Using Splunk

Category Activity

maxresults and stats command Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a sear... by kbecker Communicator in Splunk Search 02-26-2010 2 1	2	1
How do I search across a specific or custom time range within each hour of the day? I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment a... by maverick Splunk Employee in Splunk Search 02-24-2010 1 1	1	1
How to assign a value to a key when working with fields? Hi Splunkers, I have a sample Perforce log file and I'm trying to extract the code contributors. Here is an example:... by Nicholas_Key Splunk Employee in Splunk Search 02-22-2010 2 2	2	2
Add reports to dashboards I created a snazzy new report that generates a chart, how can I add this to my dashboard? by benstraw Splunk Employee in Dashboards & Visualizations 02-22-2010 1 3	1	3
How do i perform a UI search via the CLI How do i use the same search strings in splunks UI on the command line? by Chris_R_ Splunk Employee in Splunk Search 02-19-2010 0 4	0	4
How to I specify a minimum time between events? There are plenty of ways to specify the exact time range or maximum range between two events in a search. But I need ... by Tisiphone Engager in Splunk Search 02-19-2010 3 1	3	1
what does connected mean in transaction explain the significance of the connected flag in transaction by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 2 1	2	1
annotated raw field in transactions Dan Goldburt asks: I'm consistently getting the following request from customers: "can I see where each event came fr... by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 1 1	1	1
NotImplementedError: Cannot find object mapper for panel type: form When attempting to make a Simple Form Search using the Developer Manual documentation, I encounter the error: Not... by Yancy Path Finder in Dashboards & Visualizations 02-09-2010 0 1	0	1
How recent is recent? On the page 'Manager > Searches and reports,' enabled scheduled searches have a 'View Recent' link. I have 2 schedul... by hulahoop Splunk Employee in Reporting 02-05-2010 1 9	1	9
what will it take for MULTIKV to format a table (1 header row, 1+ data rows) properly? Such a helpful command, and yet doesn't work for me... by V_at_Splunk Splunk Employee in Splunk Search 02-05-2010 1 3	1	3
Why do I only see 10 results/columns in my count table? When I run this search - source="*conn.log" \| rex field=_raw "\.IP = '(?<connectionIp>[^']+)" \| fields host, connect... by Mick Splunk Employee in Splunk Search 02-05-2010 4 1	4	1
How do I report on message volume over time We are attempting to create a report that compares message traffic for the past two complete weeks. We have this as... by Mick Splunk Employee in Splunk Search 02-05-2010 0 2	0	2
Managing Eventtypes and Tags Any recommended best practices for managing eventtypes and their corresponding tags? I've found the Splunk Common In... by Yancy Path Finder in Splunk Search 02-02-2010 0 2	0	2
"Invalid Regex: no named extraction" in the interactive field extractor What is wrong with this regex? (?P<AUTH_PIN_TYPE>[^ ]+)( [^ ]+){2}$ The interactive field extractor gives this err... by dinh Path Finder in Splunk Search 02-01-2010 0 5	0	5
How do I refer to the first, nth or last value of a multivalue field? I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into... by cfrln Explorer in Splunk Search 02-01-2010 4 3	4	3
How do I group and identify a set of events based on a time range? Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so ... by hans Splunk Employee in Splunk Search 01-29-2010 1 2	1	2
How to best determine IP range membership? Use Case: Find Juniper firewall events where the source/destination IP (Src_Zone/Dst_Zone) does or does not belong in... by hulahoop Splunk Employee in Splunk Search 01-28-2010 5 5	5	5
Can the transaction command be used to group events where different fields have the same value? Use Case: Correlate logon events from a Windows desktop to events on the domain controller. Sample (shortened) event... by hulahoop Splunk Employee in Splunk Search 01-28-2010 2 9	2	9
Can I alert when the value of a field changes? I've got an application that logs status events. The values in these events generally will not change. Is there a s... by matt Splunk Employee in Splunk Search 01-27-2010 1 1	1	1
Error on using eval in a subsearch What is wrong with the way I'm using eval here? source="/some.audit.log" "End" "/foo/baz" \| rex field=_raw "(?P<ReqI... by dinh Path Finder in Splunk Search 01-27-2010 0 5	0	5
How can summary indexing help improve the performance of my dashboards and reports I have a report on my dashboard that takes a very long time to build, how can I use summary indexing to improve the p... by benstraw Splunk Employee in Dashboards & Visualizations 01-25-2010 0 3	0	3
How do I search for a single specific event? Sometimes I come across an event in my index that I'd like to refer to later, either as part of an investigation or t... by Johnvey Contributor in Splunk Search 01-25-2010 1 3	1	3
I know the data is in the index, why didn't my scheduled search find all of the events? I have a saved seach setup to check every minute for file changes. I have the start time set for [-1m] to search bac... by Mick Splunk Employee in Splunk Search 01-22-2010 2 1	2	1
suppressing adjacent events with duplicate field values I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where ... by Justin_Grant Contributor in Splunk Search 01-22-2010 0 2	0	2