About pkisplunk

pkisplunk · ‎10-04-2020

You can use the `IN` operator like: error_code IN (4*, 500, 502, 503) You can have both concrete values and wildcards. See https://www.splunk.com/en_us/blog/tips-and-tricks/smooth-operator-searching-for-multiple-field-values.html

pkisplunk · ‎10-10-2018

We used Fluentd with Splunk cloud and it worked seamlessly. If anyone using Splunk Cloud sees this answer - the methods above are applicable both to the Enterprise version as well as the Cloud.

pkisplunk · ‎10-08-2018

The idea is to have a display of a rolling log / tail -f . This could be very useful to me in tracking the live output of some machines performing batch / background operations.

Posts	3
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎10-08-2018

Online Status	Offline
Date Last Visited	‎10-05-2020 02:51 AM

Can Splunk refresh search results automatically?

Re: Search a field for multiple values

Re: How to index Kubernetes STDOUT data in Splunk?

Can Splunk refresh search results automatically?