Splunk Search

Community Activity

Importing External Lookup Table from PostgresDB Hi, I would like to import an external lookup table from a postgres DB. What would be the best way to do this? T... by balbano Contributor in Splunk Search 07-16-2012 0 2	0	2
Sum of running total at the top not bottom. .....\|top limit=0 app_id app_name \| fields + count, total_count, percent,app_name, app_id \| accum count AS total_co... by Michael_Schyma1 Contributor in Splunk Search 07-16-2012 0 4	0	4
Is it possible to genereate parallell time charts liks this? IS is possible to draw charts in Splunk that can show multi-channel data in the same chart? Similar to the multi-chan... by sune43 Engager in Splunk Search 07-16-2012 1 1	1	1
Regex extracting field values, but unable to find them when added to search Hi Splunkers & Splunkettes, I am currently defining some sourcetypes for some db2 SMF logs and have finally got the ... by rturk Builder in Splunk Search 07-15-2012 0 3	0	3
v4.1.4 REGEX works.....v4.3.2 Doesn't I have a hostname extraction TRANSFORMS.conf that works in v4.1.4, but since our upgrade to v4.3.2 it now doesn't ext... by MasterOogway Communicator in Splunk Search 07-14-2012 0 1	0	1
Comparing averages and counts between different hours Hello, I have a search that returns records like those: PivotField1 hour1 countOfCalls averageDuration PivotField1 h... by dantonag Explorer in Splunk Search 07-14-2012 0 3	0	3
how to change result of alert from gzip to CSV? Hi All, I have a problem. I create a scheduler search to retrieve a list of IP access to my web server exceeds a cert... by dungpv Explorer in Splunk Search 07-14-2012 0 1	0	1
How to quickly validate the metadata files of a given index and of all its buckets? When the filesystem that Splunk uses to store its indexes becomes unavailable, goes into read-only mode or Splunk cra... by hexx Splunk Employee in Splunk Search 07-13-2012 6 4	6	4
Field extraction and Splunk forwarding I have systems sending data to splunk1 in the form: k1=v1 k2=v2 I have field extraction configured for the sourcetype... by lrhazi Path Finder in Splunk Search 07-13-2012 0 4	0	4
Real-time search with fixed start I'd like to create a real-time search and chart plotting logged values since midnight. My search is below. eventtype=... by marksnelling Communicator in Splunk Search 07-13-2012 0 4	0	4
Map a closed network Hello, I am curious if there is a solution to map internal networks that do not have connections to internet. We hav... by MrWh1t3 Path Finder in Splunk Search 07-13-2012 0 2	0	2
how to sum everyday result this is my search srcipt, it will show everyday use some apps count sourcetype="acclog" app="molly" OR app="wms" \|ti... by ypfbkg Explorer in Splunk Search 07-12-2012 0 4	0	4
Static map of user ID with user name A finger print server log generates a user ID. Active directory log has user name. I have excel sheet for the user I... by nuwan New Member in Splunk Search 07-12-2012 0 2	0	2
Most recent event from each source? I'm looking for an efficient way to retrieve the single most recent event from each of about 2000 sources. It seems ... by yoeljacobsen Explorer in Splunk Search 07-12-2012 2 9	2	9
string to time and then timechart Hi All, I am trying to extract the timestamps from the log file name (source) and then find how many logs are produc... by KarunK Contributor in Splunk Search 07-12-2012 1 3	1	3
search group by I am doing a internal audit for splunk log, the query is following index="_audit" action = edit_user NOT "search" \|... by cheeseng New Member in Splunk Search 07-12-2012 0 1	0	1
Can't extract named fields I am collecting syslogs from the network (UDP 514) and they are all coming in as sourcetype=syslog. I did not see a c... by hortone New Member in Splunk Search 07-11-2012 0 1	0	1
Search is not listing the Extracted field I am having problems with an extracted field not showing in the search results. I am indexing a log file that among ... by bshamsian Path Finder in Splunk Search 07-11-2012 0 1	0	1
The search that you sent to the background has completed Hi, We have an issue about receiving email tells "The search that you sent to the background has completed" We recei... by Anthony_Hou Path Finder in Splunk Search 07-11-2012 0 2	0	2
Extraction of an indexed field in summary indexes I'm having a field that is being specifically indexed (and not extracted during search time). The following configura... by bojanz Communicator in Splunk Search 07-11-2012 0 7	0	7
Bubble Charts input data structure [lacking documentation] From the latest docs, this is the simplest prerequisite to build a bubble chart, "1. A single series structure that ... by splunk_zen Builder in Splunk Search 07-11-2012 1 6	1	6
Best practice for field extraction What is the best option for field extraction? my log file contain some data separated with # and I want to convert t... by jangid Builder in Splunk Search 07-11-2012 0 8	0	8
Multiple Lookups from Sourcetype Hi, Is it possible to perform a more than 1x lookup on a number of fields? I have 2x IP fields, one is a source ip a... by paulf Explorer in Splunk Search 07-11-2012 1 2	1	2
Regex: Issue with domain name extraction from URL field Greetings Splunkers! I posed this question in the IRC channel, but thought I'd put it in here as well just in case a... by rturk Builder in Splunk Search 07-11-2012 0 11	0	11
time difference between two events. Hi, I need to calucalte the time difference between two events in splunk..using the transaction command ....how can ... by rakesh_498115 Motivator in Splunk Search 07-11-2012 0 1	0	1