×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
cfrln
Explorer
Member since: ‎01-14-2010
‎06-05-2020
Community Statistics
Posts 7
Solutions 0
Karma Given 0
Karma Received 24
Member Since ‎01-14-2010
Activity Feed
View All

Re: How do I refer to the first, nth or last value...

by Splunk Employee in Splunk Search
‎02-01-2010 08:29 AM
1 Karma
‎02-01-2010 08:29 AM
1 Karma
hulahoop, the field value ordering is controlled by the "mvlist" parameter of the "transaction" command: http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction ... View more

Re: transaction vs stats commands

by in Splunk Search
‎06-12-2015 02:48 PM
‎06-12-2015 02:48 PM
One other surprising and wonderful thing about the transaction command is that it recognizes transitive relationships. If some events have userID & src_IP and others have sessionID & src_IP and still others have sessionID & userID , the transaction command will be able to recognize the transitive relationships and bundle them all together with a single command; this is not the case for stats . ... View more

Re: I can't see data I know is indexed

by Splunk Employee in Getting Data In
‎01-14-2010 07:25 PM
5 Karma
‎01-14-2010 07:25 PM
5 Karma
If you're certain the data is indexed, then it is likely that your default indexes do not include the index in which is it is stored. If you do have permission to view it, you can try: index=* You can see what indexes are available to you by running the search: | eventcount summarize=false index=* index=_* ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from