Splunk Search

Community Activity

Parsing and grouping with I am trying to find an hourly count of the content in Apache access log. 10.113.76.13 - - [16/Nov/2011:17:13:59 -08... by ajitsd Explorer in Splunk Search 11-16-2011 0 3	0	3
eval Time difference I have the following data indexed: initialTime Purchase_Time 2011-11-04T13:17Z 2011-11-04 09:18:20 2011-11-04T... by lpolo Motivator in Splunk Search 11-16-2011 3 3	3	3
need subsearch to return more than 10k results I have several use cases where i need to run a subsearch that is not limited to the default 10k results. ex. this se... by jshaynes Explorer in Splunk Search 11-16-2011 1 1	1	1
How can you check if the splunkweb and splunkd process are running? Is there a good Unixy way to check "is splunkweb running" and "is splunkd running"? I want to run a cronjob that che... by jeffoptimizely Explorer in Splunk Search 11-16-2011 1 4	1	4
Does splunk's database support relational search?? suppose two log file have common field named IPaddress. One log file has username filed with that IPaddress field and... by keshab Path Finder in Splunk Search 11-16-2011 0 2	0	2
multiple searches in form view i have a simple form view set up to retrieve a specific ip address or username from the system. the results are then... by riderofyamaha Explorer in Splunk Search 11-16-2011 1 2	1	2
time difference calculation I have a log which says when session was created and destroyed. What search string should I use to calculate the leng... by keshab Path Finder in Splunk Search 11-16-2011 0 5	0	5
Log Volume for Symmetrix Logs this looks very interesting. How much volume does this produce each day? by crescens New Member in Splunk Search 11-15-2011 0 1	0	1
eval lower command producing incorrect results I have a search that will basically look through some logs for a line "Inserting a record" and then take the username... by gnovak Builder in Splunk Search 11-15-2011 0 13	0	13
Evaluation Noob Question - Help Needed We have a large number of audit files from Oracle that have been written to the Local OS. In the audit files there is... by jrialto New Member in Splunk Search 11-15-2011 0 3	0	3
Default _time extraction I have an example log file with the following format: Nov 05 10:33:37 servername applicationserver: instance,ipaddre... by camah4 New Member in Splunk Search 11-15-2011 0 2	0	2
How to make splunk interpret multiple lines as single line I have a pretty long log that needs to be analyzed, not single lined though, here is example #1: .....some unimporta... by c0mrade Explorer in Splunk Search 11-15-2011 1 2	1	2
Does a sorted lookup table result in faster lookups? Am curious what the performance difference is between sorted and unsorted lookups (sorting by the primary search key ... by hulahoop Splunk Employee in Splunk Search 11-15-2011 3 2	3	2
Splunk search using operator returning opposite results When I use the windows app to search for a hardrive with less than a certain amount of space to set up alerts, I some... by tympaniplayer Path Finder in Splunk Search 11-15-2011 0 3	0	3
regex to pick a event Hi all, I have a question to ask about using regex to recognize a field. I did manage to pick the field out from my ... by e82than Communicator in Splunk Search 11-15-2011 0 3	0	3
Custom field extractions no longer being indexed Hi All, We have some indexes that have suddenly stopped indexing the custom fields we had configured on our logs. T... by felixjs New Member in Splunk Search 11-14-2011 0 3	0	3
How to save the results of a function and reuse them in a search and have a clause based on count of >1 New to splunk but getting somewhere with learning to construct complex searches. The goal of the search below is to l... by wrangler2x Motivator in Splunk Search 11-14-2011 0 2	0	2
Substract actual field with previous event field I have the following summary index _time Type Number 11/14/11 3:00:53.000 PM New 56802 ... by lpolo Motivator in Splunk Search 11-14-2011 1 3	1	3
Display static text in splunk dashbaord Hi, I've below dashboard xml that I'm using for my project: <view autoCancelInterval="90" isVisible="true" objectMo... by freephoneid Path Finder in Splunk Search 11-14-2011 0 3	0	3
Extracting multiple values from one field Using the Akamai app, and the configuration 'akamai-access-combined-extractions' uses: [[all:other]] ... to capture... by slandail New Member in Splunk Search 11-14-2011 0 1	0	1
Splunk date/time localization problem Hi, i'm facing the problem that I cannot set the time and date in Splunk in the way that it displays it in the hunga... by marotit Engager in Splunk Search 11-14-2011 1 3	1	3
Can a custom search script invoke an eval/where expression? I would like to be able to create a custom search command that uses an eval-expression as an argument. (Similar to ... by Lowell Super Champion in Splunk Search 11-14-2011 2 5	2	5
a month time of x axis with span of 5 min window? is there anyways to show a whole month of graph with a time span of 5 min window splunk has reduce the chart to 4 day... by cpuppet Path Finder in Splunk Search 11-14-2011 0 5	0	5
Why Do I keep getting banned from the Splunk IRC? For some reason, Splunk IRC considers me to be a Spam? No matter what I do it seems to be going back to this conclus... by Dark_Ichigo Builder in Splunk Search 11-14-2011 0 4	0	4
Search for * in log I would like to search for a * in my searchresult, more specific i would like to get all entries that is "select *" t... by mrdaniel Explorer in Splunk Search 11-13-2011 1 1	1	1

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Search

Parsing and grouping with

eval Time difference

need subsearch to return more than 10k results

How can you check if the splunkweb and splunkd process are running?

Does splunk's database support relational search??

multiple searches in form view

time difference calculation

Log Volume for Symmetrix Logs

eval lower command producing incorrect results

Evaluation Noob Question - Help Needed

Default _time extraction

How to make splunk interpret multiple lines as single line

Does a sorted lookup table result in faster lookups?

Splunk search using operator returning opposite results

regex to pick a event

Custom field extractions no longer being indexed

How to save the results of a function and reuse them in a search and have a clause based on count of >1

Substract actual field with previous event field

Display static text in splunk dashbaord

Extracting multiple values from one field

Splunk date/time localization problem

Can a custom search script invoke an eval/where expression?

a month time of x axis with span of 5 min window?

Why Do I keep getting banned from the Splunk IRC?

Search for * in log

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation