Splunk Search

Community Activity

How can I aggregate some values of a field and divide a list into 2 parts? I have 2 questions: Is it possible to aggregate some values of a field into one value?? For example I have in the fie... by Jochen_1987 Explorer in Splunk Search 08-16-2012 0 3	0	3
timechart span using used time instead of full hour Hello Lets say you timechart with span=1h and within that hour you have 10000 requests that you need to calculate th... by tuxford Path Finder in Splunk Search 08-16-2012 0 3	0	3
How do I show default search app's dashboard How Do I display default search app in my app? http://mjserver:8000/en-US/app/search/dashboard_live Within my app I... by jangid Builder in Splunk Search 08-16-2012 0 1	0	1
Save chart as image Hello, I would like to know if it is possible to save a chart as an image. I read on one answer that there should be ... by atelesca Explorer in Splunk Search 08-16-2012 1 1	1	1
Scheduled frequently vs scheduled real-time search load Hi, I assume this has been asked several times before, but I haven’t found a good discussion on it… What are the ho... by mark Path Finder in Splunk Search 08-15-2012 1 1	1	1
Real-time alerting with search head pooling Hi, We have a distributed environment with 2 search heads in a pool (for LB and HA) running v4.3.0 (upgrading shortl... by mark Path Finder in Splunk Search 08-15-2012 1 1	1	1
How to get an avg field result in a stats values command Hello Splunk Users I m trying to get an average response time per IP for a few sites I m monitoring. \| stats value... by egrignon Explorer in Splunk Search 08-15-2012 0 2	0	2
Line breaks and regex help Hello, I am having issues when Splunk is reading an XML file. I need Splunk to know that a transaction starts with ... by j666gak Communicator in Splunk Search 08-15-2012 0 5	0	5
Using the Rest API endpoint, how do i know if a search Completed successfully or errored out? So reading the documentation on http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch#Search_ID it see... by Genti Splunk Employee in Splunk Search 08-15-2012 0 2	0	2
How to display a chart with raw data? How to display a chart with raw data e.g. mysearch \| table MyCount \| timechart MyCount or mysearch \| table MyCount ... by jangid Builder in Splunk Search 08-15-2012 1 2	1	2
timechart of 2 ranges doesn't show old time when hovering over line Hi, I have created a timechart of 2 time ranges: index="XXXX" host="XXXX" earliest=-0w@w latest=+1w@w XXXX \| eval Re... by nirt Path Finder in Splunk Search 08-15-2012 0 3	0	3
Move input to different index I have too many machines (almost 500) logging to a single index. I want to create a new index (which I know how to d... by rblalock New Member in Splunk Search 08-15-2012 0 3	0	3
splunk query drops off results after query has finished I had a query that was working perfectly until recently where it started cutting off the last 4 days of data just for... by imosquera Explorer in Splunk Search 08-15-2012 0 1	0	1
To append or to appendcols? Timecharting same search over different time period Hello Splunkers, I've seen a few questions and one blog post about this topic. Goal: Look at the trend of one user... by cburr2012 Path Finder in Splunk Search 08-15-2012 1 2	1	2
Joining entries using IDs Hi, I am trying to extract an ID from a search and append the results using the extracted ID. Example: Search: host... by m_hunger New Member in Splunk Search 08-15-2012 0 4	0	4
rsyslog regex or another way? So i'm curious, I installed the Windows rsyslog agent on a windows box because I like the idea of being able to use S... by MrWh1t3 Path Finder in Splunk Search 08-15-2012 0 4	0	4
Problems to explore Data The Explore Data button is disabled in my project. I uploaded a CSV file with data, but I can't explote it. It says "... by jiseruk New Member in Splunk Search 08-15-2012 0 2	0	2
Creating a Stacked Graph (Area but coloured like bar) I have the following search: index="cms_test_1" [\|inputlookup Stacked_Worse12.csv \| rename FullURL as cs_uri \| field... by AccentureQBETA Path Finder in Splunk Search 08-15-2012 0 2	0	2
Simple newbie question - "stats count per user" not alerting Gurus I just started playing with splunk and after reading the alert howto it looks like a real-time/rolling window a... by stucky101 Engager in Splunk Search 08-14-2012 0 8	0	8
How do you list the pages visited for a particular session id? I'd like to get a list of sessions each with their page views and session durations like this: Session12324 \| Sessio... by qodeninja Explorer in Splunk Search 08-14-2012 1 5	1	5
contingency command and percent I have a search where I am trying to take the totals and turn them into a percentage. sourcetype="EPPWEB" source="/o... by gnovak Builder in Splunk Search 08-14-2012 0 8	0	8
Modify Splunk Output So here's my problem, I'm using splunk to index some server logs. I am using the splunk javasdk to do a search and ge... by nielsenr New Member in Splunk Search 08-14-2012 0 2	0	2
Remove first line from event types How do i remove the first line from event type when importing a log file into our enviornment? I thought it would be ... by Michael_Schyma1 Contributor in Splunk Search 08-14-2012 0 3	0	3
Interactive field extractor my search is based on the eventtype="someevents" and now I want to extract field and I want to restrict my fields ext... by jangid Builder in Splunk Search 08-14-2012 1 4	1	4
Using regex to capture exactly 20 characters I need to create a field extraction that extracts the first 20 characters ONLY from an error log; I've got the regex ... by hharvey Explorer in Splunk Search 08-14-2012 0 3	0	3

Get Updates on the Splunk Community!

Index This | What has goals but no motivation?

June 2026 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

How can I aggregate some values of a field and divide a list into 2 parts?

timechart span using used time instead of full hour

How do I show default search app's dashboard

Save chart as image

Scheduled frequently vs scheduled real-time search load

Real-time alerting with search head pooling

How to get an avg field result in a stats values command

Line breaks and regex help

Using the Rest API endpoint, how do i know if a search Completed successfully or errored out?

How to display a chart with raw data?

timechart of 2 ranges doesn't show old time when hovering over line

Move input to different index

splunk query drops off results after query has finished

To append or to appendcols? Timecharting same search over different time period

Joining entries using IDs

rsyslog regex or another way?

Problems to explore Data

Creating a Stacked Graph (Area but coloured like bar)

Simple newbie question - "stats count per user" not alerting

How do you list the pages visited for a particular session id?

contingency command and percent

Modify Splunk Output

Remove first line from event types

Interactive field extractor

Using regex to capture exactly 20 characters

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation