Splunk Search

Community Activity

Adding up numerical values within a multi-value field In search language, is there a way to add the values stored in a multi-value field provided they are all numerical va... by hexx Splunk Employee in Splunk Search 06-29-2012 4 3	4	3
sum fields in same event I need to sum fields by other fields in the same event. Here is an example event: _time ... by jrizzobwa New Member in Splunk Search 06-29-2012 0 4	0	4
Can't get chart to show data. I have about 10 Windows computers using the universal forwarder to report CPU utilization, memory, disk and network c... by keithstone New Member in Splunk Search 06-29-2012 0 2	0	2
Is it possible to encrypt lookup files and use it in queries ? I have a situation where i dont need people to see the data in lookup file,so i want to encrypt it.Can splunk decrypt... by adityapavan18 Contributor in Splunk Search 06-29-2012 0 1	0	1
Search within 2 entries Hello, I want to search for an entry that contains UsersController#update and with the following entry that contain ... by Ikanui123 New Member in Splunk Search 06-28-2012 0 3	0	3
simple questions about a search hi there, with the search... `all_forwarders` \| fields sourceHost ...I will get all forwarder host names. On th... by nebel Communicator in Splunk Search 06-28-2012 0 1	0	1
Is it possible to run stats or eval on a multi-valued field? I'm using transaction to build a list of actions taken on behalf of our users. Is it possible to run stats to count ... by responsys_cm Builder in Splunk Search 06-28-2012 0 1	0	1
lookup tables?? What is the simplest way to populate a lookup table? I started creating a cronjob. However the splunk search comman... by DTERM Contributor in Splunk Search 06-28-2012 0 2	0	2
Subgroup rows for addcoltotals I would like to use the add column totals to get the sum of certain rows. Is there a way to specify a "by" clause in ... by SarahWKarvenz Path Finder in Splunk Search 06-28-2012 0 1	0	1
date parsing I've got date field in a splunk log that looks like: firstOccurrence=2012/06/27 14:55:12 Splunk does not interpret ... by DTERM Contributor in Splunk Search 06-28-2012 0 3	0	3
Day of the Week table - current day vs Monthly avg I'm trying to get a table showing the current daily average vs the previous month average, but I'm unsure I got the c... by splunk_zen Builder in Splunk Search 06-28-2012 0 3	0	3
timechart fields I'm trying to create a chart based on this data, the Num field changes every day: 2012-06-28 13:57:48 operator=TLFT ... by HansK Path Finder in Splunk Search 06-28-2012 0 3	0	3
Converting Percentages to Decimal based Percentages I want to change the percentage results of the follwoing search into decimal based Percentages, as I want the 0.5% fo... by Dark_Ichigo Builder in Splunk Search 06-27-2012 0 2	0	2
Help with a search query involving two time ranges We have a Splunk instance here at my job that I've inherited. I rarely have to go do anything in it so my Splunk Fu i... by cfortune Explorer in Splunk Search 06-27-2012 3 3	3	3
newbie question: Exchange data input So I installed universal forwarder on my Exchange 2010 server, during install specified the splunk server's FQDN. On... by itrcb4 New Member in Splunk Search 06-27-2012 0 7	0	7
Create a search with multiple outputs I'm trying to figure out if there is some combination of subsearches or other operations that will allow me to accomp... by responsys_cm Builder in Splunk Search 06-27-2012 0 4	0	4
can i use Table Tag in the Advance DashBoard Hi , I have created a advance dashboard with the module tags and all.can i use the table tag to display my search re... by rakesh_498115 Motivator in Splunk Search 06-27-2012 0 1	0	1
Round down I have a function where I take a number, divide it by 3, then would like to round that number down. Is that possible ... by KaliBaker Engager in Splunk Search 06-27-2012 0 4	0	4
Searching duplicate data across indexers Hi there Theoretical scenario: I have one search head and two indexers all on physical servers I am forwarding all s... by tobypass New Member in Splunk Search 06-27-2012 0 1	0	1
How can I count lines? hello, This is my search: source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PURCH_MIN>44 \| stats count by ID_CARDHOLDE... by LauraBre Communicator in Splunk Search 06-27-2012 0 3	0	3
Search: how is keyword "AND" used? I'm trying to search two different fields and I'm trying to combine the search with "AND" but it doesn't seem to work... by monicato Path Finder in Splunk Search 06-26-2012 0 2	0	2
Restrict Hosts in This Particular Search Hello to all, I am using the search in the link below to find hosts that haven't logged in a certain amount of time:... by aferone Builder in Splunk Search 06-26-2012 0 2	0	2
Ho to get a single report by evaluating 3 saved searches Scenario: I need to get a single dashboard out of 3 different sourcetype by passing a unique ID using the form view.... by balavenkatachal New Member in Splunk Search 06-26-2012 0 2	0	2
can we have a uniqueID for two field extractions Hi , Actually i have two events in the output like this... event 1 ...... ... ...... User Message ...... .... ..... by rakesh_498115 Motivator in Splunk Search 06-26-2012 0 2	0	2
can i display my multiple queries in html table format Hi, Assume i have some 4 search Queries like Q1,Q2,Q3 and Q4 . These Four Queries were no realted to each other and ... by rakesh_498115 Motivator in Splunk Search 06-26-2012 0 1	0	1