Splunk Search

Community Activity

How to get the earliest and latest for the last full hour Hello, How would I set the earliest and latest to the last full hour? Example: current time 5:19 pm I want earliest=... by damucka Builder in Splunk Search 11-04-2019 1 2	1	2
getting error for regex "exceeded configured match_limit, consider raising the value in limits.conf" Below is the regex I am using \|rex field=_raw "\d\-\d\s\d\:\d\:\d\.\d\s(?<Primary_Server>[^\s]+)\s*(?<Primary... by vrmandadi Builder in Splunk Search 11-04-2019 1 3	1	3
Search String for Connection hangs I have been toying around with the task of identifying servers on our network with abnormal connection times . We hav... by jsproesser New Member in Splunk Search 11-04-2019 0 5	0	5
How to get tstats results independent of time range Hi All, is it possible to get list of sourcetype by host and index irrespective of time range? I just want the list ... by gaurav_maniar Builder in Splunk Search 11-04-2019 0 5	0	5
Highlight entire row in table after the row is clicked I want to highlight an entire row in a table when its clicked. I want this to be persistent so when I click outside t... by lyderhansen Engager in Splunk Search 11-04-2019 0 2	0	2
Splunk query for sum of fields Hi i have a field A B C D for example with following data A B C D 1 2 3 4 1 2 2 3 2 3 3 4 I want a result ... by NAVEEN_CTS Path Finder in Splunk Search 11-04-2019 0 1	0	1
How to add a column to a stats table using rex I'm fairly new to splunk and have just learned how to use the rex/regex. I am trying to add a column in my string se... by harshparikhxlrd Path Finder in Splunk Search 11-04-2019 0 3	0	3
How to sort table by total errors in descending order? Hi, I have this search and basically it shows a table with the channel. Error type, total error, and the sum total ... by lsy9891 Engager in Splunk Search 11-03-2019 0 1	0	1
How to determine if duplicate logs are sent There was an issue with our Splunk forwarders and it appears our application sent duplicate logs. I am seeing a sudd... by balash1979 Path Finder in Splunk Search 11-03-2019 0 3	0	3
Is the search concurrency and limits.conf too high? Hi! I'm wrestling with performance on our Production Splunk installation and have been reading on Search Concurren... by skirven Communicator in Splunk Search 11-03-2019 1 1	1	1
Performance issue on dashboard : Base search query and data model acceleration assistance required Hello Experts Actually I am trying to show the usage trends across one application on different platforms (Online, M... by gopiven Explorer in Splunk Search 11-03-2019 0 1	0	1
How to run a search only if the panel is visible The panel depends is been ignored and is still running the query which causes performance issues. How can you only r... by jjwallaby Engager in Splunk Search 11-03-2019 0 5	0	5
Help with script to make Splunk status up automatically if Splunk is down Please help me with the script below. This script is not running in Unix and Windows machine. Please help tweak and ... by rajaguru2790 Explorer in Splunk Search 11-03-2019 1 2	1	2
Splunk to verify output of the Splunk query I have created a splunk alert which runs after every one hour to check for certain pattern in last one hour. Most of ... by bsaujla131984 Path Finder in Splunk Search 11-02-2019 0 1	0	1
Tutorial seems inaccurate or my instance of Splunk Cloud is busted Specifically at this stage of the tutorial "https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchTutorial/Ab... by whitehaven Explorer in Splunk Search 11-02-2019 1 1	1	1
How to calculate two months of deviation with count index=proxy earliest=-1month@month latest=@month\|fields host month \| eval month=strftime(_time, "%m") \| stats count b... by igschloessl Explorer in Splunk Search 11-02-2019 0 7	0	7
Need help displaying null results in a table Hi, With the search below, I would like to be able to display in my table the host which have also "No SPLUNK Agent"... by jip31 Motivator in Splunk Search 11-02-2019 0 9	0	9
My Splunk Light license expired, so I switched to free, but why did I immediately get license violations and search was disabled? All, I had Splunk Light installed (version 6.4.0). Tried to log in, but noticed that the license had expired, so I s... by staze Path Finder in Splunk Search 11-02-2019 0 5	0	5
Transaction command doesn't work for all events when the 'endswith' event is seen next day. I am trying to run a transaction command for all the patrons where startswith=(Action=CardIn) endswith=(Action=CardOu... by aishwaryabh New Member in Splunk Search 11-02-2019 0 3	0	3
How to efficiently query all indexes for a list of IPs BACKGROUND: My Disaster Recovery team is compiling a list of all IPs endpoints, and has requested that I query all of... by asearson Explorer in Splunk Search 11-01-2019 0 4	0	4
How to generate timechart for eventstats per minute for multisearch index=something \| rex field=_raw ".\&WST=(?P<MMMId>[^&]+)." \| search Googly \| dedup MMMId \| bucket_... by rithick New Member in Splunk Search 11-01-2019 0 2	0	2
How can i disable the search that opens when i click on chart?! Hi I created a chart panel in a dashboard. The panel is based on an sql query. Everytime i click on the chart it sel... by alkhaldi Engager in Splunk Search 11-01-2019 0 4	0	4
Updating a lookup table with new row ? Hello All, I have an existing lookup file newlookupfile.csv. I'm trying to update the lookupfile with new row. I di... by iamsplunker31 Path Finder in Splunk Search 11-01-2019 0 6	0	6
Can you help me write a regular expression Need to extract Insurer , User , Dealer name 2019-11-01 06:54:20 W3SVC4 AUSYD11AS90 172.29.5.28 GET /Areas/Framewor... by rashi83 Path Finder in Splunk Search 11-01-2019 0 7	0	7
How to set up alerts with multiple fields with different thresholds Trying to setup up an alert with multiple fields extracted through Field. For example A,B, C etc and each having a d... by abhishekbhasin Explorer in Splunk Search 11-01-2019 1 12	1	12