Splunk Search

Community Activity

Why is Eventstats and Subsearch adding non-existent values to the table? My data is structured in a way that there exists multiple types of events, each with a specific id field that is uniq... by brajaram Communicator in Splunk Search 04-05-2018 0 3	0	3
Why is outputlookup not updating the csv file as intended? I have a lookup file in the form of test.csv in the test.csv there are two columns with date fields(date_first and da... by esmonder Path Finder in Splunk Search 04-05-2018 0 2	0	2
How can I remove additional field values? I've tried several different ways to resolve this issue including using 'rex' and 'replace' but I can't seem to get i... by chrisschum Path Finder in Splunk Search 04-05-2018 0 8	0	8
Why is the time picker not working with date in logs? Data is forwarded to Splunk every couple of days meaning that the _time stamp relates to the day it was sent to Splun... by davidcraven02 Communicator in Splunk Search 04-05-2018 0 6	0	6
How to find employee manager up to levels above until CEO using dbquery? I have a report that I run against Oracel db using dbquery to gather the following fields in a table EMPLOYEEID ,EMP... by LintuMathews Explorer in Splunk Search 04-05-2018 0 3	0	3
Splunk Query Exclude Question I am building a search query and trying to find the correct syntax to exclude specific combinations of source and des... by johann2017 Explorer in Splunk Search 04-05-2018 0 5	0	5
What is this (search_startup_time) field in _audit index ? Hi Folks May I know what is this search_startup_time field in this event from splunk _audit index & also would like ... by PowerPacked Builder in Splunk Search 04-05-2018 1 5	1	5
How to REGEX and ROUTE incoming syslog data to the correct index? I have an HF listener receiving syslog data from multiple sources. The source(s) events are going to the same index ... by Log_wrangler Builder in Splunk Search 04-05-2018 0 2	0	2
Field Extraction and search Here is the line in the log I am working with; Message=COMPUTERNAME [Monday, April 02, 2018 7:15:53 AM (GMT-06:00)]:... by cyler New Member in Splunk Search 04-05-2018 0 7	0	7
How to get the difference between 2 queries? This is the query that reports when a user last changed their password: index=_audit "action=password change" This... by kiamco Path Finder in Splunk Search 04-05-2018 0 5	0	5
Need help in creating timechart query I have hourly data for 30 days on execution of jobs. I wanted to create a timechart based on elapsed time. could you ... by jcvytla New Member in Splunk Search 04-05-2018 0 7	0	7
Could somebody assist with this query? Hi All We're importing our WAF logs into Splunk, and I'd like to create a table to shows where traffic is originatin... by kelvinJE Engager in Splunk Search 04-05-2018 0 2	0	2
What is desc short for? For example I've seen example queries that say "sort count desc" What is this doing? by summitsplunk Communicator in Splunk Search 04-05-2018 0 2	0	2
How to find events between date ranges? This has been answered but using the methods still do not provide the right results. I have a date column. Format i... by jimbolya11 New Member in Splunk Search 04-05-2018 0 2	0	2
fillnull not working I have a query base query \| stats count by ABC \| fillnull but i am getting "no result" instead of this, i want to... by logloganathan Motivator in Splunk Search 04-05-2018 0 13	0	13
How to configure a lookup in Splunk Add-on for ServiceNow ? Hi Team, Got a request to configure a lookup called cmdb_ci_computer.csv that containing anything with subcategory ... by Hemnaath Motivator in Splunk Search 04-05-2018 0 8	0	8
Splunk Search - 'OR' operator is missing a clause on the right hand side Issue, here is my search index=my_index EventSubType="Computer Modified" NOT UserName="System" "HostIP=172.16.1."... by cyler New Member in Splunk Search 04-05-2018 0 7	0	7
appendcols to take values from my first search for each row Hi I need my appendcols to take values from my first search. Specifically two values of time produce in the first s... by robertlynch2020 Influencer in Splunk Search 04-05-2018 1 5	1	5
while indexing csv with slash and hyphen in the header that is getting modified to underscore Hi, I have a csv file which i am indexing first and then generating the output.csv file using savedsearches.conf fil... by surekhasplunk Communicator in Splunk Search 04-05-2018 0 5	0	5
Why do I get a different number of results when filtering based on variations of the same lookup field value? Hello, Splunk is acting strangely and it's something I've never encountered before. I will try to simplify my expla... by andrewtrobec Motivator in Splunk Search 04-05-2018 0 1	0	1
Is it possible before doing indexing I want to ignore some lines from a log file? I have a Log file. below mentioned lines are available in that Log file. I want to ignore all lines after the entire ... by saibal6 Path Finder in Splunk Search 04-05-2018 0 2	0	2
Distributed search groups not actually filtering searches We are using distributed search groups ( http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/Distributedsear... by Lucas_K Motivator in Splunk Search 04-05-2018 0 1	0	1
Alert if Fortigate and Clearpass events match HI, i've two datasources. Clearpass and Fortigate. I want to trigger an alarm if the Fortigate log contains Virus an... by nielsg97 Engager in Splunk Search 04-05-2018 0 5	0	5
How to display multiple data points when hovering on one data point on timechart line graph? The issue I run into is if, at a given time, the # of apples, oranges and pears are all let's say 8, then it appears ... by bgeshk Engager in Splunk Search 04-05-2018 0 3	0	3
How to setup a timechart showing three different statuses? I want to set up a timechart, showing three different status. Now I found this SPL online, which was modified by myse... by ThomasLehenberg New Member in Splunk Search 04-05-2018 0 3	0	3