Splunk Search

Community Activity

Subtract two timestamps in one event Hopefully this is a simple question, but I haven't found a way to do so using either the convert or eval commands. Ba... by jscottmiller New Member in Splunk Search 08-26-2010 0 2	0	2
Compare timestamps Is it possible to compare two times and get the difference in seconds? I have a field I am extracting called rec_time... by ericrobinson Path Finder in Splunk Search 08-26-2010 0 1	0	1
How to specify SplitMode using simple form XML Hi there, I can create a line graph with SplitMode, however there is no configuration guide for manually adding XML... by melonman Motivator in Splunk Search 08-26-2010 1 3	1	3
How can I configure axis and series with module Hi There, I would like to know how to configure axis. With the following XML, I got _time on Y-axis and count on X-A... by melonman Motivator in Splunk Search 08-26-2010 1 2	1	2
Display field uniques in search Hi there, What I am after is quite straight forward really. I am trying to conduct a search of a particular index (p... by aaronnicoli Path Finder in Splunk Search 08-25-2010 0 2	0	2
GeoIP app not working correctly Hi, I downloaded (installed via Splunk GUI) and am testing out the GeoIP app on my 4.1.4 search head. I'm having an ... by castle1126 Communicator in Splunk Search 08-25-2010 1 5	1	5
Realtime search question I have splunk forwarders configured on 3 machines going to a splunk receiver. I have a request to create a real-time ... by ericrobinson Path Finder in Splunk Search 08-25-2010 0 1	0	1
Computing average request time with mvcount fields and numerical field values Hello, Is it possible to compute an average of the numerical field by dividing it by the mvcount field I am defining... by ericrobinson Path Finder in Splunk Search 08-25-2010 0 2	0	2
Where should the tags.conf file be located? I am beginning to work with tags and am having partial success. I have a tags.conf file that I dropped into the loca... by muebel SplunkTrust in Splunk Search 08-25-2010 4 3	4	3
Trying to identify duplicate logs I've found some logs in our splunk environment that seem to be duplicates (they differ only by their srcip field--whi... by thepocketwade Path Finder in Splunk Search 08-25-2010 2 6	2	6
PDFServer cant contact appserver: Proxy Authentication Required Hi All my PDFserver cant contact the appserver. Both are running on the same host. How do I set these kind of props ... by tsillay Explorer in Splunk Search 08-25-2010 1 3	1	3
space-delimited txt file import I have a datasource that i export to a text file that I need to import into splunk. The file has a header that looks... by EricPartington Communicator in Splunk Search 08-24-2010 0 5	0	5
Transaction event charting question I was wondering if it is possible to chart results on a per event basis. By this, I mean that I have defined a transa... by ericrobinson Path Finder in Splunk Search 08-24-2010 0 3	0	3
download specific CSV columns via the web API? What I want to do is pull down the results of a saved search as a CSV file, which will then be loaded into a data war... by rwgilt Explorer in Splunk Search 08-24-2010 3 4	3	4
Transaction Search Using different fields across multiple logs I am facing a problem with doing a transaction search across multiple logs (11 different sourcetypes) based on the ex... by manwin Path Finder in Splunk Search 08-24-2010 3 6	3	6
Extracted fields issues I'm experiencing weird issues with extracted fields : I have a custom field that basically get the hostname (in bold ... by wleroy New Member in Splunk Search 08-24-2010 0 7	0	7
count rex output within one line? if I'm want to use a rex to pull out values at want to use the ?<xcount> psuedo-field to use in a chart, is this poss... by mmattek Path Finder in Splunk Search 08-24-2010 1 4	1	4
Do you have advenced xml example file to explain "Selector" module ??? Dear Sir Does you have advenced xml example file to explain "Selector" module ??? I can't understand the explanati... by SamChang Path Finder in Splunk Search 08-24-2010 0 6	0	6
Search query for multiple login done by more than one pc Hi all, someone can tell me how to do this query on the search app? multiple login done by more than one pc Th... by pinzer Path Finder in Splunk Search 08-23-2010 0 3	0	3
Complex transaction searches with varying fields What's the recommended approach when trying to correlate events together whenever the the events themselves don't all... by Lowell Super Champion in Splunk Search 08-23-2010 1 4	1	4
Help with transforms Hello, I have been using splunk for about 6 months and continue to be amazed at what the product can do.. Anyway, I... by ericrobinson Path Finder in Splunk Search 08-23-2010 0 2	0	2
Iplocation Command I tried using the iplocation command on the searchHeadUI. I was using this search: index=na1 logRecordTypeL=1 \| head... by rsimmons Splunk Employee in Splunk Search 08-23-2010 1 3	1	3
How to disable typeahead How do you disable typeahead? We want this turned off for all users by default. by sfmandmdev Path Finder in Splunk Search 08-23-2010 1 1	1	1
Generic Host search only uses "all time" When I choose a host from the Host list it automatically starts to search......but for "all time". I don't want to se... by MasterOogway Communicator in Splunk Search 08-23-2010 2 2	2	2
Separate combined log entries at search time I have an ongoing problem that I hope just goes away when I upgrade completely to v4. My current setup is v3 Forward... by vbumgarn Path Finder in Splunk Search 08-23-2010 0 2	0	2