Splunk Search

Community Activity

Error in 'inputlookup' command I get the following error: "Error in 'inputlookup' command: This command must be the first command of a search." F... by terryloar Path Finder in Splunk Search 07-05-2012 1 1	1	1
Events not found, even though dashboard says there are I have a universal forwarder pulling in a log file from a linux server. It has been working just fine up until the o... by gregwilliams Path Finder in Splunk Search 07-05-2012 0 6	0	6
how to create fields from _raw field How to create a field from _raw field? my _raw field have some common pattern e.g. I0703 15:07:20.627351 3108 logg... by jangid Builder in Splunk Search 07-05-2012 0 6	0	6
Calculate time difference, then calculate average duration per severity level This is a sample snippet from a very large log file: lastOccurrence=2012/07/05 13:56:14\|firstOccurrence=2012/06/18 1... by DTERM Contributor in Splunk Search 07-05-2012 0 1	0	1
What's the wrong in this search? I want to extract processid from my log and here is query eventtype=statustrace \| regex _raw="^[IEWF]" \| rex field=_... by jangid Builder in Splunk Search 07-05-2012 0 5	0	5
Field transformation hello, I have this following log in Splunk: RS:D2T,PAN:1/1,Req:fr18126,User:a169805,TKN:g00e29dfd883effecba,H:W6008... by LauraBre Communicator in Splunk Search 07-05-2012 0 2	0	2
limit to case function? Hi this is a simple case query I ran on splunk ... \| eval country=case(country="US","USA",country="CA","CA","rest") ... by Yarsa Path Finder in Splunk Search 07-05-2012 0 1	0	1
where did result of search store? Hi Everyone, I have one question. I have excuted searching and created alert data in splunk. I saw alert on tab alert... by dungpv Explorer in Splunk Search 07-04-2012 0 4	0	4
Extracting Report from CISCO FW Logs We have installed Splunk recently and forwarding our Cisco FW logs through syslog. We have also installed the Splunk ... by msamant New Member in Splunk Search 07-04-2012 0 6	0	6
How to insert static data in dashboard? Hello Let's say there are several Excel tables and it is needed to make graphs using its data in Splunk dashboard. H... by iKate Builder in Splunk Search 07-04-2012 0 3	0	3
Monitor specific set of Processes from WMI Hi, What I'm attempting to do is monitor a specific set of processes on a machine. For this, I am obtaining data fro... by joshhenderson Explorer in Splunk Search 07-03-2012 1 2	1	2
grouping similar field values I have a set of events that are generated with locations in the form of xloc and yloc. (z, or height, is irrelevant) ... by atreece Path Finder in Splunk Search 07-03-2012 0 1	0	1
Sub-Domain Count I am looking to pull all domains from dns logs and get a count of how many unique sub-domains that were requested of ... by queme Explorer in Splunk Search 07-03-2012 0 5	0	5
Multiple filters in multiple sourcetypes to be pushed to nullqueue I am trying to filter out events whenever the "healthcheck" url below appears. 2012-07-02 15:29:52,190 DEBUG [http-0... by asarolkar Builder in Splunk Search 07-03-2012 0 7	0	7
Stat user duration connection Hello, I would like to know if it's possible with Splunk to know the connection time of each user by day or month fo... by gloudou Engager in Splunk Search 07-03-2012 0 3	0	3
Have two searches by count on one chart and their sum Hey everyone! I just started using Splunk and am having trouble finding a way to have a line graph with 3 separate li... by klaurean Engager in Splunk Search 07-02-2012 0 2	0	2
REGEX for nullQueue in transforms.conf We have a certain logfile (tied to sourcetype: syslog) inbound from a forwarder which has THIS line in it: 2012-07-... by asarolkar Builder in Splunk Search 07-02-2012 1 2	1	2
Help with stats for troubleshooting different result sets I have a table with the following fields: table qualys_id,exploit_cve_id,exploit_name,exploit_source,exploit_url Do... by responsys_cm Builder in Splunk Search 07-02-2012 0 1	0	1
Can't get lookups to work I am just using some test data that I generated to try to get lookups to work. First, my log (completely manually ge... by timmy13 Communicator in Splunk Search 07-02-2012 0 4	0	4
Custom _time extraction I would like to use a field in my event data for the _time field. It looks like: <LAST_UPDATE><![CDATA[2012-06-14T2... by responsys_cm Builder in Splunk Search 07-01-2012 0 3	0	3
can we change the position of the search button in search form ? Hi.. I have a created a simple form which consists of a textbox to take the search key input to perform the search.I... by rakesh_498115 Motivator in Splunk Search 07-01-2012 0 3	0	3
Lookup table matching on multivalued fields I have a field in some of our events called "action". I have blacklisted IPs that we've seen a number of attacks fro... by responsys_cm Builder in Splunk Search 06-29-2012 0 1	0	1
Table columns and rows transposition I'm trying to format the output from Windows perflogs into a nice table. The way the events are formatted, with separ... by twinspop Influencer in Splunk Search 06-29-2012 1 1	1	1
Adding up numerical values within a multi-value field In search language, is there a way to add the values stored in a multi-value field provided they are all numerical va... by hexx Splunk Employee in Splunk Search 06-29-2012 4 3	4	3
sum fields in same event I need to sum fields by other fields in the same event. Here is an example event: _time ... by jrizzobwa New Member in Splunk Search 06-29-2012 0 4	0	4