Using Splunk

Category Activity

What is the procedure to build your own Splunk (search related) function? I have heard that this is possible - please correct me if I am wrong. Firstly, the reason I want to do this. We inde... by Glenn Builder in Splunk Search 04-01-2010 0 4	0	4
How do I account for many concurrent users when designing my hardware requirements I'm curious how to plan a deployment where i have many concurrent searches. I understand how to account for indexing... by Erik_Swan Splunk Employee in Splunk Search 03-29-2010 1 1	1	1
Can I make my dashboards load faster by scheduling the searches? I understand summary indexing can drastically improve the load time of my dashboards. In addition, if I schedule eac... by hulahoop Splunk Employee in Splunk Search 03-26-2010 7 5	7	5
Do search-time fields have performance considerations? Are search-time fields slow? Can I rely on them to efficiently sort through my data? Are there significant differenc... by jrodman Splunk Employee in Splunk Search 03-24-2010 5 4	5	4
Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items. Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown ... by zliu Splunk Employee in Reporting 03-23-2010 1 1	1	1
How to find top 5 input data volumes of the day? I got Your index exceeded your 20.00 GB/day limit again. I would like to know which data inputs cause this. by Alan_Bradley Path Finder in Splunk Search 03-21-2010 0 2	0	2
How to subtract two specific requestTime For every Retention key (already extracted by Splunk: 20181947800000) I want to subtract the requestTime="2009-05-26T... by Alan_Bradley Path Finder in Splunk Search 03-19-2010 0 1	0	1
How do we turn off alert email from source type=ps We get an alert from sourcetype=ps as a result of running this save search: (authentication failure) OR (Account * to... by Alan_Bradley Path Finder in Alerting 03-19-2010 0 1	0	1
Search for disappeared and new hosts Hi I would like to have a way to find out whether hosts have stopped logging to our central log infrastructure or i... by chris Motivator in Splunk Search 03-19-2010 0 3	0	3
How can I create a stacked line graph with multiple values from the same log line? I am having trouble getting my head around the search required to graph multiple values from the same log event. It s... by Glenn Builder in Splunk Search 03-18-2010 2 5	2	5
Creating a parameterized transaction search Our office has a specific TRANSACTION search we do frequently to track all events related to a particular user. The s... by Justin_Grant Contributor in Splunk Search 03-16-2010 0 5	0	5
How to use 2 timeranges in a single search? I'd like to provide a table where the event count for today and yesterday are displayed. For example, count by statu... by hulahoop Splunk Employee in Splunk Search 03-16-2010 0 2	0	2
Does SEDCMD use PCRE regular expressions? I know that in general, regular expressions in Splunk use PCRE (or a modified PCRE for matching in props.conf source ... by gkanapathy Splunk Employee in Splunk Search 03-15-2010 3 1	3	1
How to optimize performance for scripted lookups? I would like to use a lookup into an external database to add fields to my events, but need some advice about perform... by Justin_Grant Contributor in Splunk Search 03-15-2010 2 3	2	3
What are the defaults for the dbinspect command? On the Search App > Status > Index activity dashboard, there is an Index health report showing the bucket spread over... by hulahoop Splunk Employee in Splunk Search 03-13-2010 1 1	1	1
Trying to combine two regexes into one I'm trying to throw out search results from a couple of different ip ranges. Currently I'm working with 2, but I mig... by thepocketwade Path Finder in Splunk Search 03-12-2010 3 4	3	4
Is it possible to include metadata in keyword searches? It is a subtlety of the search language that keyword searches run against the raw event data only. To search metadat... by hulahoop Splunk Employee in Splunk Search 03-09-2010 1 2	1	2
How can I limit the number of results that can be returned in a search (in UI)? I'd like to limit certain users from running expensive searches by limiting the number of results that can be returne... by the_wolverine Champion in Splunk Search 03-09-2010 2 1	2	1
How do I change the default granularity on a chart? How do I change the default granularity on a chart? It appears I'm hitting a limit somewhere and I'm not getting as ... by dskillman Splunk Employee in Splunk Search 03-04-2010 5 2	5	2
How to open a log file with Splunk from Windows Explorer? While I browse my local drive in Explorer I would like to add and search some log files with Splunk without opening a... by Leo Splunk Employee in Splunk Search 03-03-2010 1 1	1	1
Incorporate something like this into a Splunk search builder (module)? There are some who are really good at regular expression, some okay, and the rest who downright are lost beyond a spl... by matt_1 Explorer in Splunk Search 03-03-2010 2 1	2	1
maxresults and stats command Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a sear... by kbecker Communicator in Splunk Search 02-26-2010 2 1	2	1
How do I search across a specific or custom time range within each hour of the day? I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment a... by maverick Splunk Employee in Splunk Search 02-24-2010 1 1	1	1
How to assign a value to a key when working with fields? Hi Splunkers, I have a sample Perforce log file and I'm trying to extract the code contributors. Here is an example:... by Nicholas_Key Splunk Employee in Splunk Search 02-22-2010 2 2	2	2
Add reports to dashboards I created a snazzy new report that generates a chart, how can I add this to my dashboard? by benstraw Splunk Employee in Dashboards & Visualizations 02-22-2010 1 3	1	3