Splunk Search

Community Activity

Kubernetes logs spamming Splunk We are having issues with Kubernetes containers spamming Splunk with 100's of gb's of logs sometimes. We would like t... by gschwel New Member in Splunk Search 06-10-2020 0 0	0	0
Issue with websphere sourcetype add-on Hi, We recently installed splunk add on for websphere source type "ibm:was:serverIndex" for websphere logs.When manua... by pdantuuri0411 Explorer in Splunk Search 06-10-2020 0 0	0	0
Time difference within a transaction command I have a search that uses the transaction: \| transaction startswith=<...> endswith=<...> Command to group it int... by tbrown Path Finder in Splunk Search 06-10-2020 0 2	0	2
Splunk Search for Total Values Hello There,I have got a search result as given below (without the highlighted row, i.e. Total):AnalystMonthTotal Cou... by madhav_dholakia Contributor in Splunk Search 06-10-2020 0 4	0	4
Display lines before and after the results of your string search I want to do a specific string search, say "mary had a little lamb" and have it return the results including the 5 li... by jtpryan New Member in Splunk Search 06-10-2020 0 1	0	1
Is there a limit on the search terms or the number of AND/OR conditions? I create a search query as follows: sourcetype="websense:proxy" \| table src_host policy \| dedup src_host policy \| ... by nareerat_pr Explorer in Splunk Search 06-10-2020 0 1	0	1
How to add a conditional statement in searchmatch? Hello, I'm new to Splunk, so please pardon me if this is too easy of a question.I'm trying to list attempted operatio... by ank15july96 Engager in Splunk Search 06-10-2020 0 3	0	3
Need to extract Workweek from date I have a date like 2020-06-08 06:39:49.0 I need to extract workweek from it. Thanks in advance. by shivareddysompa Explorer in Splunk Search 06-10-2020 0 3	0	3
Add avg to xyseries I have a column chart that works great, but I want to add a single value to each column. The columns represent the su... by seomaniv Explorer in Splunk Search 06-10-2020 0 3	0	3
Search by lookup file did not return all results I have a base search that produces a lookup that contains a million rows. When doing inputlookup, it displays the num... by timyong80 Explorer in Splunk Search 06-09-2020 0 1	0	1
Matching fields from different indices to return another field Hi, I have two different indexes where I need to match a field and if true, return another field. First Search (Index... by izyknows Path Finder in Splunk Search 06-09-2020 0 8	0	8
Zero results when searching with Splunk Powershell Module. I am experiencing an odd behavior with my Splunk module for powershell. A search query that on the web interface woul... by cmlombardo Path Finder in Splunk Search 06-09-2020 0 3	0	3
search with parameters Hello, I have this query: index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhc... by sarit_s Communicator in Splunk Search 06-09-2020 0 8	0	8
Join 3 source types with common field which matches on substring Hi All, I have query below which joins 3 sources 1,2,3 on id field, this works when id values matches across 3 source... by msrama5 Explorer in Splunk Search 06-09-2020 0 0	0	0
How to apply a regular expression that pulls multiple values from application log and show them to the given field name Hi all, I've been struggling to extract certain values from application logs and assign them to the given field name... by iqbalintouch Path Finder in Splunk Search 06-09-2020 0 2	0	2
How to build a lookup table based on a condition? Hello all, I can't figure out how to build a lookup with a condition. I have the following table which is my base sea... by dgoamaral Engager in Splunk Search 06-09-2020 0 1	0	1
Error message when creating a diag file Hello All, I'm receiving the following error when I try to create a diag file; ./splunk diag Collecting components:... by jrsanders Path Finder in Splunk Search 06-04-2020 0 2	0	2
How to add a value from a lookup table to results, by using a field value from the search? I want to include a value from a lookup table in search results, by using a field value from the main search. by jrobar New Member in Splunk Search 06-04-2020 0 1	0	1
How to abort a search if lookup file is causing errors and incomplete results? Hello all, I'm using a search that baselines user activity (looks back in time). But I've noticed that sometimes the ... by ddelmont Explorer in Splunk Search 06-04-2020 0 0	0	0
How to extract fields between backslashes and quotes with rex command? These rows have a field that begins and ends with a quote, but have different meanings between the backslashes. 1st a... by kjonesdba_lm Explorer in Splunk Search 06-04-2020 1 14	1	14
Month to date for previous month with current month date Hi, I have to extract the sum of particular search output from my query and the same needs to be compared with previ... by prakashmca05 Explorer in Splunk Search 06-04-2020 0 3	0	3
How to add a new column with serial number based on the uniqueness of the existing column? I have a column called "message" which has duplicate records in it. I want to create a new column named "serial" besi... by spkriyaz Path Finder in Splunk Search 06-04-2020 0 1	0	1
I want number of days between two events in splunk search? My query index=main source=secure.log sourcetype=* \| stats earliest(_time) as start, latest(_time) as stop \| eval ... by LogUx Motivator in Splunk Search 06-04-2020 0 1	0	1
Multiselect: value's prefix and suffix not working Hi Splunk colleagues, I'm having a problem with multiselect in my dashboards. Here's the code of the multiselect: <in... by ferivas New Member in Splunk Search 06-04-2020 0 2	0	2
What is the usage of "(?msi)" in Splunk with rex comamnd? Hi,I am having some problem to understand the usage of "(?msi)" with rex command,please help me regarding that? by admin12345678 Path Finder in Splunk Search 06-04-2020 0 3	0	3