Splunk Search

Community Activity

Returning a computed expression in a subsearch I am using a subsearch to build part of a query. The query is complex so I need to build the search that I want and ... by fk319 Builder in Splunk Search 03-05-2013 0 6	0	6
Could not use strptime to parse timestamp I have researched this error previously (and found a lot of helpful material). I am stuck with a slightly complicated... by asarolkar Builder in Splunk Search 03-05-2013 0 3	0	3
No results found, I want to show other message！！！ Search : index=server1 \| table processName porcessCount result A : search has a results. processName processCoun... by caiyundong Engager in Splunk Search 03-05-2013 2 2	2	2
Interactive field extractor sample data Is there a way to control the sample data displayed in the IFX sample data? It is not selective enough for me to see ... by khodges_splunk Splunk Employee in Splunk Search 03-04-2013 1 5	1	5
Calculating Average Time Span I am having problems calculating an average time span. I need to determine how log it takes for a technician to "ack... by capri1231 New Member in Splunk Search 03-04-2013 0 1	0	1
Timestamp extraction issue Hi everyone, I have the following log line which has two timestamps and we need to get the SECOND one. Mar 4 18:5... by asarolkar Builder in Splunk Search 03-04-2013 0 2	0	2
Any other way to simplify this search? Hello I am trying to find out a way if there is any way to use just one search to get the data for all. Can we a pos... by theouhuios Motivator in Splunk Search 03-04-2013 2 4	2	4
Total count per rule, combined with count per rule,ip,port combination Hi all, I am going to try and keep this as simple as I can and explain only what I am trying to achieve and what I h... by aaronnicoli Path Finder in Splunk Search 03-04-2013 0 3	0	3
Eval command on a field with multiple words I want to use the eval command to create another field using an existing field. However, the existing field has multi... by cmak Contributor in Splunk Search 03-04-2013 0 4	0	4
Adding multiple sparklines in a search I am trying to add multiple sparklines to a search. When I use this stats sparkline avg(ProcV) as ProcV sparkline a... by theouhuios Motivator in Splunk Search 03-04-2013 0 1	0	1
Assistance needed for a cleaner regex approach on field with variable content Hi everyone. I am trying to parse SIP dialogs using splunk. Inside the dialog messages, there are TO and FROM lines. ... by msarro Builder in Splunk Search 03-04-2013 0 1	0	1
Regex, Split into fields and timechart I have several of this kind: 8/2/11 2:20:57.000 PM 2011-08-02 14:20:57 Err: DeliveryPolicy:: _deliverRequest: faile... by borisalves Path Finder in Splunk Search 03-04-2013 0 1	0	1
Extract fields from multi value fields I am trying to create a new fields from a multi value fields. Here's an example: group_id, user_id user_address ... by chiwang Explorer in Splunk Search 03-04-2013 0 8	0	8
Find unique person count in Splunk I've below line in my logs: INFO #add-person# #new# personId=12 isGroupMember=true INFO #remove-person# #remove# per... by freephoneid Path Finder in Splunk Search 03-03-2013 0 5	0	5
Filter ip_city in timechart Yello, Being new to Splunk and still amazed at its capabilities, I have this query and trying to filter out ip_city n... by gt2013 Engager in Splunk Search 03-02-2013 0 2	0	2
Compare two periods, results shows only from today I want to search over two periods to measure the average response time of the access data of GET requests. The period... by mkelderm Path Finder in Splunk Search 03-01-2013 2 2	2	2
Splunk unable to index the file ?? Hi .. This is my sample event . splunk is unable to index this file... Is the problem with the '\|' symbol ?? my Sa... by rakesh_498115 Motivator in Splunk Search 03-01-2013 0 4	0	4
Search command Top -> Does not return more than 100K results? I need to index the all the Top N results of a field. Search query: \|top limit=0 field\| streamstats count as rank... by lpolo Motivator in Splunk Search 03-01-2013 0 3	0	3
How can I calculate 2 different search result If I do a search in on index and get a value then I need to search another index to get second value. How can I combi... by chappe4 New Member in Splunk Search 03-01-2013 0 10	0	10
Use Lookup to Add MetaData to Results If I have a lookup table with ID's and descriptions, is it possible to use the lookup table to add the corresponding ... by aapittts Path Finder in Splunk Search 03-01-2013 0 2	0	2
Runtask after log loading Hi all, is it possibile with splunk to execute a custom script (runtask) after the loading of a log? thank you by fede New Member in Splunk Search 03-01-2013 0 1	0	1
Grouping values in bar chart when using inline search Using the search app I can run a search like this: \| chart avg(callcount) by sp_day sp which gives me a bar chart... by MatMeredith Path Finder in Splunk Search 03-01-2013 0 1	0	1
How to write one events to multiple indexes I have many many events and they are all useful but there is a subset that is most important. I want to keep all even... by kmccarthy New Member in Splunk Search 03-01-2013 0 2	0	2
Count number of times a field appears in a single event? I have an event which contains many instances of the same field. Additionally the field is multi-valued. How can I ... by the_wolverine Champion in Splunk Search 03-01-2013 0 2	0	2
graphing over time between values 02/27/2013 21:59 UTC Media Table Statistics.Unique Media Files.value=6277 02/27/2013 20:59 UTC Media Table Statistics... by rdb_splunk Explorer in Splunk Search 02-28-2013 1 2	1	2