Splunk Search

Community Activity

I am trying to create a field for sudo based on the following log entry I am trying to extract the username into a field that I can use and have so far been unsuccessful. I am doing this ba... by gceraso Engager in Splunk Search 03-07-2011 0 1	0	1
not getting result in join - imp I am using :join" query to show one table with different columns from different sourcetypes. However some of the sour... by Anvita Explorer in Splunk Search 03-07-2011 1 3	1	3
Discard unwanted syslog events? I need to reduce our licensing usage by filtering common, valid, no-news-is-good-news domains out of our Barracuda We... by mileserickson Engager in Splunk Search 03-07-2011 1 2	1	2
Not Able to see sourcetype="websphere:MBean:stats" on splunk websphere dashboard Hi, I am not Able to see sourcetype="websphere:MBean:stats" on splunk websphere dashboard. Since this source is imp... by lalitgoyal87 New Member in Splunk Search 03-07-2011 0 3	0	3
Eval type error on subseach Hi all, I'm having a few issues with using a subsearch within an eval statement. index="capacityanalysisindex01" \|... by jarrodrobins Engager in Splunk Search 03-07-2011 0 1	0	1
How can I perform math on the counts from two queries Here's the situation: I have one set of web log events that represent people using my app which I generally display ... by markgo Engager in Splunk Search 03-07-2011 4 3	4	3
locate duplicate MAC addresses in dhcp logs Should be simple to solve, but i'm drawing a blank. i have three fields i wnat to look at in dhcp logs mac hostname ... by EricPartington Communicator in Splunk Search 03-05-2011 1 3	1	3
Does splunk> do any internal caching of recent searches? Does splunk> do any internal caching of recent searches? More to the point... Can I be 100% certain that my searc... by tylr Engager in Splunk Search 03-05-2011 2 2	2	2
Search Issues with regex field1= "..." \| regex field1="..." I think i may have stumbled upon an error in Splunk. The following search will filter out any 10.x.x.x and 172 priva... by I-Man Communicator in Splunk Search 03-04-2011 0 2	0	2
How do I deal with logs containing asterisks? I'm trying to deal with a report that contain an asterisk to denote a "true/false" condition. My goal is to use trans... by hacktastic Path Finder in Splunk Search 03-04-2011 1 6	1	6
Bring back set number of fields even if the field isn't in the data Hello, I am trying to bring back a set number of fields in a query even if that field isn't in the indexed data. Fo... by jlechem New Member in Splunk Search 03-04-2011 0 3	0	3
Transactions: summing up repeated fields I have server farms made up of 4 servers each. I have various stats from each posted once per minute. I want to group... by twinspop Influencer in Splunk Search 03-04-2011 0 1	0	1
How do I extract a value from the 'source' field at search-time? My log directories are structured like so - /var/myapplogs/<app-name>/logs/*.log How can I extract <app-name> as ... by Mick Splunk Employee in Splunk Search 03-03-2011 1 3	1	3
Limiting timechart span to only include values > 0 I have a search that is returning the value of a field called num_oracle_batch. I am using the following to get a per... by ericrobinson Path Finder in Splunk Search 03-03-2011 1 3	1	3
Average Hits per Minute by Distinct SourceIP I'm interested to know the average hits per minute by distinct source IP address from my web log data for a given tim... by mattreidy Engager in Splunk Search 03-03-2011 1 6	1	6
optimal order for doing dedup, fields and sort I have lots of little searches and postProcess searches all over the place, where the request only needs a single sor... by sideview SplunkTrust in Splunk Search 03-03-2011 3 1	3	1
Passing results to next command one at a time and using event results in parameters Trying to get a search working where instead of the whole result set passing to the next command as one, they would p... by skippylou Communicator in Splunk Search 03-03-2011 2 2	2	2
Server Side Execution Hi, does Splunk has a possibility to run server side scripts (python, ruby) based on a splunk search result? The sea... by lwalhoefer Engager in Splunk Search 03-03-2011 1 2	1	2
add dynamic field in splunk Hi everyone , i would like to add a field in splunk.but field value does not come in result. here my source are:- 1.... by chandansingh Explorer in Splunk Search 03-03-2011 0 1	0	1
Drilldown on OTHER field Hey, There is a field named OTHER which tends to appear at times in my search results. However, if I drilldown on th... by Ant1D Motivator in Splunk Search 03-03-2011 2 5	2	5
Download Link in Result Table Hi, I'm looking for a possibility to add a download link to a column within a result table ( e.g. ... \| table field1)... by lwalhoefer Engager in Splunk Search 03-02-2011 0 1	0	1
Setting MetaData:Host over transforms.conf doesn't work I have icinga debug logs from a server called monitoring01 looking like: [1284468200.195107] Checking service 'sys -... by Thomas_Gresch Explorer in Splunk Search 03-02-2011 0 5	0	5
Summary Indexing and Sort Orders I am somewhat confused on how to set up my searches to populate my summary index. For example, two of the reports wil... by Kyle_Brandt Path Finder in Splunk Search 03-02-2011 0 1	0	1
transaction commmand with huge event base Hi, I've the following _raw event base: line1 field1=field1Value field2=field2Value sometext: a_stringline2 field1=... by lwalhoefer Engager in Splunk Search 03-01-2011 0 1	0	1
Tracking how much an item moves vs. a baseline. I was asked to look into building a report on how much an item moves vs. a baseline. I was trying to compare CPU Uti... by jbsplunk Splunk Employee in Splunk Search 03-01-2011 12 3	12	3

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community, What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Splunk Search

I am trying to create a field for sudo based on the following log entry

not getting result in join - imp

Discard unwanted syslog events?

Not Able to see sourcetype="websphere:MBean:stats" on splunk websphere dashboard

Eval type error on subseach

How can I perform math on the counts from two queries

locate duplicate MAC addresses in dhcp logs

Does splunk> do any internal caching of recent searches?

Search Issues with regex field1= "..." | regex field1="..."

How do I deal with logs containing asterisks?

Bring back set number of fields even if the field isn't in the data

Transactions: summing up repeated fields

How do I extract a value from the 'source' field at search-time?

Limiting timechart span to only include values > 0

Average Hits per Minute by Distinct SourceIP

optimal order for doing dedup, fields and sort

Passing results to next command one at a time and using event results in parameters

Server Side Execution

add dynamic field in splunk

Drilldown on OTHER field

Download Link in Result Table

Setting MetaData:Host over transforms.conf doesn't work

Summary Indexing and Sort Orders

transaction commmand with huge event base

Tracking how much an item moves vs. a baseline.

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

MLTKC how should i check jupyter notebook func in ...

ITSI thresholds: adaptive vs static

Splunk Search

Are you a member of the Splunk Community?