Using Splunk

Category Activity

Using host tags (or similar) when searching on fields? I have a number of hosts that have a certain tag on them (let's say "sensitive"). I want to look for account lockout ... by Ayn Legend in Splunk Search 04-13-2010 1 2	1	2
Subsearch like correlated subquery in SQL Is it possible with subsearch to pass a list of search results to the outside search? similar to a SQL correlated sub... by Yancy Path Finder in Splunk Search 04-13-2010 3 3	3	3
What is the best way to handle sequential event funnels? Given a sequence of general to specific events (like product browsing a pages, followed by particular product pages)... by andynu Engager in Splunk Search 04-13-2010 2 2	2	2
How can find out what search query was executed for a particular search job id? I'm trying to map search performance to specific searches. I have to discover if its possible to marry up a job ID t... by Michael_Wilde Splunk Employee in Splunk Search 04-13-2010 2 8	2	8
The asterisk character is not matching all characters when doing a search, is this a bug? The asterisk character is not matching all characters. A search for : rectype="bl*query" returns 0 matching event... by rsimmons Splunk Employee in Splunk Search 04-13-2010 10 5	10	5
When displaying events in a table, can I change the timeformat used to render the times? In a dashboard we're working with we are displaying a table of events and the times always have 000 as the millisecon... by sideview SplunkTrust in Splunk Search 04-13-2010 1 1	1	1
What happened to Livetail? Livetail was around in version 3.x and went away in 4.0. When is it coming back? by the_wolverine Champion in Splunk Search 04-13-2010 2 1	2	1
The splunk-system-user is hitting a quota limit. How do I increase the quota for this user? I'm running summary searches and the splunk-system-user keeps hitting a quota limit. 04-12-2010 16:50:28.436 ERR... by the_wolverine Champion in Splunk Search 04-13-2010 3 1	3	1
Migrating Saved Search from 3.x to 4.x Hi folks Is there a way to manually migrate saved searches from splunk 3.x to 4.x? The problem is that I didn't upgr... by Simon Contributor in Reporting 04-13-2010 1 2	1	2
Comparing events from 2 dates to detect new ones Hi All... i'll first describe my scenario.. i have logs that contains entries regarding open ports like: 1-1-2000 ... by aagmon New Member in Splunk Search 04-12-2010 0 2	0	2
How can I stop a user from seeing other apps? I want to lock down a user to seeing only one app. I figured out how to set their default dashboard, but i want this... by bfaber Communicator in Dashboards & Visualizations 04-10-2010 2 1	2	1
Does LiveSearch work with a distributed environment? Can I do a live search over multiple Splunk indexers? by bfaber Communicator in Splunk Search 04-10-2010 1 2	1	2
in a dashboard customer would like to show the chart with no results If there are no results found when a dashboard is rendered instead of having a "NO RESULTS FOUND" message in the dash... by davesplunkmonky Splunk Employee in Dashboards & Visualizations 04-09-2010 2 1	2	1
emit 3-column table from search (like CHART without aggregation) My search returns 10 fields in each event and I want to create a table with one row per event and columns for 3 of th... by Justin_Grant Contributor in Splunk Search 04-09-2010 0 6	0	6
outputcsv: can I tell it where to create the CSV instead of /var/run/splunk? I would like to stay away from having to point to or move the file in a script. by davesplunkmonky Splunk Employee in Reporting 04-09-2010 2 1	2	1
Scheduled PDF Report Generation Error -- urlopen error [Errno 111] Connection refused Hi! I posted this in the Splunk Forums the other day but I stumbled on Answers this morning and it seems like it m... by jpdubose Explorer in Reporting 04-08-2010 1 5	1	5
Changing SERVER HEALTH ALERT emails Hi, We get many alerts sent to us about cpu health under the email heading SERVER HEALTH ALERT - followed by tags. ... by Hazel Communicator in Alerting 04-08-2010 0 4	0	4
What are the known/possible ways of drilling down into a result set without re-querying the entire index? Wanted to see what is/are the possible methods to do so. One way I could think of is to export the results using out... by rayfoo Path Finder in Splunk Search 04-08-2010 1 7	1	7
Finding the busiest hour of the day with timespan and ignore hours with zero events I use the following query against a Cisco as5400 to find the number of calls per hour during a day. 10.200.90.19 Cal... by MHS Explorer in Splunk Search 04-08-2010 0 4	0	4
after upgrade to 4.1 unable to get fields from search using python After upgrading to 4.1 from 4.0.10 I am unable to get fields using a search from python script. The simplified versio... by imrago Contributor in Splunk Search 04-08-2010 0 2	0	2
Scripted auth and search filters in 4.1 I am trying to get scripted auth working on the new 4.1. I had a configuration on 3.4.x that worked great but after m... by zscgeek Path Finder in Splunk Search 04-07-2010 0 2	0	2
how to find all windows systems reporting a partcular event ID, Source, and/or Severity What are the searches required to search across Windows Event Logs for: most recent events of a particular event ID ... by Justin_Grant Contributor in Splunk Search 04-07-2010 2 1	2	1
In a Distributed Search environment, how do I restrict my search to a particular peer or peers? Splunk does such an awesome job with distributed search. It seems like all my data is on one server (my search head)... by the_wolverine Champion in Splunk Search 04-07-2010 1 2	1	2
How can you get rid of the GUI notifications When I run a search on my custom dashboard, I get a notification bar on top stating the status of the dashboard queri... by BunnyHop Contributor in Dashboards & Visualizations 04-06-2010 2 6	2	6
What is the minimum free space value for a search? After upgrading to Splunk 4.1 from 4.0.10 today, we find that we can no longer run searches. splunkd.log shows: 04-... by Alan_Bradley Path Finder in Splunk Search 04-05-2010 4 1	4	1