General Splunk Splunk Searches

Splunk Search for Users Running All Time Searches Copy


				index=_audit action=search info=completed search_et="N/A" search_lt="N/A" user!=splunk-system-user | stats count by user

0 comments

[0]

Splunk Search for Size of All Lookup Files on Search Head Copy


				| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
| fields title eai:acl.owner eai:acl.app
| where !match(title,"\.mlmodel")
| rename eai:acl.* as *
| map
    [ | inputlookup $title$ | foreach *
        [ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
    | addtotals b_* fieldname=b
    | stats sum(eval(b/1024/1024)) as mb
    | eval name="$title$", owner="$owner$", app="$app$" ] maxsearches=1000

0 comments

[0]

Splunk Search for Size of Lookup File Copy


				| inputlookup <insert lookup file name>
| foreach *
    [ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
| addtotals b_* fieldname=b
| stats sum(b) as b
| eval mb=b/1024/1024, gb=mb/1024
| fields b mb gb

0 comments

[0]

Splunk Search for Indexes With High Indexing Lag Time Copy


				| tstats count where index=* by _time, _indextime, index | rename _* as * | eval diff_secs=indextime-time, diff_hours=diff_secs/60/60 | stats max(diff_secs) as diff_secs, max(diff_hours) as diff_hours by index

1 comment

[0]

Splunk Search for Issues Sending Email Reports from Splunk Copy


				index=_internal sourcetype=splunk_python sendemail ERROR

0 comments

[0]

Splunk Search for Historical Splunk Version Installed Copy


				index=_introspection component=Hostwide | bin _time span=1d | stats values(data.splunk_version) by _time, host

0 comments

[1]

[0]

Splunk Search for Details on Ad-hoc Searches Run by Users Copy


				index=_audit action=search search=* user!=splunk-system-user provenance!=scheduler | table _time user search host total_run_time result_count | sort - _time

0 comments

[0]

Splunk Search for Apps Installed in the Environment Copy


				| rest /services/apps/local | search disabled IN ("false",0)| table title version description splunk_server

0 comments

[0]

Splunk Search for Buckets frozen by index Copy


				index=_internal sourcetype=splunkd earliest=-7d latest=now component=BucketMover | rex field=bkt "/opt/splunk/var/lib/splunk/cold/(?<frozen_index>[^/]+)" | stats count by frozen_index

0 comments

[0]

Splunk Search for Duplicate Events in Splunk Copy


				index=*  | stats count by _raw, index, sourcetype, source, host | where count>1

0 comments

[1]

[0]

Splunk searches relating to General Splunk