Splunk Search

Community Activity

are they ways to make queries like this faster? I have to run a query periodically like this. The query seems to run pretty slow. Are there ways to optimize such a... by dtakacssplunk Explorer in Splunk Search 04-28-2019 0 2	0	2
Why is the search not showing all the expected results? Hello, I have log file that contains the following rows (im showing only those who relevant to my question) <0> 11/... by sarit_s Communicator in Splunk Search 04-28-2019 0 13	0	13
Append 2 tables. Gets "Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__index" error I am trying to append to search results which displays the same column headers. However I am getting the error: Missi... by niyaz006 Path Finder in Splunk Search 04-28-2019 0 2	0	2
_audit search for regex's Is it possible to build a search looking for regex variances? i.e. SSN regex, CC regex by reneedeleon Engager in Splunk Search 04-28-2019 0 6	0	6
Howto use _time to compare with field with time Hello, I've a field with date/time in it. The field name is system_created_on=2019-04-26 09:38:24. I have a time pi... by krusovice Path Finder in Splunk Search 04-28-2019 1 2	1	2
Location value in SPMetadata.xml We are trying to configure SSO on Splunk Web, but when we download the SPMetadata.xml file, it mentions the location ... by prafulag Engager in Splunk Search 04-28-2019 1 1	1	1
How can we figure out the size of KVStores and Lookups? In our enterprise sometimes kvstores and lookup files can get really large and we're looking for a way to monitor thi... by davedubinsky Engager in Splunk Search 04-28-2019 1 4	1	4
Cisco Network App and Search & Reporting App Time Difference With no TZ configured, my Search & Reporting App is displaying the correct time (UTC-10:00 or 13:00 HST) but, my Cisc... by splunkot New Member in Splunk Search 04-28-2019 0 5	0	5
Unable to continue after using a regular expression to extract a new field. This is day 2 working with splunk. I want to extract a portion of an xml printout in the logs. My regex works fine,... by jpetrides Explorer in Splunk Search 04-27-2019 1 10	1	10
transform command after timechart? Is it possible to do an eval after using timechart? I want to modify the count values in column A by dividing those ... by dyeo Engager in Splunk Search 04-27-2019 0 2	0	2
pstack以外の代替手段についてフォワーダーの splunkd プロセスが異常に CPU を使用している問題で、Splunk サポートに調査を依頼するため、pstack サンプルを採集しょうとしましたが、どうも pstack は Ubuntu 環境ではうまく動作しな... by cweiliou_splunk Splunk Employee in Splunk Search 04-27-2019 0 1	0	1
How to apply operator on a specific value in a table? I'm trying to divide a specific value in a table by 10. What is the best way to do this? My search: (index=Winevent... by dyeo Engager in Splunk Search 04-26-2019 0 2	0	2
Splunk Datamodel tstats Error Hi All, I have created a datamodel "Introspection_Usage" with global permission with the following dataset as given.... by keishamtcs Explorer in Splunk Search 04-26-2019 0 5	0	5
Calculating multiple counts in one search Hi all, I am trying to get the results for both the stats count in the code below. I'm getting no results when I d... by synastraa Path Finder in Splunk Search 04-26-2019 0 5	0	5
What is the reseasoning behind the Sysmon sourcetype? all, I was just looking at the sysmon sourcetype "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" and it's not... by daniel333 Builder in Splunk Search 04-26-2019 0 1	0	1
[Solved] How to extract fields with a space in a field name? [edit - a workaround was found in the comments] Hello, We try to export VMware inventory to Splunk. A raw Splunk ev... by AlexeySh Communicator in Splunk Search 04-26-2019 0 4	0	4
List different lines even when not found I had the follow data index=os sourcetype=top host=xxxxxxx \| search COMMAND = "startWebworksAd" OR COMMAND="startWLSS... by leonardomassard Explorer in Splunk Search 04-26-2019 0 2	0	2
"Unable to distribute to peer named...because peer has status = "Down""? What does this error mean? Unable to distribute to peer named foobar237.xxx.com:8089 at uri https://foobar237.xxx.c... by vrmandadi Builder in Splunk Search 04-26-2019 0 10	0	10
Extract part of the result Hello, I have some data in Splunk server that is separated by semicolon ";" String1=Int1;String2=Int2;String3=Int3..... by starbac Explorer in Splunk Search 04-26-2019 0 1	0	1
regex delimiters & config file formatting I'm experiencing a subtle issue, which is not very apparent due to lack of delimiters around regular expressions, whe... by Gregory_Lapchen Engager in Splunk Search 04-26-2019 3 3	3	3
How to pull events with multiple sourcetype I am searching events with specific multiple sourcetype, but getting extra sourcetype.Kindly refer attached file. Am... by rakesh44 Communicator in Splunk Search 04-26-2019 0 3	0	3
How to find count for each field value? Events: SEVERITY=5, INCIDENT=INC1929283737 Command index="_internal" component=root OR component=Metrics OR event... by rakesh44 Communicator in Splunk Search 04-25-2019 0 17	0	17
How to use regex to extract date? Hello experts , I need some help in extracting date time from the attribute "SrcDtm" in below sample data. <GI SrcDt... by kirangurram Explorer in Splunk Search 04-25-2019 0 2	0	2
How do I extract an email address from raw data using regex? Hi all, I have some raw data looking like this.(just a part) ....."","10/30/2018 7:31:08 AM","10/30/2018 7:41:52 AM"... by dannili Communicator in Splunk Search 04-25-2019 0 6	0	6
finding the index retention for missing data I am new to splunk. Is there any way to know whether an index got rolled to frozen because of frozen time period or m... by iamlearner123 Explorer in Splunk Search 04-25-2019 0 1	0	1