Using Splunk

Category Activity

Trying to combine two regexes into one I'm trying to throw out search results from a couple of different ip ranges. Currently I'm working with 2, but I mig... by thepocketwade Path Finder in Splunk Search 03-12-2010 3 4	3	4
Is it possible to include metadata in keyword searches? It is a subtlety of the search language that keyword searches run against the raw event data only. To search metadat... by hulahoop Splunk Employee in Splunk Search 03-09-2010 1 2	1	2
How can I limit the number of results that can be returned in a search (in UI)? I'd like to limit certain users from running expensive searches by limiting the number of results that can be returne... by the_wolverine Champion in Splunk Search 03-09-2010 2 1	2	1
How do I change the default granularity on a chart? How do I change the default granularity on a chart? It appears I'm hitting a limit somewhere and I'm not getting as ... by dskillman Splunk Employee in Splunk Search 03-04-2010 5 2	5	2
How to open a log file with Splunk from Windows Explorer? While I browse my local drive in Explorer I would like to add and search some log files with Splunk without opening a... by Leo Splunk Employee in Splunk Search 03-03-2010 1 1	1	1
Incorporate something like this into a Splunk search builder (module)? There are some who are really good at regular expression, some okay, and the rest who downright are lost beyond a spl... by matt_1 Explorer in Splunk Search 03-03-2010 2 1	2	1
maxresults and stats command Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a sear... by kbecker Communicator in Splunk Search 02-26-2010 2 1	2	1
How do I search across a specific or custom time range within each hour of the day? I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment a... by maverick Splunk Employee in Splunk Search 02-24-2010 1 1	1	1
How to assign a value to a key when working with fields? Hi Splunkers, I have a sample Perforce log file and I'm trying to extract the code contributors. Here is an example:... by Nicholas_Key Splunk Employee in Splunk Search 02-22-2010 2 2	2	2
Add reports to dashboards I created a snazzy new report that generates a chart, how can I add this to my dashboard? by benstraw Splunk Employee in Dashboards & Visualizations 02-22-2010 1 3	1	3
How do i perform a UI search via the CLI How do i use the same search strings in splunks UI on the command line? by Chris_R_ Splunk Employee in Splunk Search 02-19-2010 0 4	0	4
How to I specify a minimum time between events? There are plenty of ways to specify the exact time range or maximum range between two events in a search. But I need ... by Tisiphone Engager in Splunk Search 02-19-2010 3 1	3	1
what does connected mean in transaction explain the significance of the connected flag in transaction by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 2 1	2	1
annotated raw field in transactions Dan Goldburt asks: I'm consistently getting the following request from customers: "can I see where each event came fr... by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 1 1	1	1
NotImplementedError: Cannot find object mapper for panel type: form When attempting to make a Simple Form Search using the Developer Manual documentation, I encounter the error: Not... by Yancy Path Finder in Dashboards & Visualizations 02-09-2010 0 1	0	1
How recent is recent? On the page 'Manager > Searches and reports,' enabled scheduled searches have a 'View Recent' link. I have 2 schedul... by hulahoop Splunk Employee in Reporting 02-05-2010 1 9	1	9
what will it take for MULTIKV to format a table (1 header row, 1+ data rows) properly? Such a helpful command, and yet doesn't work for me... by V_at_Splunk Splunk Employee in Splunk Search 02-05-2010 1 3	1	3
Why do I only see 10 results/columns in my count table? When I run this search - source="*conn.log" \| rex field=_raw "\.IP = '(?<connectionIp>[^']+)" \| fields host, connect... by Mick Splunk Employee in Splunk Search 02-05-2010 4 1	4	1
How do I report on message volume over time We are attempting to create a report that compares message traffic for the past two complete weeks. We have this as... by Mick Splunk Employee in Splunk Search 02-05-2010 0 2	0	2
Managing Eventtypes and Tags Any recommended best practices for managing eventtypes and their corresponding tags? I've found the Splunk Common In... by Yancy Path Finder in Splunk Search 02-02-2010 0 2	0	2
"Invalid Regex: no named extraction" in the interactive field extractor What is wrong with this regex? (?P<AUTH_PIN_TYPE>[^ ]+)( [^ ]+){2}$ The interactive field extractor gives this err... by dinh Path Finder in Splunk Search 02-01-2010 0 5	0	5
How do I refer to the first, nth or last value of a multivalue field? I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into... by cfrln Explorer in Splunk Search 02-01-2010 4 3	4	3
How do I group and identify a set of events based on a time range? Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so ... by hans Splunk Employee in Splunk Search 01-29-2010 1 2	1	2
How to best determine IP range membership? Use Case: Find Juniper firewall events where the source/destination IP (Src_Zone/Dst_Zone) does or does not belong in... by hulahoop Splunk Employee in Splunk Search 01-28-2010 5 5	5	5
Can the transaction command be used to group events where different fields have the same value? Use Case: Correlate logon events from a Windows desktop to events on the domain controller. Sample (shortened) event... by hulahoop Splunk Employee in Splunk Search 01-28-2010 2 9	2	9