General Splunk Splunk Searches

Splunk Search for Users Running All Time Searches Copy


				index=_audit action=search info=completed search_et="N/A" search_lt="N/A" user!=splunk-system-user | stats count by user

0 comments

[0]

Splunk Search for Size of All Lookup Files on Search Head Copy


				| rest /servicesNS/-/-/data/transforms/lookups getsize=true
| fields splunk_server filename title type size eai:appName

0 comments

[0]

Splunk Search for Size of Lookup File Copy


				| rest /servicesNS/-/-/data/transforms/lookups getsize=true
| fields splunk_server filename title type size eai:appName
| search filename="<insert lookup file name>"

0 comments

[0]

Splunk Search for Indexes With High Indexing Lag Time Copy


				| tstats count where index=* by _time, _indextime, index | rename _* as * | eval diff_secs=indextime-time, diff_hours=diff_secs/60/60 | stats max(diff_secs) as diff_secs, max(diff_hours) as diff_hours by index

1 comment

[0]

Splunk Search for Issues Sending Email Reports from Splunk Copy


				index=_internal sourcetype=splunk_python sendemail ERROR

0 comments

[0]

Splunk Search for Historical Splunk Version Installed Copy


				index=_introspection component=Hostwide | bin _time span=1d | stats values(data.splunk_version) by _time, host

0 comments

[1]

[0]

Splunk Search for Details on Ad-hoc Searches Run by Users Copy


				index=_audit action=search search=* user!=splunk-system-user provenance!=scheduler | table _time user search host total_run_time result_count | sort - _time

0 comments

[0]

Splunk Search for Apps Installed in the Environment Copy


				| rest /services/apps/local | search disabled IN ("false",0)| table title version description splunk_server

0 comments

[0]

Splunk Search for Buckets frozen by index Copy


				index=_internal sourcetype=splunkd earliest=-7d latest=now component=BucketMover | rex field=bkt "/opt/splunk/var/lib/splunk/cold/(?<frozen_index>[^/]+)" | stats count by frozen_index

0 comments

[0]

Splunk Search for Duplicate Events in Splunk Copy


				index=*  | stats count by _raw, index, sourcetype, source, host | where count>1

0 comments

[1]

[0]

Splunk searches relating to General Splunk