Splunk Search

Community Activity

How do you find common information between two users in a proxy log? how do I get common information from two users in a proxy log? for example, i would like to find whether a URL that... by pinkyyu Explorer in Splunk Search 01-27-2019 0 2	0	2
How to configure Search Head in one of the Index Server Hi I have the following setup : 1 x Node Master with 2 x indexer ( Clustering) How can I configure to designate one... by christay New Member in Splunk Search 01-27-2019 0 3	0	3
how to set the log size limit how to set the log size limit? how to make automatic deletion for the log collected by johnsmithcy Path Finder in Splunk Search 01-27-2019 0 8	0	8
splunk installation in windows 10 Warning: overriding %SPLUNK_HOME% setting in environment ("C:\Program Files\Splunk\bin") with "C:\Program Files\Splun... by lakshmichandu New Member in Splunk Search 01-27-2019 0 1	0	1
Why is the time off by a hundredth of a second? We have a case in with the time is off by a hundredth of a second for many events of a certain sourcetype - What c... by ddrillic Ultra Champion in Splunk Search 01-26-2019 0 5	0	5
Duration determination Here is a sample of a connection that spans the midnight hour into the next day. I'm trying to extract a new field na... by roayers Explorer in Splunk Search 01-26-2019 0 5	0	5
ERROR UserManagerPro - Could not get info for non-existent user="tesla" ERROR UserManagerPro - Could not get info for non-existent user="tesla" We have alerts setup to trigger .py scripts f... by bzsplunk54 New Member in Splunk Search 01-26-2019 0 2	0	2
TCP input gets only one event indexed I have fully configured cluster running Splunk 6.6.5. All indexers and search heads work properly with other inputs. ... by asnegina New Member in Splunk Search 01-26-2019 0 3	0	3
splunk backup - How to Exclude /var folder during backup I want to know what is the command and from where can i execute to exclude ( /var) folder from backing up. by srampally Path Finder in Splunk Search 01-26-2019 0 1	0	1
Send Windows Logs to thrid party without Splunk adding in new syslog header I can send a subset of windows data as syslog server by sourcetype and then use the TransFroms to REGEX out the host.... by jmcclure Explorer in Splunk Search 01-25-2019 0 1	0	1
is multi site cluster architecture the same as multi region cluster architecture? As we have different regions in AWS, and different sites in that region, is multi site cluster architecture the same ... by ahmed23 New Member in Splunk Search 01-25-2019 0 1	0	1
Is there a way I can see how much data is being searched per index? Is there a way I can see how much data is being searched per index? Eg: for an index, a user has searched 10 GB of d... by ssagar1009 New Member in Splunk Search 01-25-2019 0 3	0	3
How do you find the duration between A to C events (startswith & endswith) where event B needs to be there in the middle? Example: Event A: LoggingAspect.BeforeController Event B: Found in Cache Event C: LoggingAspect.afterReturningCont... by rsharma1984 Explorer in Splunk Search 01-25-2019 1 7	1	7
How to retrieve search name by search id my splunk server has high CPU usage and I saw a bunch of splunkd process like below search --id=admin_adminsearch_se... by danielwan Explorer in Splunk Search 01-25-2019 1 3	1	3
How do you send an alert when the number of records goes below 20% of the daily avg? Hi , I am using the below query to get an average count . But how do I write a query to send an alert when the numbe... by navd New Member in Splunk Search 01-25-2019 0 3	0	3
Very Large Diag File It is becoming harder to submit cases, because our diag files have gotten very large. In the most recent case, the di... by reed_kelly Contributor in Splunk Search 01-25-2019 2 4	2	4
Can you help me compare the numerical values of fields? My company gets a log file that we are trying to compare a set of numbers to one another. These numbers have to be wi... by sgoodman26 Explorer in Splunk Search 01-25-2019 0 4	0	4
Too many one time connections I recently upgraded a Windows heavy forwarder to 7.2.3 and I am now getting errors when it attempts to connect to an ... by joeldavideng Path Finder in Splunk Search 01-25-2019 0 2	0	2
use regex to remove a number from a string Hi, I want to remove a number (up to 5 digits) from a string on its beginning. an example: 43.aaaa_vvvvv.cccccc:ddd... by matansocher Contributor in Splunk Search 01-25-2019 0 3	0	3
視覚エフェクトで作成したグラフの色について - About color of graph created by visual effect Splunk Enterprizeでログのサーチ結果をグラフ化しようとしています。サーチした結果について、視覚エフェクトからグラフ化したところ、グラフの色が用意していた項目の色とずれてしまいました。主導でグラフの色を変えられないか... by arai0729 Explorer in Splunk Search 01-25-2019 0 1	0	1
Timeline App duration problem Hi everyone! I'm trying to use Timeline module but I have some trouble with the duration: Note: I'm working with a l... by MaryvonneMB Path Finder in Splunk Search 01-25-2019 0 4	0	4
Can you help me extract the following fields using the rex command? Is there any way I can extract only PersistenceLo cache cleared! and PmFinUtilityL Cache Cleared (highlighted in BOLD... by harishnpandey Explorer in Splunk Search 01-25-2019 0 5	0	5
Can you help me with a lookup table behavior question? I have a lookup table that is giving me strange search results that I can't figure out — I have a table which is a li... by wfjarrett538 Explorer in Splunk Search 01-25-2019 0 6	0	6
Strange timechart issue I have an issue on one of my two search head clusters where the column order is reversed when running timechart. For... by john_dagostino Path Finder in Splunk Search 01-25-2019 0 9	0	9
Adding search to a search in search string .... Hi all, What i try to ask is if that i can add to this: (index="bogdan") \| rename Date AS RootObject.Date ... by bogdan_nicolesc Communicator in Splunk Search 01-25-2019 0 11	0	11