Using Splunk

Category Activity

How to I specify a minimum time between events? There are plenty of ways to specify the exact time range or maximum range between two events in a search. But I need ... by Tisiphone Engager in Splunk Search 02-19-2010 3 1	3	1
what does connected mean in transaction explain the significance of the connected flag in transaction by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 2 1	2	1
annotated raw field in transactions Dan Goldburt asks: I'm consistently getting the following request from customers: "can I see where each event came fr... by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 1 1	1	1
NotImplementedError: Cannot find object mapper for panel type: form When attempting to make a Simple Form Search using the Developer Manual documentation, I encounter the error: Not... by Yancy Path Finder in Dashboards & Visualizations 02-09-2010 0 1	0	1
How recent is recent? On the page 'Manager > Searches and reports,' enabled scheduled searches have a 'View Recent' link. I have 2 schedul... by hulahoop Splunk Employee in Reporting 02-05-2010 1 9	1	9
what will it take for MULTIKV to format a table (1 header row, 1+ data rows) properly? Such a helpful command, and yet doesn't work for me... by V_at_Splunk Splunk Employee in Splunk Search 02-05-2010 1 3	1	3
Why do I only see 10 results/columns in my count table? When I run this search - source="*conn.log" \| rex field=_raw "\.IP = '(?<connectionIp>[^']+)" \| fields host, connect... by Mick Splunk Employee in Splunk Search 02-05-2010 4 1	4	1
How do I report on message volume over time We are attempting to create a report that compares message traffic for the past two complete weeks. We have this as... by Mick Splunk Employee in Splunk Search 02-05-2010 0 2	0	2
Managing Eventtypes and Tags Any recommended best practices for managing eventtypes and their corresponding tags? I've found the Splunk Common In... by Yancy Path Finder in Splunk Search 02-02-2010 0 2	0	2
"Invalid Regex: no named extraction" in the interactive field extractor What is wrong with this regex? (?P<AUTH_PIN_TYPE>[^ ]+)( [^ ]+){2}$ The interactive field extractor gives this err... by dinh Path Finder in Splunk Search 02-01-2010 0 5	0	5
How do I refer to the first, nth or last value of a multivalue field? I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into... by cfrln Explorer in Splunk Search 02-01-2010 4 3	4	3
How do I group and identify a set of events based on a time range? Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so ... by hans Splunk Employee in Splunk Search 01-29-2010 1 2	1	2
How to best determine IP range membership? Use Case: Find Juniper firewall events where the source/destination IP (Src_Zone/Dst_Zone) does or does not belong in... by hulahoop Splunk Employee in Splunk Search 01-28-2010 5 5	5	5
Can the transaction command be used to group events where different fields have the same value? Use Case: Correlate logon events from a Windows desktop to events on the domain controller. Sample (shortened) event... by hulahoop Splunk Employee in Splunk Search 01-28-2010 2 9	2	9
Can I alert when the value of a field changes? I've got an application that logs status events. The values in these events generally will not change. Is there a s... by matt Splunk Employee in Splunk Search 01-27-2010 1 1	1	1
Error on using eval in a subsearch What is wrong with the way I'm using eval here? source="/some.audit.log" "End" "/foo/baz" \| rex field=_raw "(?P<ReqI... by dinh Path Finder in Splunk Search 01-27-2010 0 5	0	5
How can summary indexing help improve the performance of my dashboards and reports I have a report on my dashboard that takes a very long time to build, how can I use summary indexing to improve the p... by benstraw Splunk Employee in Dashboards & Visualizations 01-25-2010 0 3	0	3
How do I search for a single specific event? Sometimes I come across an event in my index that I'd like to refer to later, either as part of an investigation or t... by Johnvey Contributor in Splunk Search 01-25-2010 1 3	1	3
I know the data is in the index, why didn't my scheduled search find all of the events? I have a saved seach setup to check every minute for file changes. I have the start time set for [-1m] to search bac... by Mick Splunk Employee in Splunk Search 01-22-2010 2 1	2	1
suppressing adjacent events with duplicate field values I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where ... by Justin_Grant Contributor in Splunk Search 01-22-2010 0 2	0	2
Will having lots of extracted fields increase my index size? I need to understand how adding fields to raw data will increase our index size growth. We are in the process of addi... by Mick Splunk Employee in Splunk Search 01-21-2010 2 1	2	1
How do I share all of the field extractions defined in a given app with all other apps? I need to share all of the field extractions in my app with all of the other apps on the system. What is the most ef... by matt Splunk Employee in Splunk Search 01-21-2010 2 5	2	5
What is the format of the Sources.data file? $SPLUNK_HOME/var/lib/splunk/defaultdb/db/Sources.data On a fresh install I see this file has something like this: ... by matt Splunk Employee in Splunk Search 01-21-2010 1 2	1	2
RSS feed links to a file not found page I set up an alert action to create an rss feed and there is an rss link in the table view of all of my saved searches... by benstraw Splunk Employee in Reporting 01-20-2010 2 1	2	1
Feature Request: troubleshooting/debugging for field extraction config files [UPDATE: from the answer below, it sounds like what I'm looking for is not supported in the product today. I'm tackin... by Justin_Grant Contributor in Splunk Search 01-20-2010 18 2	18	2