Top

Category Activity

How to subtract two specific requestTime For every Retention key (already extracted by Splunk: 20181947800000) I want to subtract the requestTime="2009-05-26T... by Alan_Bradley Path Finder in Splunk Search 03-19-2010 0 1	0	1
How do we turn off alert email from source type=ps We get an alert from sourcetype=ps as a result of running this save search: (authentication failure) OR (Account * to... by Alan_Bradley Path Finder in Alerting 03-19-2010 0 1	0	1
How to add hosts? I do not see in any of the manuals or Help how to add host servers. You label the targets as Host on the main page bu... by Alan_Bradley Path Finder in Getting Data In 03-19-2010 1 1	1	1
Search for disappeared and new hosts Hi I would like to have a way to find out whether hosts have stopped logging to our central log infrastructure or i... by chris Motivator in Splunk Search 03-19-2010 0 3	0	3
How often does Splunk check to apply retention policy? If a size- or time-based retention policy is set via maxTotalDataSizeMB or frozenTimePeriodInSecs in indexes.conf, ho... by hulahoop Splunk Employee in Getting Data In 03-18-2010 3 2	3	2
How can I create a stacked line graph with multiple values from the same log line? I am having trouble getting my head around the search required to graph multiple values from the same log event. It s... by Glenn Builder in Splunk Search 03-18-2010 2 5	2	5
Put Data in Separate Index Based on Timestamp We have Splunk as part of our default vm image but we're having some bucket issues. Initially, the time isn't set an... by oreoshake Communicator in Monitoring Splunk 03-17-2010 2 1	2	1
Creating a parameterized transaction search Our office has a specific TRANSACTION search we do frequently to track all events related to a particular user. The s... by Justin_Grant Contributor in Splunk Search 03-16-2010 0 5	0	5
How to use 2 timeranges in a single search? I'd like to provide a table where the event count for today and yesterday are displayed. For example, count by statu... by hulahoop Splunk Employee in Splunk Search 03-16-2010 0 2	0	2
Does SEDCMD use PCRE regular expressions? I know that in general, regular expressions in Splunk use PCRE (or a modified PCRE for matching in props.conf source ... by gkanapathy Splunk Employee in Splunk Search 03-15-2010 3 1	3	1
Automating troubleticket creation How can I set up Splunk to automatically open troubletickets? by SteveS Splunk Employee in Getting Data In 03-15-2010 1 1	1	1
How to optimize performance for scripted lookups? I would like to use a lookup into an external database to add fields to my events, but need some advice about perform... by Justin_Grant Contributor in Splunk Search 03-15-2010 2 3	2	3
What are the defaults for the dbinspect command? On the Search App > Status > Index activity dashboard, there is an Index health report showing the bucket spread over... by hulahoop Splunk Employee in Splunk Search 03-13-2010 1 1	1	1
I've installed Splunk on windows, and I see splunk-wmi.exe and splunk-regmon.exe programs. What are these? Can I turn them off? Installed Splunk on Windows machine and in the task manager I see these two processes running by default. How can I ... by elusive Splunk Employee in Getting Data In 03-13-2010 2 2	2	2
When should I use a FIFO for an input? I notice there is support for fifo's as inputs. Are there any benefits to using a fifo or is it just support for thos... by Erik_Swan Splunk Employee in Monitoring Splunk 03-13-2010 1 2	1	2
Any way to reduce the storage footprint of a Windows LWF in 4.0? I've reduced the log retention timeout so that the disk footprint doesn't grow. Is there any way to remove anything ... by dskillman Splunk Employee in Deployment Architecture 03-13-2010 2 2	2	2
Trying to combine two regexes into one I'm trying to throw out search results from a couple of different ip ranges. Currently I'm working with 2, but I mig... by thepocketwade Path Finder in Splunk Search 03-12-2010 3 4	3	4
How can I find out what events get sent to the nullQueue when I try to filter events on a forwarder? Hi I am trying to filter events on a LightWeightForwarder, but they don't get dropped. Is there a way to debug this?... by chris Motivator in Getting Data In 03-12-2010 1 4	1	4
"The specified search is too large." Can somebody help me figure out what "too large" is? A query to count tag=pci entries by eventtype (and happens to be part of the application): tag=pci \| stats count by ... by Nate_Schmoll Engager in Knowledge Management 03-12-2010 4 5	4	5
How do I set the default PAGE, instead of just the default app? I've followed the instructions on http://www.splunk.com/base/Documentation/4.0.9/Developer/DefaultApp to set the defa... by oreoshake Communicator in Monitoring Splunk 03-10-2010 6 2	6	2
Timestamp logic/config on forwarder or indexer? I looked at the report for timestamping errors and found a fair amount of errors. I’ve been following the Splunk blo... by oreoshake Communicator in Monitoring Splunk 03-10-2010 0 5	0	5
Can Splunk decode data at index time? If I have a field value that is URL encoded then base-64 encoded, is it possible to have Splunk decode this field bef... by hulahoop Splunk Employee in Getting Data In 03-10-2010 3 7	3	7
Is it possible to include metadata in keyword searches? It is a subtlety of the search language that keyword searches run against the raw event data only. To search metadat... by hulahoop Splunk Employee in Splunk Search 03-09-2010 1 2	1	2
What is the difference between a lightforwarder and a regular forwarder? Apart from the fact that a lightforwarder does not have a web UI, what are the main differences between the 2 apps? by Mick Splunk Employee in Getting Data In 03-09-2010 0 2	0	2
How can I limit the number of results that can be returned in a search (in UI)? I'd like to limit certain users from running expensive searches by limiting the number of results that can be returne... by the_wolverine Champion in Splunk Search 03-09-2010 2 1	2	1