×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
spl_stu
Explorer
Member since: ‎01-23-2022
‎11-04-2025
Community Statistics
Posts 9
Solutions 0
Karma Given 4
Karma Received 0
Member Since ‎01-23-2022
Activity Feed
View All

How Splunk collects data after a specific time

by in Getting Data In
‎08-17-2023 02:17 AM
‎08-17-2023 02:17 AM
A file directory needs to be collected, but there is a large amount of historical data in the file directory. If I currently point to collecting data from the last three days, is there a parameter to control the collection of files after the specified time? ... View more

Re: How to view the currently running search of Sp...

by in Splunk Search
‎05-04-2023 07:37 PM
‎05-04-2023 07:37 PM
Okay, thank you for your suggestion. This issue has been resolved so far. ... View more

How to view the currently running search of Splunk...

by in Splunk Search
‎04-25-2023 11:09 PM
‎04-25-2023 11:09 PM
How to view the currently running search of Splunk and display the amount of memory consumed during the execution of this search command? Based on this information, I would like to pause some searches with high memory usage. ... View more

How to change host = hostname to host = IP in sear...

by in Splunk Enterprise
‎08-18-2022 01:46 AM
‎08-18-2022 01:46 AM
Please help answer this question, thank you： All the host values of the data I access now are the host names. I want to change all the host names to IP. How can I do this? For example, host = Splunk is changed to host = 192.168.3.1 There are many hosts to be modified, so is there any configuration to be pushed uniformly by the deployment server? ... View more

Re: Split correspondence of multi value fields

by in Splunk Enterprise
‎07-22-2022 12:17 AM
‎07-22-2022 12:17 AM
Thank you very much for your answer. My problem has been solved ... View more

Re: Split correspondence of multi value fields

by in Splunk Enterprise
‎07-21-2022 11:43 PM
‎07-21-2022 11:43 PM
OK, thank you very much for your answer. I'll test it now ... View more

Re: Split correspondence of multi value fields

by in Splunk Enterprise
‎07-21-2022 11:26 PM
‎07-21-2022 11:26 PM
These two values are the log content automatically extracted by "add on". The corresponding value of "Recipient" is a field, and the corresponding value is the recipient connected by multiple space characters. The complete value of "status" is this content ... View more

How to Split correspondence of multi value fields

by in Splunk Enterprise
‎07-21-2022 10:49 PM
‎07-21-2022 10:49 PM
Please help answer this question, thank you： For these two multivalued fields, you want the value in the "Recipient" field to correspond to the value in the "recipient_status". If the receipt is successful, it corresponds to ";", If it fails, it corresponds to "'550 5.1.1 resolver.adr.recipnotfound, not found'". Is there a way to segment the values of these two fields and make one-to-one correspondence? The following are the values corresponding to these two fields Recipient="@000.com @123.com @456.com @789.com", recipient_status=";;'550 5.1.1 RESOLVER.ADR.RecipNotFound; not found';" ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎11-04-2025 01:06 AM
Karma given to