https://community.splunk.com/t5/Monitoring-Splunk/Commands-helps-for-search/m-p/665664#M9851 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/261266">@DANITO115</a>,</P><P>did you followed the Splunk Search Tutorial (<A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial)?" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial)?</A></P><P>Anyway, this depends on the data type you want to search and if you already extracted the status field.</P><P>If you already extracted, you could simply use:</P><LI-CODE lang="markup">index=your_index status=403</LI-CODE><P>if not, you have to extract it using a regex, but to help you in this a sample of your logs is required.</P><P>Otherwise, you can simply search the string 403</P><LI-CODE lang="markup">index=your_index 403</LI-CODE><P>but you could have some false positive:</P><P>Ciao.</P><P>Giuseppe</P> Fri, 20 Oct 2023 09:53:19 GMT gcusello 2023-10-20T09:53:19Z https://community.splunk.com/t5/Monitoring-Splunk/Commands-helps-for-search/m-p/665663#M9850 <P>Good morning, I need to know what the exact search command is in order to see this parameter: Enter a search that returns all web application events that<BR />contain a prohibited status (403)</P> Fri, 20 Oct 2023 09:32:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/Commands-helps-for-search/m-p/665663#M9850 DANITO115 2023-10-20T09:32:50Z https://community.splunk.com/t5/Monitoring-Splunk/Commands-helps-for-search/m-p/665664#M9851 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/261266">@DANITO115</a>,</P><P>did you followed the Splunk Search Tutorial (<A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial)?" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial)?</A></P><P>Anyway, this depends on the data type you want to search and if you already extracted the status field.</P><P>If you already extracted, you could simply use:</P><LI-CODE lang="markup">index=your_index status=403</LI-CODE><P>if not, you have to extract it using a regex, but to help you in this a sample of your logs is required.</P><P>Otherwise, you can simply search the string 403</P><LI-CODE lang="markup">index=your_index 403</LI-CODE><P>but you could have some false positive:</P><P>Ciao.</P><P>Giuseppe</P> Fri, 20 Oct 2023 09:53:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/Commands-helps-for-search/m-p/665664#M9851 gcusello 2023-10-20T09:53:19Z https://community.splunk.com/t5/Monitoring-Splunk/Commands-helps-for-search/m-p/665969#M9854 <P>ty This command help me a lot</P> Tue, 24 Oct 2023 06:41:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/Commands-helps-for-search/m-p/665969#M9854 DANITO115 2023-10-24T06:41:43Z