Splunk Search

Community Activity

list "top" command question Hi, My mail server logs display recipient info like that: Feb 14 16:04:25 224.67.24.175 Feb 14 16:04:25 mail_log... by dikaye Path Finder in Splunk Search 02-15-2011 0 3	0	3
Is there any way to selectively avoid automatic field extraction? I have multiline events where there's a fair bit of auto-kv extraction that is good, but then there's a lot of noise ... by sideview SplunkTrust in Splunk Search 02-15-2011 1 6	1	6
timechart percentage data - not working Hi, I am trying to plot the percentage data over a period of span 1h. host="abc" sourcetype="xyz" ("Eurl" ) \| eval ... by aahadqj Explorer in Splunk Search 02-15-2011 1 7	1	7
Chart displaying UNIX timestamp on x axis. How to change to human readable date? Hi All, I'll start with the data we are dealing with. It deals with predictions of a price into the future. We recei... by phoenixdigital Builder in Splunk Search 02-15-2011 2 5	2	5
Need something like addtotals(sum across columns) for calculating average across columns I want to compute average across columns for a table(that I get as a result from stats command). I am trying to do so... by hmahendrakumar Path Finder in Splunk Search 02-14-2011 0 3	0	3
Can't figure out how to get Syslog data to chart Hi, I am having ADSL line problems as a result I am using splunk to monitor my syslog, especially interested in lines... by anthonycohn New Member in Splunk Search 02-14-2011 0 3	0	3
how to centralized the splunk login account? Dear Sir, We will have two indexer servers for our account login to manage they account founctions, so how to centra... by dikaye Path Finder in Splunk Search 02-14-2011 0 3	0	3
How to calculate time elapsed since now from IIS logs I need to be able to show how long it has been since a user uploaded or downloaded a specific type of data based on t... by DaClyde Contributor in Splunk Search 02-12-2011 1 5	1	5
Can't disable remote web browsing My Enterprise Trial license was just about to expire, so I applied the "free" license. Since there is no authenticat... by dpgrant Engager in Splunk Search 02-11-2011 1 1	1	1
Can I add text to return value of eval/case? I'm writing a search that performs a simple eval: eval changed = case (NOT address="-",address,NOT city="-",city,NOT... by castle1126 Communicator in Splunk Search 02-11-2011 3 3	3	3
Multiple values, same field -- how? I'm not sure how to workaround an issue where my field extraction is working on multiple values of the same field. F... by the_wolverine Champion in Splunk Search 02-11-2011 0 4	0	4
Can't manage field extractions from manager I'm doing some field extractions for a sourcetype and Splunk is saying the field has already been extracted. I went ... by jambajuice Communicator in Splunk Search 02-10-2011 0 2	0	2
How do I extract useful information into fields from Oracle WebLogic Application Server logs? I want to extract fields from WebLogic logs to use in reports. by Rob_Jordan Explorer in Splunk Search 02-10-2011 3 2	3	2
How can I index config files and text documents as individual events? When I configure Splunk to index a folder containing config files and text documents, it indexes each line of the fil... by Ron_Naken Splunk Employee in Splunk Search 02-10-2011 2 2	2	2
Match substring in list to event I am using lookup to "house" this long list of keywords. Now, I want to run a query against field A (eg. ABC-DEF-ZYL)... by jq06 New Member in Splunk Search 02-10-2011 0 3	0	3
Is it possible to use outputlookup to append results to a lookup table? I want to create a single lookup table based on the results of three different searches. I've tried using subsearche... by jambajuice Communicator in Splunk Search 02-10-2011 3 2	3	2
How to search a Multiline event using rex at searchtime? Hey Splunkers, I cannot get the following rex statement to match in Splunk. I read that using (?m) in the transforms... by I-Man Communicator in Splunk Search 02-10-2011 2 4	2	4
Log Volume Indexed. I would like to display the volume indexed from several indexed into following chart. Past 24hrs log volume by time... by sanju005ind Communicator in Splunk Search 02-09-2011 0 3	0	3
Quick Question: Field Lookups http://www.splunk.com/base/Documentation/latest/User/Fieldlookupstutorial Error 'Could not find all of the spec... by wyang6 Path Finder in Splunk Search 02-09-2011 0 1	0	1
How to create a menu item in the search app ? Hi, I am trying to create an arborescence of saved search but I have some problems. I would like to have something li... by ruffieuxlu New Member in Splunk Search 02-09-2011 0 4	0	4
stats generate distinct counts by a field, and also overall I am parsing through a lot of data, so I want to do this preferably in one search command. 1) I want to generate dis... by nbharadwaj Path Finder in Splunk Search 02-08-2011 3 3	3	3
adding lookup or eval to transforms.conf I would like to do an eval on every log entry, from a certian sourcetype. In this case I have a real number that I w... by fk319 Builder in Splunk Search 02-08-2011 0 2	0	2
is there an official list of Splunk error codes? It would be very helpful to have a documented list of error codes. Does anyone know of such a thing? Even if there i... by dhaffner Path Finder in Splunk Search 02-08-2011 3 5	3	5
How can I control the order of results on a chart or timechart? I have a timechart that is based on count by score, where score is a whole number between 0 and 10. Every time I mak... by jambajuice Communicator in Splunk Search 02-08-2011 2 1	2	1
anonymized data We are conducting a study in our organization surrounding productivity and user behavior. Currently I'm receiving al... by gregwilliams Path Finder in Splunk Search 02-08-2011 3 1	3	1