Splunk Search

Community Activity

Regex after delimited field extraction After a delimited field extraction in transforms.conf, I have a field called Gateway_Name that contains, for example,... by tnkoehn Path Finder in Splunk Search 12-18-2012 1 4	1	4
Extracted field as variable Hi everyone, A simple question about the field extractions. Suppose I've got 12 logs with basically some recurrent i... by quatral Explorer in Splunk Search 12-18-2012 1 3	1	3
Why comparision not working when field is having value "" fieldA is the extracted field already available fieldB is eval field \| eval fieldB= \| where fieldA=fieldB Here im... by ma_anand1984 Contributor in Splunk Search 12-18-2012 0 4	0	4
Separate Fields Hi, I'm new to splunk, so please excuse the basic question. I have some data in the following format: Field1=abcdef... by jaykay New Member in Splunk Search 12-18-2012 0 4	0	4
Create unique field counts from comma deliminated line I have a log file that always has the same structure of: time1,time2,groupNumber eg: 355350224,338837556,2 135535022... by chablist New Member in Splunk Search 12-18-2012 0 1	0	1
Create unique field counts from comma deliminated line I have a log file that always has the same structure of: time1,time2,groupNumber eg: 355350224,338837556,2 135535022... by chablist New Member in Splunk Search 12-17-2012 0 1	0	1
macro with 2 arguments and a where clause hi, i have a search query like index=main a=* OR b=* 'macroname("a","b")' \|table b b1 b2 b3 my macro is like macr... by smolcj Builder in Splunk Search 12-17-2012 1 4	1	4
Determine time value based on count and Average duration This may not be possible but I work at a SAAS company and we want to start evaluating which of our web methods that a... by jericksonpf Path Finder in Splunk Search 12-17-2012 0 5	0	5
Comparing data from two files and showing the results. I have two files with a simple list of filenames in each. What I'd like to do is to compare one file to the other and... by malag_doval Engager in Splunk Search 12-17-2012 0 8	0	8
Timeformat not sorting properly I am using this search: sourcetype="foo" name="foobar*" \| convert timeformat="%m/%d/%Y - %a" ctime(_time) AS Date \| ... by hartfoml Motivator in Splunk Search 12-17-2012 0 4	0	4
How to do this below? Hi all, Am new to splunk tool and i have downloaded to use my project for reporting,analysis,charts and alerts notif... by balajsoz Path Finder in Splunk Search 12-17-2012 0 1	0	1
Multikv not extracting data Hello I am trying to input data of free -tm in splunk. The raw data would look like total used ... by theouhuios Motivator in Splunk Search 12-17-2012 0 4	0	4
Problem with set command I'm trying to get use the set command to monitor differences between two sets of DNS records. I've looked through th... by megancarney Explorer in Splunk Search 12-16-2012 0 3	0	3
extract from calculated field I can't find anything that says you can't do a field extraction from a calculated field, but I found that this works ... by pwattssplunk Splunk Employee in Splunk Search 12-15-2012 0 2	0	2
Main differences between a saved report and a saved search I wonder if there is any site in splunk Docs that clearly define the distinct differences between the two of them. I ... by e82than Communicator in Splunk Search 12-15-2012 1 2	1	2
OR (\|) condition in regular expression I am missing something in my regular expression I am having similar log and I can do with two regex but I want to com... by jangid Builder in Splunk Search 12-14-2012 0 3	0	3
Dividing Field by a Number in stats Hi, How do I divide a field by a number. I want to divide Att.Duration by 100 and use the new field in the stats s... by yinon_nadav New Member in Splunk Search 12-14-2012 0 3	0	3
Splunk search regex how to?? from this string 'op-failed', 'text': "[Errno 2] bad format", 'time': 1355388330.578211, 'error': 'fetch-error'} how ... by hostedtower3 New Member in Splunk Search 12-14-2012 0 5	0	5
Time Specifier (Yesterday 12AM until Yesterday at current time) Trying to compare numbers of events that have come in from 12AM until NOW, with yesterday's data 12AM until NOW(Yeste... by beaunewcomb Communicator in Splunk Search 12-14-2012 0 2	0	2
External file lookup is failing, possible due to a "/" character in the lookup fields. Hi all, I'm having trouble getting an external file lookup to work in the Search app. I've setup a number of these p... by martinpugh Explorer in Splunk Search 12-14-2012 0 4	0	4
How to create a field with a value repeated a number of times when the number of time comes from another field - to get around concurrency limitation Hi, I am trying to implement our requirement for "concurrency". Lets say we want to measure user concurrency every 5 ... by fere Path Finder in Splunk Search 12-14-2012 0 1	0	1
Can we replace certain value in field ?? Hi , I have a field called UniqueID which contains the following values..like A,B,C,D etc..Now For this field i want... by rakesh_498115 Motivator in Splunk Search 12-14-2012 1 11	1	11
How to modify / change x axis values in timechart graph? Hi all, I have created a graph which shows time intervals in x axis and application up or down time % in y axis.I ha... by balajsoz Path Finder in Splunk Search 12-14-2012 1 1	1	1
Custom dynamic field extraction Dear fellow splunkers, I've got some events where the automatic field extraction of Splunk doesn't work. The log for... by Simon Contributor in Splunk Search 12-14-2012 0 2	0	2
Are Lookups appropriate here? I work with a bunch of media companies and on monthly basis licensing for the content they provide changes. So this ... by marquiselee Path Finder in Splunk Search 12-13-2012 0 4	0	4