Splunk Search

Splunk Search

Community Activity

	Can the transaction command be used to group events where different fields have the same value? Use Case: Correlate logon events from a Windows desktop to events on the domain controller. Sample (shortened) event... by hulahoop Splunk Employee in Splunk Search 01-28-2010 2 9	2	9
	Can I alert when the value of a field changes? I've got an application that logs status events. The values in these events generally will not change. Is there a s... by matt Splunk Employee in Splunk Search 01-27-2010 1 1	1	1
	Error on using eval in a subsearch What is wrong with the way I'm using eval here? source="/some.audit.log" "End" "/foo/baz" \| rex field=_raw "(?P<ReqI... by dinh Path Finder in Splunk Search 01-27-2010 0 5	0	5
	How do I search for a single specific event? Sometimes I come across an event in my index that I'd like to refer to later, either as part of an investigation or t... by Johnvey Contributor in Splunk Search 01-25-2010 1 3	1	3
	I know the data is in the index, why didn't my scheduled search find all of the events? I have a saved seach setup to check every minute for file changes. I have the start time set for [-1m] to search bac... by Mick Splunk Employee in Splunk Search 01-22-2010 2 1	2	1
	suppressing adjacent events with duplicate field values I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where ... by Justin_Grant Contributor in Splunk Search 01-22-2010 0 2	0	2
	Will having lots of extracted fields increase my index size? I need to understand how adding fields to raw data will increase our index size growth. We are in the process of addi... by Mick Splunk Employee in Splunk Search 01-21-2010 2 1	2	1
	How do I share all of the field extractions defined in a given app with all other apps? I need to share all of the field extractions in my app with all of the other apps on the system. What is the most ef... by matt Splunk Employee in Splunk Search 01-21-2010 2 5	2	5
	What is the format of the Sources.data file? $SPLUNK_HOME/var/lib/splunk/defaultdb/db/Sources.data On a fresh install I see this file has something like this: ... by matt Splunk Employee in Splunk Search 01-21-2010 1 2	1	2
	Feature Request: troubleshooting/debugging for field extraction config files [UPDATE: from the answer below, it sounds like what I'm looking for is not supported in the product today. I'm tackin... by Justin_Grant Contributor in Splunk Search 01-20-2010 18 2	18	2
	Finalize action for searchscript? I wrote a search operator that takes actions external to splunk. It has to take an action to 'complete' its operatio... by jrodman Splunk Employee in Splunk Search 01-15-2010 2 2	2	2
	how to tell if I have multiline events? Because wc -l of the input doesn't match my event count, and I'm trying to troubleshoot. by V_at_Splunk Splunk Employee in Splunk Search 01-14-2010 1 2	1	2

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members! The ...