outputcsv I am trying to use this. It will create a file with the correct file name, it just has no contents... Any Ideas? my ... by ShaneNewman Motivator in Splunk Search 03-05-2013 1 11	1	11
Type of Visitor (New or Returning) -> Can be done with single Splunk query? Sampling Period = Daily MAC addresses with 1 count are considered new visitors. MAC addresses with more than one co... by lpolo Motivator in Splunk Search 03-05-2013 0 2	0	2

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community, What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Splunk Search

Using field values as paramaters for macros bis

Unable to extract IP Address and Port number with reg

Use "Splunk" relative times for custom fields?@

Metadata Command Alerting

addcoltotal name?

Problem with the summation in chart command in SPLUNK

How does automatic key=value extraction works?

Counts and sum of counts

problem with lookup command

How do I display the average processing time after the total count?

Find Avg Diff two Date fields

How to add lookups that don't have matching fields on the log entries

How to display matching lookup definitions in a search

Timechart multiple events by a field

Timestamp Regex need help here!

Regex for multiline events

Saved Search Start and End Time

Efficient way to look for values across many millions (hundreds of, or, billions) of events?

Group by responseCode

Need to correlate two different data sources

Passing a field from a database query to another search DB Connect

Local database name

troublesome double-quotes in macro/subsearch expansion

Creating unique file name for outputcsv

Type of Visitor (New or Returning) -> Can be done with single Splunk query?

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers

Some AD groups are not displaying when setting up ...

How to process BOTS data?

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

Splunk Search

Are you a member of the Splunk Community?