Splunk Search

Community Activity

Extracted Fields working inconsistently in Search I'm rather new to Splunk. One of the things I have been tasked with is the tracking of API commands sent in URLs to u... by Ossian Explorer in Splunk Search 04-06-2011 2 4	2	4
Load regex from file hi, currently we use as a central syslog server with logcheck. every hour the server will generate a mail with messa... by pugnacity New Member in Splunk Search 04-06-2011 0 2	0	2
What file would you edit to extract that field automatically in the future? What file would you edit to extract that field automatically in the future? by 1dbenzo Explorer in Splunk Search 04-06-2011 0 1	0	1
Problematic behavior with chart and last() So I have a dashboard and I want to display the most recent value of fieldA, for each value of fieldB and fieldC, sh... by sideview SplunkTrust in Splunk Search 04-06-2011 0 4	0	4
'transaction' command" step by step Can anybody explain to me how 'transaction' command works in a step by step written format? by 1dbenzo Explorer in Splunk Search 04-06-2011 0 1	0	1
How do you perform a field extraction on the fly in Splunk? How do you perform a field extraction on the fly in Splunk? by 1dbenzo Explorer in Splunk Search 04-06-2011 0 1	0	1
index retirement policies: size versus age Where index retirement policies are concerned, if you define both size and age I assume first policy type hit wins? by ualbanytech Path Finder in Splunk Search 04-05-2011 0 4	0	4
Looking for search-head & indexer deployment advice We need advice on setting up search head(s). We have set up a distributed search system with 12 indexers and 2 search... by mctester Communicator in Splunk Search 04-05-2011 1 6	1	6
Use extracted field in a subsearch Hi, I would like to combine two searches. The first one gives me the session-id which i would like to use in a secon... by kochera Communicator in Splunk Search 04-05-2011 1 6	1	6
Retrieving stats from multiple summary reports What's the best way to retrieve stats from multiple reports in the summary index? We have a remote client that will ... by beaumaris Communicator in Splunk Search 04-05-2011 1 4	1	4
Problem trying to use remote CLI When trying to run a search from a remote CLI instance, I keep getting a 404. The command-line I'm running is: ./sp... by bcotton Engager in Splunk Search 04-05-2011 1 1	1	1
best way to ignore a timeframe when using timechart? I'm using timechart to show the number of connections we have over a collection of servers. When these servers go th... by dang Path Finder in Splunk Search 04-04-2011 1 4	1	4
Index reads in multiple lines of logs instead of line-by-line Hi, I encountered a problem with the splunk indexing. I developed a script to invoke tshark to generate HTTP traf... by wanling Path Finder in Splunk Search 04-04-2011 0 2	0	2
how do i search for the ? character? "?" and escape permutations don't seem to work. by piebob Splunk Employee in Splunk Search 04-03-2011 2 1	2	1
Reloading Transforms from CLI? "Enable configuration changes made to transforms.conf by typing the following search in Splunk Web: \| extract reload... by s6a9d6u9s New Member in Splunk Search 04-01-2011 0 4	0	4
Creating a table with common columns for multiple fields I have performance data captured with Splunk with fields and data like this: DatabaseCachePercentHit=0 DatabaseCach... by jamesklassen Path Finder in Splunk Search 04-01-2011 0 2	0	2
Other interesting fields How does Splunk determine which fields to add to "other interesting fields"? by rroberts Splunk Employee in Splunk Search 04-01-2011 2 3	2	3
Compare two sets of data from different times Hi I am at a loss on how to approach this problem. Lets say we have the following data: Input 1: Contains list of... by sranga Path Finder in Splunk Search 04-01-2011 1 5	1	5
Further customize setup.xml Are there any way to further customize the setup.xml file for my app? I'm trying to include some radio-buttons, or d... by klee310 Communicator in Splunk Search 04-01-2011 0 2	0	2
outcome of stats into timechart host=myserver JobWrapper \| transaction keepevicted=true jobid \| where job="provisioningJob" \| stats max(duration) AS... by bowa Path Finder in Splunk Search 04-01-2011 1 7	1	7
search with value from setup.xml I have a setup.xml and a myappsetup.conf all setup properly (lets make that assumption for now, still many bugs to ir... by klee310 Communicator in Splunk Search 04-01-2011 0 2	0	2
Search for multiple IP ranges I am looking for the best way to search multiple IP ranges. Currently I am using rex as follows sourcetype=mysource... by bsteelz93 Path Finder in Splunk Search 03-31-2011 0 3	0	3
Nullqueue Thruput Totals Hi, Is there a search or metrics.log that one can get an idea of the amount of data/events being sent to the nullque... by ephemeric Contributor in Splunk Search 03-31-2011 1 3	1	3
Bind forwarder to particular IP Hey everyone. I am trying to bind the forwarding service to a particular IP because one of the boxes we are using as ... by msarro Builder in Splunk Search 03-31-2011 0 2	0	2
Testdrive, daily indexing quota? Hello. I am giving this software a testdrive on one of my servers. Accidently I pointed to a log-directory holding 23... by tore_stensby New Member in Splunk Search 03-31-2011 0 1	0	1