Splunk Search

Community Activity

addcoltotal name? Hi, I have a table that gives me connections, and I want to show those connections, plus a total. The search works, ... by a212830 Champion in Splunk Search 03-07-2013 0 3	0	3
Problem with the summation in chart command in SPLUNK Hi, I want to find out how what is the total number of "Exit" and "Entry" for the particular CARD_NUMBER for a parti... by abhayneilam Contributor in Splunk Search 03-07-2013 0 6	0	6
How does automatic key=value extraction works? Hello, we have a logfile that contains key=value pairs. Usually Splunks automatic field extraction is working fine ... by tpaulsen Contributor in Splunk Search 03-07-2013 1 2	1	2
Counts and sum of counts I'm sure this is obvious but I'm not seeing it I've a search endiing in "chart count by UserName, host" which gives... by alnapp Engager in Splunk Search 03-07-2013 1 2	1	2
problem with lookup command Hi, I have a master .csv file in which I have 10 rows, now I have one more child file which contains only 4 rows, no... by abhayneilam Contributor in Splunk Search 03-07-2013 0 1	0	1
How do I display the average processing time after the total count? Fellow Splunkers, I have a chart that displays my Apache processing times as such Seconds count 0 1919... by ten_yard_fight Path Finder in Splunk Search 03-06-2013 0 3	0	3
Find Avg Diff two Date fields Splunkers, I have events from our Helpdesk ticketing system that have two date fields, DateOpen and DateClosed, both... by I-Man Communicator in Splunk Search 03-06-2013 0 2	0	2
How to add lookups that don't have matching fields on the log entries Let's say I have log entries as follows: sourcetype-syslog: time, event_id, host I want to be able to incorporate t... by sa_splunk New Member in Splunk Search 03-06-2013 0 2	0	2
How to display matching lookup definitions in a search Is there a way to display lookup definition name or lookup table file name that contains matching value in a search? ... by thipsz Explorer in Splunk Search 03-06-2013 0 2	0	2
Timechart multiple events by a field Hi, I have multiple events that I wish to timechart the top 20, the events look like this: s.d.r.rrm.0.TIME.Range[1,... by nirt Path Finder in Splunk Search 03-06-2013 1 10	1	10
Timestamp Regex need help here! Good Day Splunkers Can you help me to define this in regex format?? Sat Mar 2 01:02:02 2013 +08:00 Thanks in ad... by christantoy Path Finder in Splunk Search 03-06-2013 0 6	0	6
Regex for multiline events I have a file with multiline events. Though there is no structured data in the events, the events themselves can be i... by sansri7680 Path Finder in Splunk Search 03-06-2013 0 4	0	4
Saved Search Start and End Time Hi, I would like to run a daily report at 3 AM and the time range should be Start Time 00:00:00 Finish Time 23:59:... by shangshin Builder in Splunk Search 03-05-2013 0 2	0	2
Efficient way to look for values across many millions (hundreds of, or, billions) of events? Hi, I've got a sourcetype which has around 100,000 values to a field across 225,000,000 events per day, and another ... by howyagoin Contributor in Splunk Search 03-05-2013 0 2	0	2
Group by responseCode Hi I have the following query that creates a report of the major transactions for a website with their count and aver... by tamnor Explorer in Splunk Search 03-05-2013 0 1	0	1
Need to correlate two different data sources Alright, so I am trying to correlate a call data record (essentially the billing part of a telephone call) with a med... by msarro Builder in Splunk Search 03-05-2013 0 1	0	1
Passing a field from a database query to another search DB Connect Hi, I was playing around with DB connect and it is quite cool. However, when I was trying to make a dashboard out ... by stephenho Path Finder in Splunk Search 03-05-2013 0 4	0	4
Local database name Just commenting here because I'm not sure that the documentation is really clear on the point: when adding a local da... by pehlke Splunk Employee in Splunk Search 03-05-2013 0 2	0	2
troublesome double-quotes in macro/subsearch expansion I have a complex macro that works in 4.3 (build 115073) but not 5.0.2 (build 149561). here is an example search: `jo... by jrstear Path Finder in Splunk Search 03-05-2013 0 4	0	4
Creating unique file name for outputcsv I am trying to use this. It will create a file with the correct file name, it just has no contents... Any Ideas? my ... by ShaneNewman Motivator in Splunk Search 03-05-2013 1 11	1	11
Type of Visitor (New or Returning) -> Can be done with single Splunk query? Sampling Period = Daily MAC addresses with 1 count are considered new visitors. MAC addresses with more than one co... by lpolo Motivator in Splunk Search 03-05-2013 0 2	0	2
Splunk query - update a field with first value of the field I'm trying to write a query that converts table 1 to table 2 Basically, i want to retain first value of flower for ci... by ma_anand1984 Contributor in Splunk Search 03-05-2013 0 1	0	1
Returning a computed expression in a subsearch I am using a subsearch to build part of a query. The query is complex so I need to build the search that I want and ... by fk319 Builder in Splunk Search 03-05-2013 0 6	0	6
Could not use strptime to parse timestamp I have researched this error previously (and found a lot of helpful material). I am stuck with a slightly complicated... by asarolkar Builder in Splunk Search 03-05-2013 0 3	0	3
No results found, I want to show other message！！！ Search : index=server1 \| table processName porcessCount result A : search has a results. processName processCoun... by caiyundong Engager in Splunk Search 03-05-2013 2 2	2	2

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Splunk Search

addcoltotal name?

Problem with the summation in chart command in SPLUNK

How does automatic key=value extraction works?

Counts and sum of counts

problem with lookup command

How do I display the average processing time after the total count?

Find Avg Diff two Date fields

How to add lookups that don't have matching fields on the log entries

How to display matching lookup definitions in a search

Timechart multiple events by a field

Timestamp Regex need help here!

Regex for multiline events

Saved Search Start and End Time

Efficient way to look for values across many millions (hundreds of, or, billions) of events?

Group by responseCode

Need to correlate two different data sources

Passing a field from a database query to another search DB Connect

Local database name

troublesome double-quotes in macro/subsearch expansion

Creating unique file name for outputcsv

Type of Visitor (New or Returning) -> Can be done with single Splunk query?

Splunk query - update a field with first value of the field

Returning a computed expression in a subsearch

Could not use strptime to parse timestamp

No results found, I want to show other message！！！

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

Data Management Digest – December 2025

Index This | What is broken 80% of the time by February?

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

MLTKC how should i check jupyter notebook func in ...

ITSI thresholds: adaptive vs static

Splunk Search

Join the Conversation