Stack Overflow
Stack Overflow

Questions tagged [splunk]

Splunk is a tool for collecting, monitoring, visualizing and analyzing machine data from any source. You may receive faster responses at answers.splunk.com which is actively monitored by Splunk employees

Splunk

You may receive faster responses at community.splunk.com which is actively monitored by Splunk employees

Splunk is a tool for collecting, monitoring, and analyzing log files from servers, applications, or other sources. The primary features of Splunk include:

  • Collecting logs from multiple sources into a single location to allow for use without needing to access individual servers.
  • Parsing of logs with arbitrary formats, including free-form logs with no defined fields
  • Advanced querying of logs, including
    • combining results from different sources
    • filtering based on identified field values and pattern matching
    • analyzing records using statistical and mapping functions
  • visualizing real-time data
  • the ability to create dashboards of various visualizations

The name "Splunk" comes from a rewriting of spelunking, a cave exploring hobby.

Splunk is available as both an enterprise application that runs on your servers (with a free tier) and a hosted service known as Splunk Cloud.

Useful links

2246 questions
4
votes
1 answer

How to initialize Splunk HTTP Event Collector via Docker Compose and use it with splunk logging driver

I'm trying to set up a local development environment with Docker Compose that bootstraps a Splunk Enterprise server and uses the splunk logging driver on an app server. Versions: Docker Engine: 18.06.1-ce Compose: 1.22.0 Compose File: 3.7 Splunk…
Shaun Scovil
  • 3,905
  • 5
  • 39
  • 58
4
votes
2 answers

Splunk count 2 different fields with two different group by without displaying them

I select orderids for a model in a subsearch and than select the most common materials for each orderid, so I get a list of every Material and the time it was a part of an order. I want to display the most common materials in percentage of all…
Nils
  • 41
  • 2
  • 6
4
votes
2 answers

Splunk: Trying to split multiline event at search time

2018-06-20T00:04:35.000+00:00 (980) WAL Autocheckpointing, name=C:\Program Files\PriceService\data\documents.db 2018-06-20T00:07:16.000+00:00 (980) WAL Autocheckpointing, name=C:\Program…
L-Samuels
  • 2,712
  • 9
  • 34
  • 42
4
votes
1 answer

How to parse JSON metrics array in Splunk

I receive JSON from API in the following format: [ { "scId": "000DD2", "sensorId": 2, "metrics": [ { "s": 5414, "dateTime": "2018-02-02T13:03:30+01:00" }, { "s": 5526, …
Max Zhylochkin
  • 79
  • 1
  • 5
4
votes
1 answer

How To Calculate Exact 99.9th Percentile in Splunk

Does anyone know how to exactly calculate the 99.9th percentile in Splunk? I have tried a variety of methods as below, such as exactperc (but this only takes integer percentiles) and perc (but this approximates the result heavily). base | stats…
user1763328
  • 301
  • 2
  • 3
  • 11
4
votes
0 answers

Splunkbase modular inputs customized UI

I've seen number of resources that described how to create customized UI for modular inputs but this customization is limited to configuration of Manager XML file (http://docs.splunk.com/Documentation/Splunk/6.6.1/AdvancedDev/ModInputsCustomizeUI).…
user1459144
  • 4,439
  • 5
  • 28
  • 35
4
votes
1 answer

Getting CORS Errors with Splunk

I am trying to write data to Splunk with a jQuery script running in a browser. I already have the following in my 'inputs.conf' file: crossOriginSharingPolicy = * However, the error I'm getting is: Cross-Origin Request Blocked: The Same Origin…
Westy
  • 707
  • 2
  • 10
  • 23
4
votes
1 answer

Splunk throwing HTTP 401 not authorized error when called from Java SDK in NiFi

I have multiple GetSplunk processors running using a Cron driven scheduling strategy. The Cron expression looks like '0 30 13 * * ?'. They all successfully execute the query the first time it's run. But, the next day it errors out with a 401 error…
MoDrags
  • 141
  • 2
  • 13
4
votes
4 answers

How to log exception stack trace in Json object with out breaking with log4j2

Environment I have implemented log4j in my application successfully. I have used following pattern loayout: {"a":"%X{Id}","b":"%d","message":"%m","priority":"%p","Exception":"%ex"} It is logging as json format with my custom attributes. But while…
Balaji
  • 151
  • 4
  • 15
4
votes
2 answers

Multiple Rex Expressions

I'm using the rex expressions below to search for the following fields in my raw data: Address Line 1 Address Line 2 Address Line 3 Address Line 4, and Postcode | rex "Address Line 1=(?[^,]*)" | rex "Address Line 2=(?[^,]*)" …
IRHM
  • 1,326
  • 11
  • 77
  • 130
4
votes
1 answer

Negative regex in splunk (not using fields)

Without extracting fields, I want to search for any events that do not contain "country=$", i.e. the event must not end with "country=". I can regex it to "country=(?!$)", but that still requires country to be present in the event, which is not what…
melladh
  • 133
  • 2
  • 9
4
votes
3 answers

Splunk Query Count of Count

I want to know the count of a count of a query. The query is sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count by X_REQUEST_ID | sort - count So you can see there are multiple rows with the value of 3. Thanks…
Miverson
  • 143
  • 1
  • 2
  • 11
4
votes
5 answers

Tool for parsing SMTP logs that finds bounces

Our web application sends e-mails. We have lots of users, and we get lots of bounces. For example, user changes company and his company e-mail is no longer valid. To find bounces, I parse SMTP log file with log parser. The logs come from Microsoft…
Željko Filipin
  • 56,372
  • 28
  • 94
  • 125
4
votes
1 answer

Why would CSS data-URIs be logged as 404 requests?

To reduce the number of requests across our site we are using CSS data-URIs rather than linking to external images. For some reason, these data-URIs are occasionally still being logged as a 404 request against our servers. Why would this be…
Buck
  • 2,054
  • 2
  • 16
  • 19
4
votes
4 answers

Filtering splunk results using results of another splunk query

I want to use a query in splunk, extract a list of fields and then use these result fields to further filter my subsequent splunk query. How do I do this?
seahorse
  • 2,420
  • 4
  • 31
  • 40
1 2 3
…
99 100