Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Sourcetypes that are Being Truncated Copy


				index=_internal sourcetype=splunkd "truncating line" 
| rex field=_raw "line length\s+>=\s+(?<length>\d+)" 
| search length=* 
| stats max(length) as length, count by data_sourcetype

0 comments

[0]

Splunk Search for Duplicate Events in Splunk Copy


				index=*  | stats count by _raw, index, sourcetype, source, host | where count>1

0 comments

[1]

[0]

Splunk Search for Duplicate Events by Index, Sourcetype Copy


				index=* | stats count by _raw, index, sourcetype | where count>1 | stats values(sourcetype) as sourcetype by index

0 comments

[1]

[0]