Splunk Search

Community Activity

Grouping similar fields using search syntax? I have a ton of useragent type fields, like MacOutlook/some_version_x_os_version_etc and Entourage/other_version_x_os... by the_wolverine Champion in Splunk Search 02-18-2011 1 2	1	2
Start Search in a new window Is it possible to start a new search in a new window or tab just by clicking on part of an entry in my current result... by thepocketwade Path Finder in Splunk Search 02-18-2011 1 4	1	4
Combine output of 2 logs with only 1 key Hey, I try to figure out if it is possible to have splunk to build a result for my special needings: I have 2 diffe... by StefanB Explorer in Splunk Search 02-18-2011 0 4	0	4
Build Event Type search char limitation I am creating several event types and have found when adding searches longer than 98 char it trims the rest off. Is t... by vlapeintuit Explorer in Splunk Search 02-18-2011 0 1	0	1
calculate percentage from two sums? I'm hoping this doesn't stretch the bounds of "no question is too 'newbie'" part of the FAQ: I'm attempting to perfo... by dang Path Finder in Splunk Search 02-17-2011 1 2	1	2
Comparaing strings of different key Hi, I would like to build a query to compare the var1 and var2 and then determinecount. Example lets say var1 = "a... by aahadqj Explorer in Splunk Search 02-17-2011 0 1	0	1
Why does SOURCE_KEY=MetaData:Host not work for REPORT stanzas? I am trying to extract data from the Host field at search time, using a REPORT- in props.conf. The extraction works ... by Jason Motivator in Splunk Search 02-17-2011 0 1	0	1
Field extraction into multivalue field So I want to do a general field extraction of IP addresses for a sourcetype that may have them in multiple places in ... by Steve_Litras Path Finder in Splunk Search 02-17-2011 2 2	2	2
Defining search timeframe from midnight to now We have situations where we just want to show what happened "today", which is defined as from Midnight to now. That'... by beaumaris Communicator in Splunk Search 02-17-2011 1 1	1	1
Search results, dashboards and search bar on same dashboard page I would like to create a dashboard that consists of 2 main parts: 1 - open search bar allowing any search 2 - result... by splunker30039 Path Finder in Splunk Search 02-17-2011 1 3	1	3
how to count rows with lack of field ! so i have a log which has column/field which will be populated with "Y" if there is an ERROR, feild name is ERROR_FLA... by ashishv Explorer in Splunk Search 02-17-2011 2 6	2	6
Calculate stats over a percentage of the data I got a challenging request from a customer regarding their access logs. They want to monitor access patterns across ... by gpburgett Splunk Employee in Splunk Search 02-17-2011 1 7	1	7
skipped savedsearches Hello, I have a case opened for this - but it seems that this forum can be quicker at times... I run between 100-20... by briang67 Communicator in Splunk Search 02-17-2011 1 4	1	4
Search Commands: analyzefields I'm trying to wrap my head around some of the more advanced/esoteric search commands. It seems like there's a lot of... by mw Splunk Employee in Splunk Search 02-17-2011 3 3	3	3
How can i efficiently discard the event stream of a search? Suppose I have a search such as sourcetype=apache errors which finds errors that I care about. Now, suppose I wa... by jrodman Splunk Employee in Splunk Search 02-16-2011 2 1	2	1
Duration data not returning properly in a transaction? Hi, For some reason, in a query that contains a transaction of some Juniper SSL VPN logs, my duration doesn't seem t... by mtanadsk Explorer in Splunk Search 02-16-2011 1 1	1	1
Help extracting multiline events using rex We have events that look like this: edit 4 set srcintf "port1" set dstintf "port2" set srcaddr "0.... by jambajuice Communicator in Splunk Search 02-16-2011 1 5	1	5
Passing event time from subsearch into parent search... I've got a search that results in an IP address. I use that search as a subsearch which takes the IP and uses it as ... by rgonzale6 Path Finder in Splunk Search 02-15-2011 2 3	2	3
Find user saved searches Given a splunk username how do i search for the following. The roles that the user has - The last 15 searches perfo... by sanju005ind Communicator in Splunk Search 02-15-2011 1 3	1	3
Problems Comparing Multivalue Fields I am trying to compare two multivalue fields using the below search: index="weblogic" "Dynamic Server List" \| rex f... by Beth Engager in Splunk Search 02-15-2011 2 1	2	1
Find size (in bytes?) of search results I'm running a search that compiles its results in a table by source and displays the number of logs per source. I'm ... by thepocketwade Path Finder in Splunk Search 02-15-2011 1 2	1	2
Backslash escape problem Hi! I have a view, with this structure: <ExtendedFieldSearch> <HiddenSearch> <HiddenPostProcess/> ... by hbazan Path Finder in Splunk Search 02-15-2011 3 5	3	5
list "top" command question Hi, My mail server logs display recipient info like that: Feb 14 16:04:25 224.67.24.175 Feb 14 16:04:25 mail_log... by dikaye Path Finder in Splunk Search 02-15-2011 0 3	0	3
Is there any way to selectively avoid automatic field extraction? I have multiline events where there's a fair bit of auto-kv extraction that is good, but then there's a lot of noise ... by sideview SplunkTrust in Splunk Search 02-15-2011 1 6	1	6
timechart percentage data - not working Hi, I am trying to plot the percentage data over a period of span 1h. host="abc" sourcetype="xyz" ("Eurl" ) \| eval ... by aahadqj Explorer in Splunk Search 02-15-2011 1 7	1	7