Splunk Search

Community Activity

Are lookup tables indexed? So how does splunk handle static lookup tables, are they indexed? max_memtable_bytes = * maximum size of static lo... by carmackd Communicator in Splunk Search 10-26-2010 4 3	4	3
match data from 2 queries I have some log entries that look like this: (note the brackets ARE in my logs) [10/25/2010] [10:25:31.817] [SCAN_H... by mcafeesecure Explorer in Splunk Search 10-26-2010 0 1	0	1
When posting setup.xml data to a custom endpoint, is it possible to make EAI calls that are properly authenticated and namespaced? My problem seems very similar to http://answers.splunk.com/questions/4175/redirects-before-and-after-our-apps-setup-... by sideview SplunkTrust in Splunk Search 10-25-2010 1 3	1	3
Automatic hostname configuration? In regard to > http://answers.splunk.com/questions/794/how-to-change-hostname-of-a-splunk-server My question is why ... by tkrn Engager in Splunk Search 10-25-2010 0 1	0	1
Multiple events returned in a single transaction - possible to create a single row in a table/csv file? I've got a transaction that returns 2 events. Originally these are 3 events but the transaction has combined 2 of th... by the_wolverine Champion in Splunk Search 10-25-2010 0 2	0	2
Two earliest queries - want search to pick based upon newest I have a query where I need to determine the earliest time I want events from.. It is either (1) The last time jboss ... by htkhtk Path Finder in Splunk Search 10-23-2010 1 1	1	1
What is the best way to show sparse concurrent transaction counts? I'm trying to report on concurrent SSL VPN sessions over time on an F5 APM device. I've defined the fields and the tr... by zentish New Member in Splunk Search 10-22-2010 0 2	0	2
Is it possible to extract a field from a transaction event? My field extraction doesn't appear to work in my transaction event. Does Splunk just combine all the various fields ... by the_wolverine Champion in Splunk Search 10-22-2010 2 1	2	1
Lookup table Limits Is there a row or column limit for a lookup table. I currently have a lookup that has 25 columns, and 350k rows, whi... by carmackd Communicator in Splunk Search 10-22-2010 0 9	0	9
How do you change the legend value Outside of renaming(aliasing) the actual field, can you also rename the entire content of the history for charting? ... by BunnyHop Contributor in Splunk Search 10-22-2010 0 1	0	1
Pie chart drilldown help Hi all, i need to change the search query when clicking on a slice of the pie chart. I need to add "\| where " to the ... by pinzer Path Finder in Splunk Search 10-21-2010 1 2	1	2
Need a search string to find MB indexed per 24 hour by a specific host Need a search string to find MB indexed per 24 hour by a specific host. Can someone send an example? by nls21 Explorer in Splunk Search 10-21-2010 0 3	0	3
How to get to a working example of the Map Command? I am trying: name=foo minutesago=1 \| head 1000 \| dedup host \| stats list(host) as list \| map search="search host=$li... by muebel SplunkTrust in Splunk Search 10-21-2010 3 2	3	2
Searches Require Wildcards I have two Splunk 4.1.3 instances that index the same data. Some searches work on one instance but not the other. The... by Jason_S Path Finder in Splunk Search 10-21-2010 0 4	0	4
Splunk indexes some events several times? In some of our indexed logs, I'll see several log entries for the same log at the same time. I thought this may be an... by cfortune Explorer in Splunk Search 10-21-2010 0 2	0	2
Need non-Flash version of charting An HTML5 alternative to chart rendering is needed. Monitoring from an iPad, for example, is impossible without it. ... by nsxdavid Engager in Splunk Search 10-21-2010 2 2	2	2
xferlog query to get top sites Good Afternoon, I have indexed my xferlogs from my FTP server and I would like to run a query of the top sites acces... by gmhp New Member in Splunk Search 10-21-2010 0 1	0	1
How to get the "splunk" command working with Windows 2008 and UAC? This may be more of a Windows UAC question than a splunk question, but I'm guessing that others are going to be runni... by Lowell Super Champion in Splunk Search 10-20-2010 1 5	1	5
Field Extraction Mystery Hey, I would like to use field extraction at search time to do the following: My source field in Splunk contains fi... by Ant1D Motivator in Splunk Search 10-20-2010 0 6	0	6
Cached search results Hi, I am using time consuming searches and i was wondering if and how is it possible to run the searches in advance ... by Eldad Explorer in Splunk Search 10-19-2010 4 2	4	2
Using search regex fails when the fieldname is a number So i have this regex: \| regex sy="\S{4,10}" which works fine. I'm telling it to match only on non-whitespace char... by nnachefski Engager in Splunk Search 10-19-2010 0 1	0	1
Matching events icon Hey, I have a question about the following icon shown in the image below: This icon is usually shown after you ex... by Ant1D Motivator in Splunk Search 10-19-2010 0 2	0	2
Search with XPath Hi I am having a problem searching an xml formated event. So basically I have an event that looks like this: <?xml v... by gallantalex Path Finder in Splunk Search 10-19-2010 1 6	1	6
Splunk duplicating events every time file changes I have created a directory to store log files that I pull from a remote machine. I use a cronjob to pull every x min... by bitbuck3t New Member in Splunk Search 10-19-2010 0 2	0	2
Will Splunk index events older than 1970/1/1 ? as Title , I have many events older than 1970/1/1 , Splunk doesn't index those events (I have modified max_days_ago=1... by dmlee Communicator in Splunk Search 10-19-2010 2 3	2	3

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Splunk Search

Are lookup tables indexed?

match data from 2 queries

When posting setup.xml data to a custom endpoint, is it possible to make EAI calls that are properly authenticated and namespaced?

Automatic hostname configuration?

Multiple events returned in a single transaction - possible to create a single row in a table/csv file?

Two earliest queries - want search to pick based upon newest

What is the best way to show sparse concurrent transaction counts?

Is it possible to extract a field from a transaction event?

Lookup table Limits

How do you change the legend value

Pie chart drilldown help

Need a search string to find MB indexed per 24 hour by a specific host

How to get to a working example of the Map Command?

Searches Require Wildcards

Splunk indexes some events several times?

Need non-Flash version of charting

xferlog query to get top sites

How to get the "splunk" command working with Windows 2008 and UAC?

Field Extraction Mystery

Cached search results

Using search regex fails when the fieldname is a number

Matching events icon

Search with XPath

Splunk duplicating events every time file changes

Will Splunk index events older than 1970/1/1 ?

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Quick connection discovery mode for forwarders

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation