Splunk Search

Community Activity

What is this (search_startup_time) field in _audit index ? Hi Folks May I know what is this search_startup_time field in this event from splunk _audit index & also would like ... by PowerPacked Builder in Splunk Search 04-05-2018 1 5	1	5
How to REGEX and ROUTE incoming syslog data to the correct index? I have an HF listener receiving syslog data from multiple sources. The source(s) events are going to the same index ... by Log_wrangler Builder in Splunk Search 04-05-2018 0 2	0	2
Field Extraction and search Here is the line in the log I am working with; Message=COMPUTERNAME [Monday, April 02, 2018 7:15:53 AM (GMT-06:00)]:... by cyler New Member in Splunk Search 04-05-2018 0 7	0	7
How to get the difference between 2 queries? This is the query that reports when a user last changed their password: index=_audit "action=password change" This... by kiamco Path Finder in Splunk Search 04-05-2018 0 5	0	5
Need help in creating timechart query I have hourly data for 30 days on execution of jobs. I wanted to create a timechart based on elapsed time. could you ... by jcvytla New Member in Splunk Search 04-05-2018 0 7	0	7
Could somebody assist with this query? Hi All We're importing our WAF logs into Splunk, and I'd like to create a table to shows where traffic is originatin... by kelvinJE Engager in Splunk Search 04-05-2018 0 2	0	2
What is desc short for? For example I've seen example queries that say "sort count desc" What is this doing? by summitsplunk Communicator in Splunk Search 04-05-2018 0 2	0	2
How to find events between date ranges? This has been answered but using the methods still do not provide the right results. I have a date column. Format i... by jimbolya11 New Member in Splunk Search 04-05-2018 0 2	0	2
fillnull not working I have a query base query \| stats count by ABC \| fillnull but i am getting "no result" instead of this, i want to... by logloganathan Motivator in Splunk Search 04-05-2018 0 13	0	13
How to configure a lookup in Splunk Add-on for ServiceNow ? Hi Team, Got a request to configure a lookup called cmdb_ci_computer.csv that containing anything with subcategory ... by Hemnaath Motivator in Splunk Search 04-05-2018 0 8	0	8
Splunk Search - 'OR' operator is missing a clause on the right hand side Issue, here is my search index=my_index EventSubType="Computer Modified" NOT UserName="System" "HostIP=172.16.1."... by cyler New Member in Splunk Search 04-05-2018 0 7	0	7
appendcols to take values from my first search for each row Hi I need my appendcols to take values from my first search. Specifically two values of time produce in the first s... by robertlynch2020 Influencer in Splunk Search 04-05-2018 1 5	1	5
while indexing csv with slash and hyphen in the header that is getting modified to underscore Hi, I have a csv file which i am indexing first and then generating the output.csv file using savedsearches.conf fil... by surekhasplunk Communicator in Splunk Search 04-05-2018 0 5	0	5
Why do I get a different number of results when filtering based on variations of the same lookup field value? Hello, Splunk is acting strangely and it's something I've never encountered before. I will try to simplify my expla... by andrewtrobec Motivator in Splunk Search 04-05-2018 0 1	0	1
Is it possible before doing indexing I want to ignore some lines from a log file? I have a Log file. below mentioned lines are available in that Log file. I want to ignore all lines after the entire ... by saibal6 Path Finder in Splunk Search 04-05-2018 0 2	0	2
Distributed search groups not actually filtering searches We are using distributed search groups ( http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Distributedsear... by Lucas_K Motivator in Splunk Search 04-05-2018 0 1	0	1
Alert if Fortigate and Clearpass events match HI, i've two datasources. Clearpass and Fortigate. I want to trigger an alarm if the Fortigate log contains Virus an... by nielsg97 Engager in Splunk Search 04-05-2018 0 5	0	5
How to display multiple data points when hovering on one data point on timechart line graph? The issue I run into is if, at a given time, the # of apples, oranges and pears are all let's say 8, then it appears ... by bgeshk Engager in Splunk Search 04-05-2018 0 3	0	3
How to setup a timechart showing three different statuses? I want to set up a timechart, showing three different status. Now I found this SPL online, which was modified by myse... by ThomasLehenberg New Member in Splunk Search 04-05-2018 0 3	0	3
How can I count same field from different sourcetypes? I have two sourcetypes. In both, there is a field present that has the same value in both but just another name, let'... by Mike6960 Path Finder in Splunk Search 04-05-2018 0 6	0	6
modify a query based on condition Hi, I have created a query which gives me date, and start and end time of a job in the below format. Date ... by dileepsri9 Engager in Splunk Search 04-05-2018 0 10	0	10
How to exclude splunk cloud server logs from my search I have a new splunk instance and I am seeing log entries for the splunk cloud host logs with host names: dx* idx-i-... by kaphie2002 New Member in Splunk Search 04-05-2018 0 2	0	2
Select all values from a dropdown input At the moment I have a final dropdown input which has options for hosts already predetermined in it from previous dro... by danielsavage New Member in Splunk Search 04-04-2018 0 13	0	13
How can I get accumulative values for a day for a period of time? One of the things I'm using Splunk to monitor is electricity usage, one of the fields indexed is the accumulative Kw ... by northwarks Engager in Splunk Search 04-04-2018 0 8	0	8
How to get time to propogate through stats command? Events in my sourcetype contain a build time, and an ID field. A given ID can have multiple events, and each event co... by brajaram Communicator in Splunk Search 04-04-2018 0 5	0	5