Splunk Search

Community Activity

How to merge two fields values into a single field? Hi, I have the below stats result Service Method Action Service1 Metho... by Allampally Path Finder in Splunk Search 05-06-2018 1 1	1	1
Split a single field into two fields Hi, I have a raw_data as below [APP=XYZ] [m=ServiceName.MethodName] [SLA=100] Splunk already generated a filed with ... by Allampally Path Finder in Splunk Search 05-06-2018 0 2	0	2
Fire Dynamic Search Queries based on Tokens I have various Inputs and i want to execute different query based of different token input value. Eg. I have 2 diffe... by raja21 Explorer in Splunk Search 05-06-2018 0 1	0	1
Match A lookup of Hosts & IP's to metadata search, to find hosts logging and not logging (where the hostname might be an IP address) Hi Splunk Community! I have a search i'm trying to build out, that will ultimately power some Dashboards to find ho... by mmwilson Explorer in Splunk Search 05-06-2018 0 0	0	0
windows client to splunk hello all i have a client that i already installed splunk forwarder on it and configured to log everything and send ... by payamhaddad New Member in Splunk Search 05-06-2018 0 2	0	2
How can I do stats by eventtype? All, I have three eventtypes [insecure_telnet] app=telnet OR dest_port=23 [insecure_snmp] app=snmp OR dest_port... by daniel333 Builder in Splunk Search 05-06-2018 0 1	0	1
How do I do search between 2 different indexes? Think of this as a youtube scenario where I have 2 different indexes: viewerreport and videoreport. The viewerreport... by tamduong16 Contributor in Splunk Search 05-05-2018 0 3	0	3
Field value combine from auto extracted value Hi All, We have endpoint logs by default logs are in JSON format field which are auto extracted however we have two... by sumitkathpal292 New Member in Splunk Search 05-05-2018 0 1	0	1
Change the span start time defaults when using bin span=1w _time Hi - I'm trying to display a count of all sources over a 4 week period for a specific source type as part of a data q... by skelly99 Explorer in Splunk Search 05-04-2018 0 3	0	3
How to display a custom field with underscore from search result For instance, how to show "_msg" from the search result? Thanks. \| makeresults \| eval _msg="Hello World" by splunkrocks2014 Communicator in Splunk Search 05-04-2018 0 2	0	2
scrub command returning 50000 results Looking for confirmation that I've found the right setting. When i run: query \| stats count I see 400,000 events. ... by chrisw3 Explorer in Splunk Search 05-04-2018 1 4	1	4
Is there a way to get additional fields from whois via iplocation command Hi, Is there a way to get the "Resolve host" "NetName" "Organization" fields from whois, using the iplocation comma... by a212830 Champion in Splunk Search 05-04-2018 0 2	0	2
regex transformation not working in transforms.conf where it does at search time? I have the following data in a key (called test_key through a field extraction) I want to split: domain\firstname.la... by jmartens Path Finder in Splunk Search 05-04-2018 0 5	0	5
How to get the total count by getting the number from the string in Splunk log? I have a splunk log as follows: ...\|\|pool-2-thread-1\|\| INFO com.tmobile.sfdc.reports.batch.writer.LeadItemWriter - ... by karthi25 Path Finder in Splunk Search 05-04-2018 0 7	0	7
Single deployment app for Prod, Test & DR. How we usually do business is; on our deployment server, we will create an app specific to its environment. Which can... by Harinder_Singh New Member in Splunk Search 05-04-2018 0 11	0	11
Merge events base on common field Hi, is there any way i could merge events base on common field? For example there are 6 events : Jun 1 2012 A:1 Ju... by darksky21 Path Finder in Splunk Search 05-04-2018 2 3	2	3
How can I iterate through all the column names and replace characters in the their names? How can I iterate through all the column names and replace space with underscore and replace :(colon space) with an u... by HattrickNZ Motivator in Splunk Search 05-04-2018 0 1	0	1
No filter by owner in views when owner contains a \ If I filter by Owner in View 'Searches, Reports, and Alerts' (Settings->Searches, Reports, and Alerts), there are no ... by shoermann Explorer in Splunk Search 05-03-2018 0 1	0	1
How to search for a series of strings then count and display by host? Hello everybody! Trying to search for a series of strings - then count and display by host. I got this far: index=... by skiller1234 Explorer in Splunk Search 05-03-2018 0 2	0	2
With multiple `appendpipes` how do I specify the number of rows above I want to apply it to? With multiple appendpipes how do I specify the number of rows above I want to apply it to? \| makeresults \| eval ... by HattrickNZ Motivator in Splunk Search 05-03-2018 3 5	3	5
How to overcome sub search limitation (only 10k records). ...dedup Order_Number\|search NOT[\|inputlookup Order_Details_Lookup.csv\|fields Order_Number]\|table Order_Number Need ... by ksolanki88 Explorer in Splunk Search 05-03-2018 3 12	3	12
How to configure logging from a custom search command to the search.log Splunk Web using the Splunk Python SDK? Hi, I'm writing a search command and need to log events from it to Splunk Web. I'm using the Python SDK in the curr... by johannesschilli Engager in Splunk Search 05-03-2018 0 2	0	2
cross checking information between two sourcetypes I have two sourcetypes. first is a table of different pet types and respective animal. second is showing which pet is... by asuratos New Member in Splunk Search 05-03-2018 0 6	0	6
Extract server name, HealthState, and HoggingTrheadCount from txt file I was thinking that I could do a rex to grab everything up to the newline but I am trying to categorize the below out... by wilcoxj New Member in Splunk Search 05-03-2018 0 6	0	6
How to write a custom generating command which can leverage the single input to collect data and write the output as events to an index? I am trying to find a good tutorial (yes, I have looked at the splunk documents) on writing a custom generating comma... by panovattack Communicator in Splunk Search 05-03-2018 1 0	1	0