Splunk Search

Community Activity

How to sum top30 and then sum top31-100 and then sum top101-500 I have use sort event from big to small ,now i want to sum 1-30,31-100,101-500,501-3000,3000- .how to do it ? thanks... by lihongyan_84 Explorer in Splunk Search 06-29-2011 0 2	0	2
will persistent queues work with splunktcp? This online doc says that persistent queues only work with certain input types. Will they work with splunktcp? This i... by suhprano Path Finder in Splunk Search 06-29-2011 0 2	0	2
combining two searches How can I combine the following two queries into a single search? index=sendmail earliest="@d-2h" latest="@d+10h" ... by DTERM Contributor in Splunk Search 06-28-2011 3 2	3	2
How to compute stats (mean, median, mode) over a frequency table? I have a search which returns the result as frequency table: uploads frequency 0 6 1 4 ... by jyzhang Engager in Splunk Search 06-28-2011 0 4	0	4
Rex problem Hi, I have the following data set: (x,y,z could be any number in the following data sets) (All IPs are in the IPFie... by weikuanl New Member in Splunk Search 06-28-2011 0 5	0	5
Join or Where statment I have condition 1 [ index=sample offending_ip="*" ] I have condition 2 [ index=main source="firewall" ] I want to ... by hartfoml Motivator in Splunk Search 06-28-2011 0 1	0	1
Can we change the Time intervals displayed on X-Axis for a Graph I want to set the Time Intervals displayed on X-Axis. By default it is shown every 4 hours for Time range of 1 Day. ... by tkadale Path Finder in Splunk Search 06-27-2011 1 2	1	2
How to find the events contain different fields while they have the same value in another field? I got the following log events: ===== User:A IP_address:10.0.0.1 User:B IP_address:10.0.0.2 User:C IP_address:10.... by weikuanl New Member in Splunk Search 06-27-2011 0 2	0	2
Specific rex doesnt seem to work Have 3 sets of drives that are listed differently by different systems. FC SSD SATAII SSD Fibre Channel SATAII... by clintla Contributor in Splunk Search 06-27-2011 0 5	0	5
Error in 'UnifiedSearch': Unable to parse the 'Missing LHS for AND' search --> error when searching for surrounding events - why? Does anyone know why I am getting the following error when running the following search to find surrounding events: ... by the_wolverine Champion in Splunk Search 06-27-2011 0 2	0	2
Regmon filters not working I'm trying to monitor the registry and filter on a few critical keys. When I look at the events, I'm seeing events f... by jambajuice Communicator in Splunk Search 06-27-2011 1 4	1	4
Percent of Subtotals Splunkers, I'm trying to get splunk to help me with the analysis of survey responses. I have the command: * \| sta... by sondradotcom Path Finder in Splunk Search 06-26-2011 0 1	0	1
Match PID to user name, then tell me what they downloaded from SFTP My goal is to parse my sftp logs, match the pid to the user name, then generate a list of what that user downloaded a... by kvassallo New Member in Splunk Search 06-24-2011 0 2	0	2
In a distributed search environment, where do my configurations go? The search head? The Indexers? If I have, say five, indexers, and a search head that points at them, where do my field extractions, tagging, lookups... by jrodman Splunk Employee in Splunk Search 06-24-2011 3 4	3	4
Why are there no time stamp in Earliest and Latest Events for main index I have two search heads, four indexers, and several forwarders. When I go to Manager -> Indexes, my main index shows... by Masa Splunk Employee in Splunk Search 06-24-2011 2 1	2	1
Splunk matters Anyone knows how to develop batch jobs to process and produce the required information for Field Lookup? by HY Explorer in Splunk Search 06-24-2011 0 4	0	4
Cant add my complete list of sources. I've got 2 folders of config data- both have 21 files. Splunk is only adding 17 from one folder & 9 from the other.... by clintla Contributor in Splunk Search 06-23-2011 1 14	1	14
Distributed Search and Lookups Hi, I'm getting an error on my Search Head when browsing for content related to some LOOKUP directives I have in my ... by ruisantos Path Finder in Splunk Search 06-23-2011 0 2	0	2
Top errors with hosts I have a search that sends me the top 10 errors on all of our servers each morning: error OR Error OR alert OR Alert... by jamesklassen Path Finder in Splunk Search 06-23-2011 0 3	0	3
Extracting a field at search time - rex question I've looked at the splunk documentation but can't make sense of it, maybe it's too early int he morning. I'm having ... by jstockamp Communicator in Splunk Search 06-23-2011 1 4	1	4
search query What is wrong with the following? index="app" \| top productName NOT productName = "Not Specified" I want to extract... by DTERM Contributor in Splunk Search 06-23-2011 0 1	0	1
data sent via syslog aren't resolving their host name The servers sending data via syslog aren't resolving their host name....I edited my inputs.conf file in local dir as ... by BSoni New Member in Splunk Search 06-23-2011 0 1	0	1
How can I search for a combination of relative and absolute times? I have a requirement to create a dashboard for a team's morning checks. It needs to search for logs between 18:00 the... by Glenn Builder in Splunk Search 06-23-2011 1 5	1	5
Splunk Chart Percent Hello, i created a bar chart for an event. That chart is Error vs Count, when i add that chart to dashboard, i am g... by dineshkumar New Member in Splunk Search 06-23-2011 0 1	0	1
Large complicated search logic I've got an index with some 80 million events in it (thus far) and I want to search it for a list of some 100+ values... by howyagoin Contributor in Splunk Search 06-23-2011 0 1	0	1