Splunk Search

Community Activity

Search-Time Field Extraction Hello Everyone, I had a quick question about Field Extraction and replication (copying) the specific field extractio... by A4orce84 New Member in Splunk Search 04-16-2012 0 4	0	4
Field Extraction - restrict extraction to - can this be changed? Field extraction appears to be restricted to Host, Source or sourcetype - I have multiple web servers, and even web s... by gerald_huddlest Path Finder in Splunk Search 04-16-2012 0 3	0	3
Grouping by numeric range Hi, Novice to Splunk, I've indexed some data and now want to perform some reports on it. My main requirement is that... by bermudabob Explorer in Splunk Search 04-16-2012 0 7	0	7
Why can't I sum summary data from sistats? So, I was running ... \| sistats count by host, source, sourcetype, field1, field2 and saving it to a summary index. ... by Jason Motivator in Splunk Search 04-16-2012 2 4	2	4
Exclude events that do not occur each day from search Hello I have this search: earliest=-7d@d latest=@d source="/var/log/snmptrapfmt.log" (timeout_url="*.GE" OR timeo... by C4r7m4n Path Finder in Splunk Search 04-16-2012 0 2	0	2
Cannot eval a field obtained from rex Sample data that I am querying on 2012/04/16 10:36:10.290 2012/04/16 10:35:16.333 2980023 811863 jac-datafileupl... by zuberpalekar Engager in Splunk Search 04-16-2012 0 1	0	1
easier/better way to get a general field summary table I have an interesting situation where I want to be able to display a little summary table, showing a few statistics ... by sideview SplunkTrust in Splunk Search 04-14-2012 0 2	0	2
search query based on response time I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 ... by subhadipc Explorer in Splunk Search 04-13-2012 0 3	0	3
is eval the right choice? The query below displays accurate values for Requests, Accepted, Rejected and %Accepted. \| stats count(eval(nps_pac... by mikefoti Communicator in Splunk Search 04-13-2012 0 10	0	10
Maximum # of bins in a timechart When running a timechart over the last 7 days, using span=10m, the timechart will only display roughly the first 3.5... by anssntaco Path Finder in Splunk Search 04-13-2012 0 1	0	1
Help for subsearch Hi Splunkers, I need the result from first search in another search. First search: sourcetype=win_server \| multikv ... by nebel Communicator in Splunk Search 04-13-2012 0 3	0	3
Query assistance needed with unrelated data set Ugh! I hate having to ask for query help, but I'm close.. but not close enough. Basically, I have two sets of data.... by jgauthier Contributor in Splunk Search 04-13-2012 0 8	0	8
How to search events that occur at least one per day, count as one and number of such counts are 5 or more per one week? Hello, Does anybody know how to write a search that find events occur at least one per day and these events count as... by C4r7m4n Path Finder in Splunk Search 04-12-2012 1 9	1	9
Gap in data after System event We had an event on our splunk server, and there's a gap in some of the logs. The logs are continually written to on ... by ironhalo Explorer in Splunk Search 04-12-2012 0 1	0	1
multiline match for same pattern <Product> <ProductName>(\w+)</ProductName> <ProductName>(\w+)</ProductName> <ProductName>(\w+)</ProductName> </Pro... by tven Explorer in Splunk Search 04-12-2012 0 1	0	1
tostring turning integers into decimals I have a rex that returns a series of 5-8 digit IDs: SEARCH "rex field=_raw "2012-\d\d-\d\d,\d,(?\d{1,8})"" RESULT ... by rachelneal Path Finder in Splunk Search 04-12-2012 1 3	1	3
Search pages based on their response time I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 ... by subhadipc Explorer in Splunk Search 04-12-2012 1 1	1	1
search for unique userid in one hour window I am trying to report the number of unique logged in users (field=USERNAME) in a timespan=1h and since i only want un... by dominiquevocat SplunkTrust in Splunk Search 04-12-2012 0 2	0	2
connect/concatenate two searches into one and visualize it as a single value Hello I have two searches: Search A: BGP_NEIGHBOR_STATE_CHANGED source="udp:514" AND ("Established to Idle" OR "Est... by C4r7m4n Path Finder in Splunk Search 04-12-2012 0 6	0	6
How to add a field from a previous line to every logged event/line? I would like to associate the "ip" field with every log line, i.e. Current source log format: 1227.125106.091263 ip... by NK_1 Path Finder in Splunk Search 04-11-2012 0 2	0	2
Regex "(? What does the regex in my question's title above mean? Source: Search Language Quick Reference Card (on top of page ... by boris Path Finder in Splunk Search 04-11-2012 0 1	0	1
return a result from fields based on 2 queries I'm trying to return a field based upon a search and within that search extract a variable to search for in another s... by gregwilliams Path Finder in Splunk Search 04-11-2012 0 5	0	5
How to get a count and percentage for denied connections in cisco web appliance I am trying to get the number of denied connections from squid proxy logs from a Cisco Ironport web security applianc... by lmyoung Engager in Splunk Search 04-11-2012 1 1	1	1
regex TEXT Hopufully a quick one but I'm looking to search and extract anything between two these fields anyone know how? by tb582 Explorer in Splunk Search 04-11-2012 0 18	0	18
Search Progress Indicator Is there a way to show the status of search jobs while the search is in progress. I have a dashboard with multiple se... by Sriram Communicator in Splunk Search 04-10-2012 0 8	0	8

Get Updates on the Splunk Community!

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

Splunk Search

Search-Time Field Extraction

Field Extraction - restrict extraction to - can this be changed?

Grouping by numeric range

Why can't I sum summary data from sistats?

Exclude events that do not occur each day from search

Cannot eval a field obtained from rex

easier/better way to get a general field summary table

search query based on response time

is eval the right choice?

Maximum # of bins in a timechart

Help for subsearch

Query assistance needed with unrelated data set

How to search events that occur at least one per day, count as one and number of such counts are 5 or more per one week?

Gap in data after System event

multiline match for same pattern

tostring turning integers into decimals

Search pages based on their response time

search for unique userid in one hour window

connect/concatenate two searches into one and visualize it as a single value

How to add a field from a previous line to every logged event/line?

Regex "(?

return a result from fields based on 2 queries

How to get a count and percentage for denied connections in cisco web appliance

regex TEXT

Search Progress Indicator

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

Monitoring AI Agents with Splunk Observability Cloud

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation