Splunk Search

Community Activity

can i get the one particular host information from the metadata command? I am using the below command and it is giving me the whole host lists in the environment, but i need for the particul... by pentela114 Engager in Splunk Search 05-16-2018 1 1	1	1
Can i define the time to search logs in colddb, db, datamodel or frozen It is posible change the time to specify the time of the storage in coldb or db. I have some index configurated in sp... by Said7 Explorer in Splunk Search 05-16-2018 0 1	0	1
How to create a regex to display all the hostnames? I have source as : /log/web/output/sat1svmdb1210_0511_kernel.log /log/web/output/sat2svmdb0100_7689_kernel.log I wan... by abhi04 Communicator in Splunk Search 05-16-2018 0 9	0	9
Why does the _time value keeps coming up blank? Hello, I have the following search string, but "_time" keeps coming up blank. It appears that something is "clearing"... by jon_d_irish_ctr Path Finder in Splunk Search 05-16-2018 0 4	0	4
How to use a lookup table in a Splunk query? I have a lookup excel sheet with the application name, hostname, and IP address. I want to use it in a Splunk query a... by abhi04 Communicator in Splunk Search 05-16-2018 0 3	0	3
Search help ? When Iam trying to run this search its giving me wrong results .Please correct my search. In my csv is having to cou... by splunker969 Communicator in Splunk Search 05-16-2018 0 6	0	6
Pass the earliest and latest value as arguments for main and sub search. Here is my requirements. On last 7 days logs need to search to get unique users per day basis and those users agai... by sankar_kasala New Member in Splunk Search 05-16-2018 0 4	0	4
Table Creation: Evaluating the sum of fields and displaying them grouped by another field I have a bit of a data that looks like base search term \| eval varA = fieldA/3 \| eval varB = fieldB/36 \| eval varC =... by splunk_question Explorer in Splunk Search 05-16-2018 0 2	0	2
Can I combine eval & latest? Hi, I have scenario were i have the record sets and the number & name will keep changing based on the status Table :... by varunapj New Member in Splunk Search 05-16-2018 0 4	0	4
Remove Wildcard from Field Name I have some ticketing data being imported into Splunk for analysis. There are a couple of field names with an asterix... by makarand13 New Member in Splunk Search 05-16-2018 0 4	0	4
How to compare field values in time? We are gathering data on information tags on servers. We want to know when a specific tag value changes so that we ca... by batsonpm Path Finder in Splunk Search 05-16-2018 0 10	0	10
Multiple eval of the same field Hi all, I got some problems categorizing a custom field according to its content; to do so I am using multiple eval ... by jlelli Path Finder in Splunk Search 05-16-2018 0 2	0	2
How to find all values after a certain label in a field with regex? Hi All, I have a big text field with sample value as: Random text Location:AL432 1)ART: New order ANYTHING Locat... by Chandras11 Communicator in Splunk Search 05-16-2018 0 7	0	7
How do I look for the existence of one field within another field? For example, if I have a proxy log, and it shows User=A, then In the URL field we have "http://somesite.com/parameter... by rwmilligan Explorer in Splunk Search 05-16-2018 0 2	0	2
disable mouse hover on line chart I want to disable hover on line chart, so it should not respond to hover, just a line. I was able to remove tooltip a... by dsiob Communicator in Splunk Search 05-16-2018 3 1	3	1
Splunk maintenance Is there maintenance procedure that Splunk Enterprise/deployment/instance requires periodically to ensure high perfo... by teddyidc1101 Communicator in Splunk Search 05-16-2018 0 4	0	4
How to create a timechart with multiple values? Hello! I'm trying to make a timechart like this one below, but I have some hosts that I need to show their medium cpu... by ppatrikfr Path Finder in Splunk Search 05-16-2018 0 3	0	3
can't extract the field, below error shows up, Argument 'value' contains invalid character : ^[\d+;\d+\w+\s+\d+-\d+-\d+\s+\d+:\d+:\d+,\d+\s+[\w+::\w+.\w+.\w+.\w+.\w... by simranrathi New Member in Splunk Search 05-16-2018 0 4	0	4
Stats Question passing one field common to two sourcetypes where location is in one sourcetype to use field in second sourcetype Where am i going wrong here: I'm trying to get a list of user ID's by location and pass them up to a search which al... by Skins Path Finder in Splunk Search 05-16-2018 0 1	0	1
Error in 'eval' command: The expression is malformed. An unexpected character is reached I was getting when I run the below query, can someone give me the solution pls, below is my query: \| convert num(ac... by sarathipattam New Member in Splunk Search 05-15-2018 0 2	0	2
How do I search for multiple errors found in /var/log/messages? I want to search for the following 3 error combinations and send alert if any, some or all are found: Error #1 - pro... by damonmanni Path Finder in Splunk Search 05-15-2018 0 1	0	1
How to filter and append a value from a subsearch into the primary search? My data is in JSON format split into two different sourcetypes. Between the two sourcetypes exists a linking logID th... by brajaram Communicator in Splunk Search 05-15-2018 0 1	0	1
How to modify my search to check mvindex count before eval? Hello Splunkers, I'm trying to figure out how to apply an if statement to check the count of an index before adding ... by splunker1981 Path Finder in Splunk Search 05-15-2018 0 2	0	2
JOIN to list user per DeviceId Search is trying to show all users within the companyOu that have Mobile Iron setup (Status=Allowed) and those that d... by davidcraven02 Communicator in Splunk Search 05-15-2018 0 7	0	7
What is the best way to handle repeating fields in a single event? Hi all, What would be the best way for Splunk to handle repeating fields in a single event? For instance, one of my ... by bcarr12 Path Finder in Splunk Search 05-15-2018 0 2	0	2