Splunk Search

Community Activity

Grouping by numeric range Hi, Novice to Splunk, I've indexed some data and now want to perform some reports on it. My main requirement is that... by bermudabob Explorer in Splunk Search 04-16-2012 0 7	0	7
Why can't I sum summary data from sistats? So, I was running ... \| sistats count by host, source, sourcetype, field1, field2 and saving it to a summary index. ... by Jason Motivator in Splunk Search 04-16-2012 2 4	2	4
Exclude events that do not occur each day from search Hello I have this search: earliest=-7d@d latest=@d source="/var/log/snmptrapfmt.log" (timeout_url="*.GE" OR timeo... by C4r7m4n Path Finder in Splunk Search 04-16-2012 0 2	0	2
Cannot eval a field obtained from rex Sample data that I am querying on 2012/04/16 10:36:10.290 2012/04/16 10:35:16.333 2980023 811863 jac-datafileupl... by zuberpalekar Engager in Splunk Search 04-16-2012 0 1	0	1
easier/better way to get a general field summary table I have an interesting situation where I want to be able to display a little summary table, showing a few statistics ... by sideview SplunkTrust in Splunk Search 04-14-2012 0 2	0	2
search query based on response time I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 ... by subhadipc Explorer in Splunk Search 04-13-2012 0 3	0	3
is eval the right choice? The query below displays accurate values for Requests, Accepted, Rejected and %Accepted. \| stats count(eval(nps_pac... by mikefoti Communicator in Splunk Search 04-13-2012 0 10	0	10
Maximum # of bins in a timechart When running a timechart over the last 7 days, using span=10m, the timechart will only display roughly the first 3.5... by anssntaco Path Finder in Splunk Search 04-13-2012 0 1	0	1
Help for subsearch Hi Splunkers, I need the result from first search in another search. First search: sourcetype=win_server \| multikv ... by nebel Communicator in Splunk Search 04-13-2012 0 3	0	3
Query assistance needed with unrelated data set Ugh! I hate having to ask for query help, but I'm close.. but not close enough. Basically, I have two sets of data.... by jgauthier Contributor in Splunk Search 04-13-2012 0 8	0	8
How to search events that occur at least one per day, count as one and number of such counts are 5 or more per one week? Hello, Does anybody know how to write a search that find events occur at least one per day and these events count as... by C4r7m4n Path Finder in Splunk Search 04-12-2012 1 9	1	9
Gap in data after System event We had an event on our splunk server, and there's a gap in some of the logs. The logs are continually written to on ... by ironhalo Explorer in Splunk Search 04-12-2012 0 1	0	1
multiline match for same pattern <Product> <ProductName>(\w+)</ProductName> <ProductName>(\w+)</ProductName> <ProductName>(\w+)</ProductName> </Pro... by tven Explorer in Splunk Search 04-12-2012 0 1	0	1
tostring turning integers into decimals I have a rex that returns a series of 5-8 digit IDs: SEARCH "rex field=_raw "2012-\d\d-\d\d,\d,(?\d{1,8})"" RESULT ... by rachelneal Path Finder in Splunk Search 04-12-2012 1 3	1	3
Search pages based on their response time I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 ... by subhadipc Explorer in Splunk Search 04-12-2012 1 1	1	1
search for unique userid in one hour window I am trying to report the number of unique logged in users (field=USERNAME) in a timespan=1h and since i only want un... by dominiquevocat SplunkTrust in Splunk Search 04-12-2012 0 2	0	2
connect/concatenate two searches into one and visualize it as a single value Hello I have two searches: Search A: BGP_NEIGHBOR_STATE_CHANGED source="udp:514" AND ("Established to Idle" OR "Est... by C4r7m4n Path Finder in Splunk Search 04-12-2012 0 6	0	6
How to add a field from a previous line to every logged event/line? I would like to associate the "ip" field with every log line, i.e. Current source log format: 1227.125106.091263 ip... by NK_1 Path Finder in Splunk Search 04-11-2012 0 2	0	2
Regex "(? What does the regex in my question's title above mean? Source: Search Language Quick Reference Card (on top of page ... by boris Path Finder in Splunk Search 04-11-2012 0 1	0	1
return a result from fields based on 2 queries I'm trying to return a field based upon a search and within that search extract a variable to search for in another s... by gregwilliams Path Finder in Splunk Search 04-11-2012 0 5	0	5
How to get a count and percentage for denied connections in cisco web appliance I am trying to get the number of denied connections from squid proxy logs from a Cisco Ironport web security applianc... by lmyoung Engager in Splunk Search 04-11-2012 1 1	1	1
regex TEXT Hopufully a quick one but I'm looking to search and extract anything between two these fields anyone know how? by tb582 Explorer in Splunk Search 04-11-2012 0 18	0	18
Search Progress Indicator Is there a way to show the status of search jobs while the search is in progress. I have a dashboard with multiple se... by Sriram Communicator in Splunk Search 04-10-2012 0 8	0	8
Alert from 2 searched values that calculate a percentage First time posting! --using splunk 4.2.4-- I noticed similar questions on here that were either unanswered or didn't... by sberg Explorer in Splunk Search 04-10-2012 0 5	0	5
Adding search-server / CLI I'm trying to add search servers to my search head. I'm using the following command: ./splunk add search-server -hos... by kevinsikora Explorer in Splunk Search 04-10-2012 1 3	1	3

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

Grouping by numeric range

Why can't I sum summary data from sistats?

Exclude events that do not occur each day from search

Cannot eval a field obtained from rex

easier/better way to get a general field summary table

search query based on response time

is eval the right choice?

Maximum # of bins in a timechart

Help for subsearch

Query assistance needed with unrelated data set

How to search events that occur at least one per day, count as one and number of such counts are 5 or more per one week?

Gap in data after System event

multiline match for same pattern

tostring turning integers into decimals

Search pages based on their response time

search for unique userid in one hour window

connect/concatenate two searches into one and visualize it as a single value

How to add a field from a previous line to every logged event/line?

Regex "(?

return a result from fields based on 2 queries

How to get a count and percentage for denied connections in cisco web appliance

regex TEXT

Search Progress Indicator

Alert from 2 searched values that calculate a percentage

Adding search-server / CLI

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

GA: New Data Management App in Splunk Platform

Announcing Modern Navigation: A New Era of Splunk User Experience

Datamodel summaries not visible

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

Splunk Search

Join the Conversation