Splunk Search

Community Activity

Lookup use without lookup definition Hi, I am trying to create dynamic lookup file from search. Before executing search to create lookupfile using output... by melonman Motivator in Splunk Search 08-09-2012 2 2	2	2
Percentage Timechart Hi All, I am trying to plot the percentage of "total requests" vs "total errors" and am unfortunately in need of hel... by paulf Explorer in Splunk Search 08-09-2012 0 1	0	1
Field Extraction - Separate on Colon? I'm trying to extract -all- the fields from a rather complex Oracle Grid Engine log file with a format like this: al... by holtb Explorer in Splunk Search 08-09-2012 1 4	1	4
the search results disappear / how to keep them longer (python SDK) Hi all, I'm writing a cron job (using the Python SDK) that does a search and exports the data to a CSV file (to anal... by tomasv Explorer in Splunk Search 08-09-2012 2 3	2	3
Agent list in OSSEC agent status dashboard is empty Hello. Yesterday I installed OSSEC & Splunk on server, and everything is working great, except two small things: OSSE... by janfabo Explorer in Splunk Search 08-09-2012 0 1	0	1
What is the difference between event listing and tables in a Dashboard? Hello All, I was wondering what is the difference between an event listing and a table? What is shown in an event li... by AntonioM Explorer in Splunk Search 08-09-2012 0 1	0	1
Remove a series of numbers in a field I have a field which is extracted in Splunk with values which look like this: /aa/Application.do?inFrame=uploadframe... by AccentureQBETA Path Finder in Splunk Search 08-09-2012 2 7	2	7
What perms/capabilities needed to create an app What permissions/capabilities are needed for a regular user account that is a member of a role that is derived essent... by skippylou Communicator in Splunk Search 08-08-2012 1 2	1	2
Filtering on HF via regex not working The overview: a syslog server acting as a UF receives data via syslog to various local files. Inputs.conf is specifie... by twhisnant New Member in Splunk Search 08-08-2012 0 3	0	3
configure the timechart to not aggregate any elements into "other" when creating a timechart, it contains a maximum of 10 elements (lines, bars, etc) + one "other". The elements that a... by alboucq Engager in Splunk Search 08-08-2012 3 1	3	1
subsearch semantics I was trying to figure out why my search with subsearch does not work and then I realized that exact semantics of th... by igorbukanov Engager in Splunk Search 08-08-2012 1 1	1	1
Can I increase the number of lines per event displayed in the UI by the EventsViewer module? Hi , I have created some many events ..my events consist of more then 500 lines...but when i click view more lines f... by rakesh_498115 Motivator in Splunk Search 08-08-2012 1 4	1	4
inputlookup and substring search We need to search if a part of URL in the log matches a string from an external file. As I can see, the method from h... by igorbukanov Engager in Splunk Search 08-08-2012 1 2	1	2
Discard specific events (Debug) and keep the rest Hi I want to discard all log which includes "DEBUG" and want to receive only with "INFO and ERROR". I am receiving h... by nikhilagrawal Path Finder in Splunk Search 08-08-2012 0 2	0	2
how to use timechart to to search Hi, i want split the login log by timechart span "30s" in the every "30s",if the login fail count by one ip is bigger... by perlish Communicator in Splunk Search 08-08-2012 1 3	1	3
Couldn't run script command Based on reference: http://www.splunk.com/base/Documentation/4.2/SearchReference/Script I created a perl file that j... by EdSplunk Explorer in Splunk Search 08-08-2012 2 4	2	4
extract from source path not working I tried to follow the directions here to extract a field from the source path of my directory -- but i cant seem to g... by kittle New Member in Splunk Search 08-07-2012 0 3	0	3
Why doesn't the upload image feature of answers work? I tried to answer another user's question with an image that showed where in the interface to click. However, the up... by jrodman Splunk Employee in Splunk Search 08-07-2012 3 3	3	3
Search join with filter I want to do the SQL in Splunk: SELECT TB1.* FROM TB1 JOIN TB2 ON TB2.ID = TB1.ID WHERE TB2.OPTION = "OPTION 1" ... by erick_costa Path Finder in Splunk Search 08-07-2012 0 4	0	4
Regex question I can't seem to figure this one out. I have a line in a log like this: 2012-08-07 12:35:49,138 [http-10.40.231.33-4... by gnovak Builder in Splunk Search 08-07-2012 0 7	0	7
Grouping eventcode Is there a way to group several eventcodes so I dont have to keep on repeating myself. I can not seem to get the righ... by Michael_Schyma1 Contributor in Splunk Search 08-07-2012 0 1	0	1
Ordering Columns Not Working http://splunk-base.splunk.com/answers/49712/can-we-sort-command-for-sorting-the-table-records-rowwise Hi All, I hav... by matthewcanty Communicator in Splunk Search 08-07-2012 0 4	0	4
Width of Single value field in 4.3.3 I've upgraded my Splunk from version 4.3 to version 4.3.3 and my dashboard view has changed. This is version from 4.... by bckq Path Finder in Splunk Search 08-06-2012 0 1	0	1
Complex query I need a query that will provide the average duration of tickets for severity levels 0-4. The individual ticket dura... by DTERM Contributor in Splunk Search 08-06-2012 0 8	0	8
How would I get these results by day I am attempting to write a license usage search and I would like to be able to see the usage for the last 7 days. He... by rmcdougal Path Finder in Splunk Search 08-06-2012 0 1	0	1