Splunk Search

Community Activity

SPL map command Good morning all,I run this search\| makeresults count=4 \| eval a="splunk_server" \| map search="search index=esak-qa s... by torustad Path Finder in Splunk Search 5 hours ago 0 21	0	21
Index time field extraction for XML data? We have a use case where index time extractions for XML data makes a lot of sense yet I do not see an easy way go mak... by ebaileytu Communicator in Splunk Search Thursday 0 6	0	6
conditional execution of search Hello, I have a parts of the search, which I would like to execute conditionally. In the below example I am trying t... by damucka Builder in Splunk Search Tuesday 0 18	0	18
Hourly Test Hello all, I am very new to Splunk so apologies if this is an easy one. We want to set up an alert to come out of Spl... by Matt_Splunk Loves-to-Learn in Splunk Search a week ago 0 5	0	5
Use an intermediate universal forwarder Hi at all, I need to send logs from many Universal Forwarders to an Indexer Cluster using an Intermediate Forwarder. ... by gcusello SplunkTrust in Splunk Search 2 weeks ago 0 5	0	5
using eval to define actions Morning All I need some help with an spl i am using to define actions requried this is my curretn spl which is worki... by PaulaCom Path Finder in Splunk Search 2 weeks ago 0 5	0	5
How to work out the age of a user based on date of birth? I want to group users by their age which range from roughly 5 years to 90. The dateofbirth field is formatted like th... by Amohlmann Communicator in Splunk Search 2 weeks ago 0 13	0	13
How do I get the cumulative percentage in Splunk Hello I am trying to get a cumulative percentage and have been unsuccessful with it. The data is below. so the equa... by theouhuios Motivator in Splunk Search 3 weeks ago 0 8	0	8
Different output search and where Hello,I have a field that is specified in the interesting fields as numeric (a). However, this field has numeric and ... by Rob1971 Loves-to-Learn in Splunk Search a month ago 0 6	0	6
The Search shows different results from what the dashboard is showing. They should be the same Can someone help me optimize this search so the results on the search and dashboard panel should be the same. The sea... by USA69 Path Finder in Splunk Search 09-07-2026 0 7	0	7
SPL Find difference from previous day from a DB Source We currently have a DB Connection and a Query which brings in Project Details with the username Entitlements. The Que... by LizAndy123 Path Finder in Splunk Search 09-02-2026 0 7	0	7
Has anyone created a Splunk search using IBM z/OS SMF type 70 records and calculated the CPU percentage? We are trying to replicate some data that was in an RMF report and imported into Excel for a graph. We are trying to... by bdh5574 New Member in Splunk Search 08-28-2026 0 4	0	4
data not coming in one of the sourcetype How will i check the data stop coming from a particular sourcetype previously the data was coming. source - /abc/r... by Praz_123 Communicator in Splunk Search 08-16-2026 0 9	0	9
issue in correlation search \| tstats summariesonly count dc(IDS_Attacks.dest) as dest from datamodel=Intrusion_Detection.IDS_Attacks where * by I... by kjain041523 Observer in Splunk Search 08-13-2026 0 3	0	3
How to combine two sourcetypes into a single table using multisearch without a common key? I am trying to build a single dashboard table in Splunk that shows data from two different sourcetypes. These sourcet... by priyankavj New Member in Splunk Search 08-11-2026 0 7	0	7
federated search from on-prem to cloud i need help in setting up federated search , the requirement is that i want to run some splunk search from dbconnect ... by imsidrai Path Finder in Splunk Search 08-07-2026 0 7	0	7
DBXlookup function in report causing random fields to be blank? We have a simple report which collates several lookups into a single lookup each night to support our dashboards. We ... by BradOH Path Finder in Splunk Search 07-31-2026 1 11	1	11
Is there a function to check if field is an ip address or hostname? I have a field to evaluate if the value of the field is an IP address or a hostname. if it is an IP address do someth... by brdr Contributor in Splunk Search 07-28-2026 0 5	0	5
Windows Event Log collection stops on Universal Forwarder while splunk-winevtlog.exe keeps running Hello everyone,We are investigating an intermittent Windows Event Log ingestion issue on multiple Windows Domain Cont... by frknklnc Observer in Splunk Search 07-23-2026 0 9	0	9
Refresh all panels of one Dashboard without Browser-Refresh Hi Guys,is there any way to create a butten within Dashboard-Studio dashboard, to refresh all panels at the same time... by verd4nd1 Engager in Splunk Search 07-21-2026 1 8	1	8
How to update geoip database for iplocation command? Hello, I use Splunk's iplocation (not Maxmind or other) command extensively in our monitoring dashboards. Since thi... by echojacques Builder in Splunk Search 07-17-2026 8 21	8	21
Splunk botsv3 dataset doesn't show mentioned sourcetypes Hi everyone!I recently installed splunk and ingested botsv3 dataset through mentioned /etc/apps and gui too. The bots... by zeshan66 New Member in Splunk Search 07-02-2026 0 2	0	2
SHC Concurrency Search control Hi,I hope all is well.I am writting to ensure i am getting the correct picture on the SHC search:Assumption: 3x searc... by 0xAli Path Finder in Splunk Search 06-30-2026 0 13	0	13
Prevent users from creating private searches, alerts reports etc I wanted to check if there is a setting in splunk enterprise where i can disable users from creating alerts in privat... by SharonNJD Engager in Splunk Search 06-28-2026 0 2	0	2
How do I compare event counts for this week vs. last week in a single search? I want a single search that shows my daily event count for the current week alongside the same days from the previous... by pcaser Engager in Splunk Search 06-20-2026 0 1	0	1