Splunk Search

Community Activity

How do you rename rows using a CSV file? Hi there, I need a way to rename rows using a file list (csv file or other file type) from a search job / dashboard.... by bogdan_nicolesc Communicator in Splunk Search 10-29-2018 0 3	0	3
Foreach value of a field, check another value. If there is a change for continuous 10 minutes then send alert Foreach value of a field (say field1), check if there is continuous 5 minutes low or high value (than 100) of res_tim... by sahil237888 Path Finder in Splunk Search 10-29-2018 0 0	0	0
How do you write a regular expression to extract a field between two colons with a particular pattern? Hi, Can anyone teach me how to write a regular expression to extract the field on the following raw event? sendmai... by kcchu01 Explorer in Splunk Search 10-29-2018 0 3	0	3
Search auto-finalized after disk usage limit (100mb) reached - What does this mean? Started getting Search auto-finalized after disk usage limit (100mb) reached - What does this mean? by simpkins1958 Contributor in Splunk Search 10-29-2018 0 4	0	4
How do I display the result of a search in a table even if there is no event? Hello, I would like to know how to display results in a count table (count = 0) even if the search doesn't return ev... by jip31 Motivator in Splunk Search 10-29-2018 0 6	0	6
combine 2 search result without using \|join Hello, I am currently have 2 tables: Table-1 date, common-granularity, groupId-1, value-1 Table-2: date, common-gr... by zztc2004 Explorer in Splunk Search 10-28-2018 0 2	0	2
Is appendcols or join better for search performance? Hi there, I am trying to decide which Splunk command I should use to give better long-term performance on the search... by msmapper Path Finder in Splunk Search 10-28-2018 0 8	0	8
How to optimize an automated correlation search for process monitoring? I am utilizing a correlation search to schedule the delivery of application performance metrics against running proce... by jrnortonjr New Member in Splunk Search 10-28-2018 0 1	0	1
What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor? We are discussing the subsearch_max configuration setting in limits.conf internally and trying to better understand t... by mschellhouse Path Finder in Splunk Search 10-28-2018 3 1	3	1
Substring only the displayed data The goal here is to let the search filter on the full values but only return a portion (substring) of the "Message" f... by rossboss1989 Engager in Splunk Search 10-28-2018 0 1	0	1
How do I find out Splunk API query row count? I am using Python API call to get Splunk data. I was running to a limit where I was hitting a limit of 50k. I saw thi... by Splunkster45 Communicator in Splunk Search 10-28-2018 0 1	0	1
Searching for a string from one sourcetype in another sourcetype which is present as a list Hi All, I have two source type , for example. 1) sourcetype 1 2) sourcetype 2 In sourcetype 1 I have a string wh... by nhvardhan58 Explorer in Splunk Search 10-28-2018 0 2	0	2
Is it possible to write switch case statements in Splunk like other programming languages? Hi , Can it be possible to write switch case statements in Splunk like other programming languages? If so, can you ... by soumidutta Explorer in Splunk Search 10-27-2018 0 3	0	3
Joining two searches Hi , I want to join two searches without using Join command ? I don't want to use join command for optimization issu... by soumidutta Explorer in Splunk Search 10-27-2018 0 4	0	4
How do you make a regex expression to capture everything after the timestamp? Hello, Cannot crack this one. I have the following event: Fri Oct 26 07:19:41 2018 STATS: GATHER_STATS_JOB encounte... by MikaJustasACN Path Finder in Splunk Search 10-27-2018 0 2	0	2
How do you use a variation of the stats command on different fields? I have 3 fields: IPAddress, ServiceStatus, BackupStatus. ServiceStatus field consists of "Services Fine", "Services ... by sxddhxrthx Engager in Splunk Search 10-27-2018 0 1	0	1
How do you calculate the average across columns in a table? Hello Splunkers I tried a few of the suggested solutions, but none of them got me where I need to be, so i'm asking... by splunker1981 Path Finder in Splunk Search 10-26-2018 0 1	0	1
Is there a possibility in splunk to pull records by one field ( uniqueID) and generate a report with custom fields? I would like to get a report based on a unique customer id. Is there an option in splunk to generate this Query by ... by sharmilad New Member in Splunk Search 10-26-2018 0 1	0	1
How do you create a transaction out of a 500 error? Hi, I want to create a single transaction out of a 500 error and a specific type of error thrown immediately after th... by thompsonsgg New Member in Splunk Search 10-26-2018 0 2	0	2
How do you find a search that finds open windows locked-screen sessions? Trying to figure out a string to find open windows locked-screen sessions Monitored all security events when doing a... by ShaunBaker Path Finder in Splunk Search 10-26-2018 0 0	0	0
How do you combine one REST search with one of the _internal license_usage.log? The REST search \| REST /services/data/indexes \| search NOT title=_* NOT title=splunklogger NOT title=firedalerts NO... by wrangler2x Motivator in Splunk Search 10-26-2018 0 2	0	2
Can you help me with my multi-field field extraction query? I have a field in an event that contains a number of separate individual fields. What would be the most efficient way... by jpolcari Communicator in Splunk Search 10-26-2018 0 3	0	3
Which is the best approach to use with an eval+case+wildcard+chart by 2 fields? I've read as many examples as I can and I still can't figure out how to get this to work. We are using 6.6.2. I am t... by wilsonds Loves-to-Learn Lots in Splunk Search 10-26-2018 0 4	0	4
Limit for chart with split-by clause ? Hi, i have this search: index=foo \| eval length=length(_raw) \| chart eval(sum(length)/1024/1024) as MiB by applicat... by JensT Communicator in Splunk Search 10-26-2018 0 5	0	5
Combining events into one We're experiencing a problem with having indexed data with the default MAX_EVENTS value of 256. While this can be fix... by echalex Builder in Splunk Search 10-26-2018 1 3	1	3

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Splunk Search

How do you rename rows using a CSV file?

Foreach value of a field, check another value. If there is a change for continuous 10 minutes then send alert

How do you write a regular expression to extract a field between two colons with a particular pattern?

Search auto-finalized after disk usage limit (100mb) reached - What does this mean?

How do I display the result of a search in a table even if there is no event?

combine 2 search result without using |join

Is appendcols or join better for search performance?

How to optimize an automated correlation search for process monitoring?

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

Substring only the displayed data

How do I find out Splunk API query row count?

Searching for a string from one sourcetype in another sourcetype which is present as a list

Is it possible to write switch case statements in Splunk like other programming languages?

Joining two searches

How do you make a regex expression to capture everything after the timestamp?

How do you use a variation of the stats command on different fields?

How do you calculate the average across columns in a table?

Is there a possibility in splunk to pull records by one field ( uniqueID) and generate a report with custom fields?

How do you create a transaction out of a 500 error?

How do you find a search that finds open windows locked-screen sessions?

How do you combine one REST search with one of the _internal license_usage.log?

Can you help me with my multi-field field extraction query?

Which is the best approach to use with an eval+case+wildcard+chart by 2 fields?

Limit for chart with split-by clause ?

Combining events into one

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Quick connection discovery mode for forwarders

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation