Splunk Search

Community Activity

Line breaks and regex help Hello, I am having issues when Splunk is reading an XML file. I need Splunk to know that a transaction starts with ... by j666gak Communicator in Splunk Search 08-15-2012 0 5	0	5
Using the Rest API endpoint, how do i know if a search Completed successfully or errored out? So reading the documentation on http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch#Search_ID it see... by Genti Splunk Employee in Splunk Search 08-15-2012 0 2	0	2
How to display a chart with raw data? How to display a chart with raw data e.g. mysearch \| table MyCount \| timechart MyCount or mysearch \| table MyCount ... by jangid Builder in Splunk Search 08-15-2012 1 2	1	2
timechart of 2 ranges doesn't show old time when hovering over line Hi, I have created a timechart of 2 time ranges: index="XXXX" host="XXXX" earliest=-0w@w latest=+1w@w XXXX \| eval Re... by nirt Path Finder in Splunk Search 08-15-2012 0 3	0	3
Move input to different index I have too many machines (almost 500) logging to a single index. I want to create a new index (which I know how to d... by rblalock New Member in Splunk Search 08-15-2012 0 3	0	3
splunk query drops off results after query has finished I had a query that was working perfectly until recently where it started cutting off the last 4 days of data just for... by imosquera Explorer in Splunk Search 08-15-2012 0 1	0	1
To append or to appendcols? Timecharting same search over different time period Hello Splunkers, I've seen a few questions and one blog post about this topic. Goal: Look at the trend of one user... by cburr2012 Path Finder in Splunk Search 08-15-2012 1 2	1	2
Joining entries using IDs Hi, I am trying to extract an ID from a search and append the results using the extracted ID. Example: Search: host... by m_hunger New Member in Splunk Search 08-15-2012 0 4	0	4
rsyslog regex or another way? So i'm curious, I installed the Windows rsyslog agent on a windows box because I like the idea of being able to use S... by MrWh1t3 Path Finder in Splunk Search 08-15-2012 0 4	0	4
Problems to explore Data The Explore Data button is disabled in my project. I uploaded a CSV file with data, but I can't explote it. It says "... by jiseruk New Member in Splunk Search 08-15-2012 0 2	0	2
Creating a Stacked Graph (Area but coloured like bar) I have the following search: index="cms_test_1" [\|inputlookup Stacked_Worse12.csv \| rename FullURL as cs_uri \| field... by AccentureQBETA Path Finder in Splunk Search 08-15-2012 0 2	0	2
Simple newbie question - "stats count per user" not alerting Gurus I just started playing with splunk and after reading the alert howto it looks like a real-time/rolling window a... by stucky101 Engager in Splunk Search 08-14-2012 0 8	0	8
How do you list the pages visited for a particular session id? I'd like to get a list of sessions each with their page views and session durations like this: Session12324 \| Sessio... by qodeninja Explorer in Splunk Search 08-14-2012 1 5	1	5
contingency command and percent I have a search where I am trying to take the totals and turn them into a percentage. sourcetype="EPPWEB" source="/o... by gnovak Builder in Splunk Search 08-14-2012 0 8	0	8
Modify Splunk Output So here's my problem, I'm using splunk to index some server logs. I am using the splunk javasdk to do a search and ge... by nielsenr New Member in Splunk Search 08-14-2012 0 2	0	2
Remove first line from event types How do i remove the first line from event type when importing a log file into our enviornment? I thought it would be ... by Michael_Schyma1 Contributor in Splunk Search 08-14-2012 0 3	0	3
Interactive field extractor my search is based on the eventtype="someevents" and now I want to extract field and I want to restrict my fields ext... by jangid Builder in Splunk Search 08-14-2012 1 4	1	4
Using regex to capture exactly 20 characters I need to create a field extraction that extracts the first 20 characters ONLY from an error log; I've got the regex ... by hharvey Explorer in Splunk Search 08-14-2012 0 3	0	3
Extract the same field two different ways I want to end up with a filed called mapi_err that contains a MAPI error string. I am looking at the third line in a ... by tstanley Engager in Splunk Search 08-14-2012 1 2	1	2
Splunk for configuration Management Hi Guys, Can we use Splunk for configuration management? I know that splunk can be used for integrity checking of fi... by socteam New Member in Splunk Search 08-14-2012 0 1	0	1
How to exclude result based on static exception file I've got a script that checks various settings on every host and returns data to the indexer via universal forwarder.... by glitchcowboy Path Finder in Splunk Search 08-13-2012 0 3	0	3
Eval ltrim forward slash oddity Hi, Sure I'm missing something obvious, but: Raw data has field "SourceName" which is looks like this: api.internal.... by alnapp Engager in Splunk Search 08-13-2012 0 1	0	1
Adding rex to only part of search Hi all, I have 2 different log file types, 1 of which I currently need to add fields in search time and the other al... by DamianS Explorer in Splunk Search 08-13-2012 0 4	0	4
Usage suggestion for eval It would be great if "eval" could do multiple evaluations in a single command, in a similar way that "stats" can: st... by brettcave Builder in Splunk Search 08-13-2012 4 2	4	2
What is difference between report and field extraction? What is the difference between REPORT- and FIELD-? by jangid Builder in Splunk Search 08-13-2012 3 8	3	8

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars Sometimes, you just need to see the code. For those looking for a ...

Splunk Search

Line breaks and regex help

Using the Rest API endpoint, how do i know if a search Completed successfully or errored out?

How to display a chart with raw data?

timechart of 2 ranges doesn't show old time when hovering over line

Move input to different index

splunk query drops off results after query has finished

To append or to appendcols? Timecharting same search over different time period

Joining entries using IDs

rsyslog regex or another way?

Problems to explore Data

Creating a Stacked Graph (Area but coloured like bar)

Simple newbie question - "stats count per user" not alerting

How do you list the pages visited for a particular session id?

contingency command and percent

Modify Splunk Output

Remove first line from event types

Interactive field extractor

Using regex to capture exactly 20 characters

Extract the same field two different ways

Splunk for configuration Management

How to exclude result based on static exception file

Eval ltrim forward slash oddity

Adding rex to only part of search

Usage suggestion for eval

What is difference between report and field extraction?

Splunk MCP & Agentic AI: Machine Data Without Limits

Finding Based Detections General Availability

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

MLTKC how should i check jupyter notebook func in ...

Splunk Search

Join the Conversation