Splunk Search

Community Activity

Creating new fields using already set data I am working with data from an application but the data has been forwarded to Splunk as raw data and appear randomly ... by leagawa New Member in Splunk Search 03-17-2018 0 1	0	1
How to create a real-time map of attacks I want to create a real-time map similar to https://cybermap.kaspersky.com/ that tracks and displays the exact locati... by Shabalala9 New Member in Splunk Search 03-16-2018 0 1	0	1
Can any one help to understand & use of below command in eval Can any one help to understand & use of below command in eval index=_internal \| eval Mahesh=max(1, 3, 6, 7, "foo", fi... by maheshsat Explorer in Splunk Search 03-16-2018 0 1	0	1
Trying to change date index=_internal \| eval Mahesh=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/") My date 03-16-2018 I need 16-03-2018 by maheshsat Explorer in Splunk Search 03-16-2018 0 2	0	2
CPU Usage by Process Is there a way to pull a list of running processes and the CPU % usage per process via Splunk natively? Using Powers... by Kendo213 Communicator in Splunk Search 03-16-2018 0 2	0	2
Calculate difference between 2 time fields using strptime As an example, I am getting weather data where in each json even I have the sunrise and sunset time for that day. The... by MedralaG Communicator in Splunk Search 03-16-2018 0 10	0	10
How to create a real-time map of attacks by Source IP? I would like to create a live map similar to the one at Norse: http://map.norsecorp.com. Below is the search that I ... by kmedina1 Explorer in Splunk Search 03-16-2018 0 4	0	4
Find percentage between two fields whose name will fall into a naming convention I have a set of fixed fields that define a maximum threshold with the naming convention of "resources_available_[[con... by mjones414 Contributor in Splunk Search 03-16-2018 0 1	0	1
How to use rex to get matching number? I tried to use \| rex "^Version\s(?P(\\d{2}))$ to extract version number - it should only be 2 digit number. But 12.1.... by xinde Path Finder in Splunk Search 03-16-2018 0 8	0	8
How to add link per rows? I first encountered the plank system. Need any help. Have a table with multiple rows. Is it possible to assign a lin... by kiselevm New Member in Splunk Search 03-16-2018 0 2	0	2
data comparison Hi all Someone can help me? We have a stream of messages that are sent from one side and received on the other. Is i... by kiselevm New Member in Splunk Search 03-16-2018 0 1	0	1
Why is the stats count showing higher count for date_ then other fields? I have a report that provides a summary of key activity by IP. I wanted to cross check that information against the ... by Gawker Path Finder in Splunk Search 03-16-2018 0 2	0	2
problem with join i am trying to join 2 indexes and ClientName. i find some rows are not joining on ClientName. but if i explicitly me... by jiaqya Builder in Splunk Search 03-16-2018 0 6	0	6
Regex Help Hi, I need a regex to extract at search time the values after ACTION[*] and up to the next character, regardless of ... by jacqu3sy Path Finder in Splunk Search 03-16-2018 0 4	0	4
How do I combine two unrelated inputlookups in the same search? Say I have one lookup which has various fields like host, source and other stuff. And another lookup which has fields... by timmag Explorer in Splunk Search 03-16-2018 0 5	0	5
Need to benchmark IOPS reliably Hi, Can someone recommend a linux utility to reliably benchmark IOPS on local, NFS and iSCSI volumes? I need someth... by ivog Engager in Splunk Search 03-15-2018 1 2	1	2
How to use transaction command with message and as argument? How to use message name as argument for transaction command? I have logs relate to a particular message ID for one so... by abhi04 Communicator in Splunk Search 03-15-2018 0 4	0	4
high cpu over xtime alert I want to create an alert when the cpu is at 50% or higher for greater than 5 mins. I thought this would work, but i... by mcbradfordwcb Engager in Splunk Search 03-15-2018 0 1	0	1
Return values of field that dc is ran on instead of just the count Hello all, I have the following search: index="vpn_gateway" eventtype="vpn-authall" \| stats dc(vpnuid) by vpnc... by trc29 Engager in Splunk Search 03-15-2018 0 1	0	1
Why are several JSON fields getting extracted more than once at search-time? At search-time, several fields get extracted more than once, even if they only exist once in the event. I know I can ... by mathiask Communicator in Splunk Search 03-15-2018 0 6	0	6
combining stats question, can I do this as one search instead of appending 2? BASE_SEARCH \| rex field=dest_host "^(?<hostname>([a-z0-9\.\-]*\.)?(?<Domain>[a-z0-9\-]{2,}(?=\.[a-z\.]{3,})\.(?<tld>... by bkirk Path Finder in Splunk Search 03-15-2018 0 3	0	3
Timechart with no data gives "No results found" I want to show the number of bad errors each minute over an hour time period to show as an embedded report. I am usi... by burwell SplunkTrust in Splunk Search 03-15-2018 1 13	1	13
Matching String in line of texts in splunk Hi, I am quite new to splunk platform. Can you please help me out here with my requirement: I have to write a logic... by rakeshyv0807 Explorer in Splunk Search 03-15-2018 0 5	0	5
Match values under 2 different fields Need help. Appreciate in advance. I have 2 lookup csv. I need to match each value under "numberX" field against the ... by linwqg New Member in Splunk Search 03-15-2018 0 12	0	12
SPL to find users NOT in ldapsearch subsearch results Looking for how to query for users that are logging in via Remote Desktop which are not in a certain OU in Active Dir... by jgbricker Contributor in Splunk Search 03-15-2018 0 4	0	4