Usage of Splunk EVAL Function : SPLIT

0
Usage of Splunk EVAL Function : SPLIT Usage of Splunk EVAL Function : SPLIT This function takes two arguments( X and Y ). So X will be any field name and Y...

Change the splunk index database location

0
Change the splunk index database location In this post, we are covering the procedure to change the location of splunk index database. Splunk gives you the option to move the index database from...

Splunk Btool

0
Splunk Btool Check Inputs The splunk Btool is a command line tool designed to troubleshoot and help with configuration file issues, can be used to see what values are being used by...

Real-time Vs Historical searches & Reports

0
Real-time Vs Historical searches & Reports Splunk supports real-time and historical both types of searches, and we in this post are going to throw some light upon these splunk search Time-frames.  About real-time...

Extract Fields from XML logs in Splunk

1
Extract Fields from XML logs in Splunk We all know that Splunk can handle almost any type of data format. Let’s say we are getting XML log from any of our index....

Interactive Field Extractor( IFX )in Splunk

4
Interactive Field Extractor ( IFX ) in Splunk Hello guys !! We all know that for writing any SPL query we need some fields. Depending upon field values we usually segregate data...

Splunk diag

1
Splunk diag This post covers splunk diag, a diagnostic tool, which collects the basic information about your splunk instance. To know more about this tool please continue reading this post. What is Splunk...

followTail attribute in Splunk

2
followTail attribute in Splunk This post covers some special cases/scenarios in which the attribute 'followTail' may come handy. followTail: An attribute which makes splunk ignore older contents of the file while tailing and...

Difference between STREAMSTATS and EVENTSTATS command in Splunk

2
Difference between STREAMSTATS and EVENTSTATS commands in Splunk Hi everyone  !! Here we have come with an interesting topic related to the SPL command. Sometimes you might hear about streamstats and eventstats...

Re-index your data into Splunk

3
Re-index your data into Splunk Sometimes, due to some unavoidable reasons data loss may occur while indexing or partial indexing may take place, then you might want to re-index all your data...