Splunk Search

Community Activity

Percentile calculation source="file.txt" \| transaction startswith="message1" endswith="message2" \| stats count values(duration) as DUR log... by chaitu99 Explorer in Splunk Search 03-18-2013 0 1	0	1
Timechart - _time subsearch issue I need to feed several days most busy hour into a weighted score evolution over time, which I'm running troubles int... by splunk_zen Builder in Splunk Search 03-18-2013 1 9	1	9
Restricting search using lookup table I have a scenario where I need to restrict 100+ users within an index to their respective departments. I created an a... by nandm New Member in Splunk Search 03-18-2013 0 1	0	1
More chart types In fact this question is an app or enhancement request. It would be extremely useful to have more chart types, like i... by iKate Builder in Splunk Search 03-18-2013 1 1	1	1
Problem with a wildcard in a field name This works: \| chart count(eval(file_date="invalid")) AS "Invalid Date Syntax" It returns "6" This doesn't work: \| c... by terryloar Path Finder in Splunk Search 03-18-2013 0 2	0	2
How to list unsuccessfully extracted fields event? dear all as title mentioned , i found some fields extraction can not reach 100 percent on total event, how can i lis... by hjwang Contributor in Splunk Search 03-16-2013 0 3	0	3
How to correlate error codes with the PDF documents, KEDB ? I want to introduce Splunk to IT operations. One of our operations is to investigate the problem with error codes of ... by sunrise Contributor in Splunk Search 03-16-2013 1 1	1	1
New to Splunk... trying to tie in to DocuSign's system for reporting Hi there, I'm new to Splunk, and I'm not 100% sure if its functionality enable it to tie in to Docusign's system via... by apzuckerman New Member in Splunk Search 03-15-2013 0 1	0	1
Extracting multiple similar values from a multi-line event I've got a rather tricky (at least for me) data set that I'd like to extract values from. For this example text ` ... by mikelanghorst Motivator in Splunk Search 03-15-2013 0 2	0	2
REX separator in search string I have 2 separate rex extractions. Both work fine individually. I need to combine both these rex's into single search... by p_basanth New Member in Splunk Search 03-15-2013 0 3	0	3
I can't capture an unrecognized field with a space I'm running the following command: host=Computername AND EventCode=1309 \| rename "Exception message" as Exception_mes... by dbaker42 Engager in Splunk Search 03-15-2013 0 4	0	4
[subsearch]: Subsearch produced 173215 results, truncating to maxout 50000.[subsearch]: Search auto-finalized after time limit (60 seconds) reached Hi all, [subsearch]: Subsearch produced 173215 results, truncating to maxout 50000. [subsearch]: Search auto-finalize... by shri_27 Path Finder in Splunk Search 03-15-2013 2 2	2	2
Large lookup files. I am getting a warning in my splunkd.log for DistributedBundleReplicationManger. 03-15-2013 08:44:28.028 -0400 WARN ... by drussell88 Explorer in Splunk Search 03-15-2013 0 2	0	2
passing table column value as new column header I'm trying to make a table that has one of the column headers to have the value as the most occurring value in anothe... by dgadjov Explorer in Splunk Search 03-15-2013 0 1	0	1
Error in Eval Command sourcetype=campusmgr earliest=-72h latest=+72h [search sourcetype=msdhcp earliest=03/10/2013:12:40:00 latest=03/10/20... by KNichol5hd Explorer in Splunk Search 03-15-2013 1 4	1	4
Events recevie date & time After the events received, how to identify the events receiving date & time? by rossikwan Path Finder in Splunk Search 03-15-2013 0 4	0	4
automatic lookup - match_type = wildcard Hi All, Again depending on my favourite support people. I have lookup file looks like below. channel,customer chnl... by KarunK Contributor in Splunk Search 03-15-2013 0 1	0	1
python custom script example Hi, I am very new to python. I need a small example of how to collect splunk search output in python variable. Please... by disha Contributor in Splunk Search 03-15-2013 0 1	0	1
pass the field values to another view and how to get it pass the field values to another view and how to get it,I don't know how to do ??? Please give me some help! thanks! by caiyundong Engager in Splunk Search 03-14-2013 1 2	1	2
convert date time to epoch time for sorting How to convert the date and time in the below format to epoch time? 201303140216 yyyymmddHHMM here hour and minute is... by smolcj Builder in Splunk Search 03-14-2013 0 4	0	4
can we pass the search query through lookup file ? Hi.. Can we pass entire search query using lookup files ? Name,Query A,sourcetype="A" \| table A B,query2 C,quer3 $... by rakesh_498115 Motivator in Splunk Search 03-14-2013 0 1	0	1
multikv and timechart \| changing the default label of line in multiline chart with another dynamic value I am trying to plot the CPU utilisation of all processes on a Solaris server using the following search query: index=... by anuragkapur Explorer in Splunk Search 03-14-2013 0 2	0	2
Line Breaking Issue/Time Stamp for Indextime field extraction Having an issue with line breaking at the time stamp for a particular sourcetype. RAW 2013-03-13T15:32:52.247-0700:... by arrowsmith3 Path Finder in Splunk Search 03-14-2013 0 2	0	2
Search for Access Page Tracking Hi, I think this is similar case as user URL tracking on web sites, and I am trying to track what page a user have ... by melonman Motivator in Splunk Search 03-14-2013 0 5	0	5
Best way to get a subset of metadata results I am trying to get a truncated list of metadata, and cant seem to get the search recognized. How can i filter certain... by sonicZ Contributor in Splunk Search 03-14-2013 0 2	0	2