Top

Category Activity

How do I change the default granularity on a chart? How do I change the default granularity on a chart? It appears I'm hitting a limit somewhere and I'm not getting as ... by dskillman Splunk Employee in Splunk Search 03-04-2010 5 2	5	2
How to open a log file with Splunk from Windows Explorer? While I browse my local drive in Explorer I would like to add and search some log files with Splunk without opening a... by Leo Splunk Employee in Splunk Search 03-03-2010 1 1	1	1
Incorporate something like this into a Splunk search builder (module)? There are some who are really good at regular expression, some okay, and the rest who downright are lost beyond a spl... by matt_1 Explorer in Splunk Search 03-03-2010 2 1	2	1
ERROR SavedSplunker - No record for that user Seeing this error in splunkd.log on a splunk indexer when running a saved search. What does it mean? by Jaci Splunk Employee in Monitoring Splunk 03-01-2010 2 1	2	1
AD is only returning 1000 entries. How do I get around this? I'm trying to configure LDAP auth for Splunk. I'm running into an issue where AD is only giving me 1000 entries and ... by the_wolverine Champion in Security 02-27-2010 2 2	2	2
maxresults and stats command Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a sear... by kbecker Communicator in Splunk Search 02-26-2010 2 1	2	1
How do I search across a specific or custom time range within each hour of the day? I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment a... by maverick Splunk Employee in Splunk Search 02-24-2010 1 1	1	1
Estimating storage requirements on a windows server In the installation manual it shows how once you have indexed some data by using the "du -shc hot_v*/rawdata" command... by Scott Engager in Installation 02-23-2010 1 1	1	1
Can I replicate a subset of the data to a non-Splunk destination? I need to do the following on my forwarder: Forward all data received and gathered by the forwarder to Splunk indexe... by Alan_Bradley Path Finder in Getting Data In 02-23-2010 1 1	1	1
retrying a scripted input after a failure [I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too] I have a... by Justin_Grant Contributor in Getting Data In 02-22-2010 1 2	1	2
How to assign a value to a key when working with fields? Hi Splunkers, I have a sample Perforce log file and I'm trying to extract the code contributors. Here is an example:... by Nicholas_Key Splunk Employee in Splunk Search 02-22-2010 2 2	2	2
Add reports to dashboards I created a snazzy new report that generates a chart, how can I add this to my dashboard? by benstraw Splunk Employee in Dashboards & Visualizations 02-22-2010 1 3	1	3
How do i perform a UI search via the CLI How do i use the same search strings in splunks UI on the command line? by Chris_R_ Splunk Employee in Splunk Search 02-19-2010 0 4	0	4
How to I specify a minimum time between events? There are plenty of ways to specify the exact time range or maximum range between two events in a search. But I need ... by Tisiphone Engager in Splunk Search 02-19-2010 3 1	3	1
what does connected mean in transaction explain the significance of the connected flag in transaction by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 2 1	2	1
annotated raw field in transactions Dan Goldburt asks: I'm consistently getting the following request from customers: "can I see where each event came fr... by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 1 1	1	1
Is it possible to tell LINE_BREAKER to stop eating my angle bracket? The use of LINE_BREAKER is a bit cryptic to me... ok, a lot. But I think I've managed to figure out how to break my ... by hulahoop Splunk Employee in Getting Data In 02-10-2010 0 6	0	6
How to direct certain sourcetypes into a non-default index When I've created a new index. how can I direct certain sourcetypes to be indexed in that new index, rather than into... by Alan_Bradley Path Finder in Security 02-10-2010 0 1	0	1
NotImplementedError: Cannot find object mapper for panel type: form When attempting to make a Simple Form Search using the Developer Manual documentation, I encounter the error: Not... by Yancy Path Finder in Dashboards & Visualizations 02-09-2010 0 1	0	1
How do I group lines into a single event at index-time? What I'm trying to do: at index time, create a multiline event based on a unique ID. In the data sample below, I nee... by hulahoop Splunk Employee in Getting Data In 02-08-2010 2 6	2	6
How recent is recent? On the page 'Manager > Searches and reports,' enabled scheduled searches have a 'View Recent' link. I have 2 schedul... by hulahoop Splunk Employee in Reporting 02-05-2010 1 9	1	9
what will it take for MULTIKV to format a table (1 header row, 1+ data rows) properly? Such a helpful command, and yet doesn't work for me... by V_at_Splunk Splunk Employee in Splunk Search 02-05-2010 1 3	1	3
Why do I only see 10 results/columns in my count table? When I run this search - source="*conn.log" \| rex field=_raw "\.IP = '(?<connectionIp>[^']+)" \| fields host, connect... by Mick Splunk Employee in Splunk Search 02-05-2010 4 1	4	1
How do I report on message volume over time We are attempting to create a report that compares message traffic for the past two complete weeks. We have this as... by Mick Splunk Employee in Splunk Search 02-05-2010 0 2	0	2
Managing Eventtypes and Tags Any recommended best practices for managing eventtypes and their corresponding tags? I've found the Splunk Common In... by Yancy Path Finder in Splunk Search 02-02-2010 0 2	0	2