Splunk Search

Community Activity

rex extraction Hi, I'm trying to extract a field via rex for a search and having problems. Hoping someone could help me... Here's ... by a212830 Champion in Splunk Search 02-06-2019 0 3	0	3
rex word extraction? How can i write a regular expression to extract string starting with S and ends with 'E'. I have used like this. r... by rakesh_498115 Motivator in Splunk Search 02-06-2019 2 8	2	8
How can I put the status into 1 when the log has "failed"? I'm creating oracle RMAN chart and need the status when failed then the status should be 1 normally it should be 0. F... by shiranaka New Member in Splunk Search 02-06-2019 0 5	0	5
When is \| tstats summariesonly=true 100% finished on an accelerated Data-model? How do I know when \| tstats summariesonly=true is 100% finished on an accelerated Data-model? I have issues where we... by robertlynch2020 Influencer in Splunk Search 02-06-2019 1 11	1	11
How do I do a CIDR match with an inputlookup? Hi All, I have a lookup that currently works. I've set match_type to CIDR(netRange) in my transforms file and every... by adepasquale Path Finder in Splunk Search 02-06-2019 0 6	0	6
How to change the permissions of a saved search from the CLI I add a new saved search by CLI splunk: ./splunk add saved-search -search 'ERROR*' -name 'ERROR chart' -schedule '0 ... by sadon Explorer in Splunk Search 02-06-2019 2 6	2	6
With regex, can you help us extract the first word that comes after the timestamp? I wanted to extract the first word that comes after the timestamp. The time stamps are of varied formats example ev... by zacksoft Contributor in Splunk Search 02-06-2019 0 11	0	11
Unable to map more than one access role in scripted authentication Hi, I have tried to map more than one access role to scripted authenticated users but only the first role is getting... by ab374134 Explorer in Splunk Search 02-06-2019 0 0	0	0
How to improve my search to identify queries which consume a large amount of memory? We had recently Search Heads crashing and it seems that queries which consume 11-12 GBs of memory cause the crashes. ... by ddrillic Ultra Champion in Splunk Search 02-06-2019 0 3	0	3
What is the problem with Regex field extraction with "OR" Hi everyone, I have data from Cisco ESA similar to this two examples: > Feb 6 10:29:56 10.1.1.152 Feb 06 10:29:45 ... by MOberschelp Explorer in Splunk Search 02-06-2019 0 5	0	5
How to find the timestamp of first occurrence of the event in a transaction? I have a transaction similar to the below one: 02/06/2018 15:10:30.560 Starting transaction 02/06/2018 15:20:90.150 ... by Naren26 Path Finder in Splunk Search 02-06-2019 0 2	0	2
How do I rename field values and add up the count(*) if the value is the same? How do I rename field values, and if the values are same, add up the corresponding count value? index="abc" earliest... by rohanmiskin Explorer in Splunk Search 02-06-2019 0 3	0	3
How do you pass a field to another chart using drilldowns? i have query like: \| timechart count by status. output: _time status 1/1/2018 20:10:12.214 2 10/1/2018 12:32:45.... by james_n Path Finder in Splunk Search 02-06-2019 0 12	0	12
in my case various null rows are there i display only the rows where value is coming index="_internal" \| table wallclock_ms_total,method,status in the above case null value is coming remove the rows by arihant16cse Path Finder in Splunk Search 02-05-2019 0 1	0	1
need for creating table Do I need to create table to run queries in static data files? I have uploaded the file but unable to run queries as ... by labani Explorer in Splunk Search 02-05-2019 0 3	0	3
How do you exclude weekends from the calculation of expected end time? I am doing a support ticket with 4 levels of severity. Level 1 expects the ticket to be resolved in 4 hoursLevel 2 e... by louisawang New Member in Splunk Search 02-05-2019 0 7	0	7
how to make column chart with filter by host and upper bound Hi, splunk comunity! How can i make query which print some info in column chart filtred by hosts and also upper bound... by mishaaaaaaaaaa Explorer in Splunk Search 02-05-2019 0 2	0	2
Fuzzy Search Not working properly Hi , I am using Splunk 7.2.0 and have used Fuzzy Search for Splunk(https://splunkbase.splunk.com/app/3109/#/details)... by anchitratnesh New Member in Splunk Search 02-05-2019 0 0	0	0
Can you help me generate stats per day? I have data like this: Time, A, B, C 01.01.2019. 11:00:00, 561, 756, 456 01.01.2019. 11:01:00, 661, 256, 123 01.01.... by darioapis Explorer in Splunk Search 02-05-2019 0 3	0	3
Can you help me figure out the best way to write the following query? Kindly provide a better way to write the query in the below example. Also, one more thing I need help with is the hi... by sherrysafdar Explorer in Splunk Search 02-05-2019 0 5	0	5
How do you do a multisearch query with the dedup command in a subsearch? I need to search on multiple indexes with the need of the dedup command on one of the searches, for which I only need... by amdhindsa New Member in Splunk Search 02-05-2019 0 4	0	4
How do you list source IPs that hit only two URLs in WEB source types? We have WEB logs, and we need to isolate the source IPs that only (only) hit two URLs. The fields are: src for sou... by aamer86 Path Finder in Splunk Search 02-05-2019 0 8	0	8
Difference between (_time) internal field and (timestamp) default field Guys I cant find the difference between _time internal field and timestamp default field in docs anywhere, Can someo... by PowerPacked Builder in Splunk Search 02-05-2019 0 8	0	8
Can you help me set the concurrency limit in limits.conf? The concurrency limit is set to five based on the below log. We are using a 4 core CPU, and according to the limits.c... by pdantuuri0411 Explorer in Splunk Search 02-05-2019 0 1	0	1
how can i dynamicly change span parametr in timechart i need to change span parameter depending on the time range how can i set dynamycly changing of span in my search qu... by mishaaaaaaaaaa Explorer in Splunk Search 02-05-2019 0 6	0	6