Splunk Search

Community Activity

REX not working in props.conf I am using this rex command \| rex max_match=100 "(?i)<severity>(?P<Severity>[^<]+)" When I add this to the props.c... by hartfoml Motivator in Splunk Search 11-26-2012 0 3	0	3
transformation : set a field value according to the host I'd like to set at search_time a new field, with a value according to the host : if host=abc.com then =test elseif h... by sbsbb Builder in Splunk Search 11-25-2012 0 2	0	2
sapninja data collection framework hi , can someone help me with sapninja data collection framework which is used for data collection for the app Splu... by nawneel Communicator in Splunk Search 11-24-2012 0 3	0	3
Joining two large datasets without a Join I have two data sources, one that is a very large file listing with *nix timestamps, and one that has a text descript... by splunk_eval Explorer in Splunk Search 11-23-2012 1 4	1	4
Fields extraction problem HI Experts. I did fields extraction in regexr, The fields matching in regexr is no problem. But, On splunk , we ca... by himang2c New Member in Splunk Search 11-23-2012 0 4	0	4
How to supress the x axis label in timechart I use a lot of timechart searches for a dashboard, each of them showing the "_time" label in the x-axis. As it is cl... by FRoth Contributor in Splunk Search 11-23-2012 3 6	3	6
Nav menu problem ??? Hi .. i have created a APP in splunk .and i have change its nav menu as below.. Google Now when i click on Googl... by rakesh_498115 Motivator in Splunk Search 11-23-2012 0 2	0	2
5 and above login failures I have managed to create a search that finds users that have failed to login within the last 24 hours but I want to o... by robK123 Explorer in Splunk Search 11-23-2012 0 2	0	2
no longer seeing all logs after clearing index I am no longer seeing all my logs on the indexer after clearing the index of all data. Is there something that needs ... by jonathanfalconi Explorer in Splunk Search 11-23-2012 0 10	0	10
Transactions which are overlapping Hourly Job 1245 started Hourly Job 1246 started Hourly Job 1246 completed -- Hourly Job 1245 completed How to... by 1234testtest Path Finder in Splunk Search 11-23-2012 0 1	0	1
Is there a way to timechat the number of open sessions given a login and logout event? Hi all, I have login and logout events and I'm trying to plot a graph showing the number of open sessions each minut... by DamianS Explorer in Splunk Search 11-23-2012 0 4	0	4
sum of average values based on two other columns hi, given the following data time, hub, port, unique ip count 12:11:01 a 1 23 12:11:02 b 2 34 12:... by stephen123 Path Finder in Splunk Search 11-23-2012 0 1	0	1
How to find deltas for multiple fields generically Currently, the query ... \| timechart span=1hr count by term limit=10 gives me _time apple orange banana... by benobviate Explorer in Splunk Search 11-22-2012 0 2	0	2
eval function inside chart using a variable Hello the splunk community, I'm kinda new to splunk, and I'm trying to perform some charting using the eval function... by guilhem Contributor in Splunk Search 11-22-2012 0 1	0	1
timechart does not dis play the error hi all , I used the below query ..but i am not getting the timechart its shows field '_time' should have numerical... by splunkpoornima Communicator in Splunk Search 11-22-2012 0 6	0	6
Need to extract fields Hi, I have the following in my logs dataSetListCountInfo_HKG_generic=2 dataSetListCountInfoicm=72 dataSetListCount... by ashu_g50 Path Finder in Splunk Search 11-22-2012 0 8	0	8
set a value at search time I made a Union with APPEND betwenn to search : search1 APPEND [search2] I want to have a field "source" that has a ... by sbsbb Builder in Splunk Search 11-22-2012 0 2	0	2
Making a table from data with objects in an array I have data that looks like {<!-- --> event: "request", timers: [ {<!-- --> category : "serverA", dur... by benobviate Explorer in Splunk Search 11-21-2012 0 3	0	3
newb help creating an alert Hi there, i'm somewhat new to splunk and hoping some of the more seasoned veterans can assist me. I have a process ... by plastiiq Explorer in Splunk Search 11-21-2012 0 1	0	1
locating dead hosts I am trying to get a report of all hosts that have not reported any events in the last 2 hours. I am using: \| metad... by rbellini Explorer in Splunk Search 11-21-2012 0 5	0	5
Problems with props.conf and transforms.conf and similar hostnames I have 2 hostnames, let's call them "temp" and "temp001". Splunk is capturing "temp001" and placing it in the proper ... by aferone Builder in Splunk Search 11-21-2012 0 15	0	15
Lookup: Escaping quotation character in field value Hi SB, Playing around with lookup tables and it appears I can not have an escaped quotation character (e.g. ") withi... by MHibbin Influencer in Splunk Search 11-21-2012 0 1	0	1
Tracking user activity on website Hey, I have problem to determine the urls which lead a customer to a certain url "x". I have an apache-log in which I... by jtworzydlo Path Finder in Splunk Search 11-21-2012 0 2	0	2
Show Single Value Panels in a Table I have 66 single value panels to display in my dashboard. So far I am finding that I can only go three columns wide... by aleem SplunkTrust in Splunk Search 11-21-2012 2 3	2	3
Sequencing Saved Searches Hi, I have a saved search, which is currently scheduled, and creates a summary index. I have other saved searches t... by JovanMilosevic Path Finder in Splunk Search 11-21-2012 0 2	0	2