Splunk Search

Community Activity

Refining Threat Activity Search So I am trying to refine my Threat Activity Detected Search to only show "Allowed" connections rather than any blocke... by mtaylor78 Engager in Splunk Search 03-11-2018 2 1	2	1
Anyone interested in doing a session during splunkconf18 with AWS SA? Total shot in a dark, but i figured this is good way to build some friendships. I'm Solutions Architect with AWS Part... by tmak Explorer in Splunk Search 03-11-2018 0 2	0	2
eval shown in my email? How do i get this search to send the following eval shown in my email? I am getting email now but no result found sho... by dave0970 Engager in Splunk Search 03-11-2018 0 11	0	11
Is it possible to have SPLUNK reporting every computer usage on the network and how? I would like to be able to run a report showing the computer usage of every client on my network. Is there a way I ca... by tweedyloebus New Member in Splunk Search 03-11-2018 0 5	0	5
Custom command with splunklib not working I want to write custom search command with one argument(option). Below is the code that I've written, but I'm not get... by VatsalJagani SplunkTrust in Splunk Search 03-11-2018 0 1	0	1
How would I find characters displayed in a XSS probe and how would I use splunk to decode the URL? As stated above. Looking for indication of XSS probe and associated characters. I know this could be URL encoded and ... by tmalcom New Member in Splunk Search 03-10-2018 0 1	0	1
Group by field and sum by previously summed column? I am attempting to create sub tables from a main table, progressively removing columns and grouping rows. I have cre... by rkassabov Path Finder in Splunk Search 03-10-2018 0 1	0	1
Better way of getting the series of events and all the field values Right now i am using the transaction command to get a sequence of events based on a common field value. The resulting... by macadminrohit Contributor in Splunk Search 03-10-2018 0 2	0	2
How to get the real time status of a job? I am trying to get the current status of a job that is running now from the logs. Suppose there are job events like ... by loveforsplunk Explorer in Splunk Search 03-10-2018 0 2	0	2
Group records by two fields Hi, I have the data like below: TransactionID1 TransactionID2 aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa bbbbbbb... by varun99 Path Finder in Splunk Search 03-10-2018 0 2	0	2
Calculate diff in timings of down and up consecutive events and show if more than 10 days Example Logs(ignore time format as it is as expected by splunk : 1 jan neibhor is up 10 jan jan neibhor is down 20 ja... by atulitm Path Finder in Splunk Search 03-10-2018 0 8	0	8
Assign colour's based on the field value Hi Splunkers, I have the below query ( (index=xxx sourcetype=xxx severity=xxx intelId=xxx ) ) \| eval intelId = c... by ravidudala Explorer in Splunk Search 03-10-2018 0 4	0	4
How to calculate moving standard deviation in Splunk? _time, Prev Week(count),Prev 2 week(count),avg,3*Std Dev,Current count,Delta,RAG 1:30 8 7 7.5 2.121320344 8 ... by payal23 Path Finder in Splunk Search 03-10-2018 0 2	0	2
Is there a more efficient way to remove stop words from a text field than using the makemv and mvexpand combo? Hello, I'm currently performing analysis on a free text field and the first step is to remove stop words. This is m... by andrewtrobec Motivator in Splunk Search 03-10-2018 1 2	1	2
eventstats Noob question. What is the different between stats and eventstats commands? by passing Explorer in Splunk Search 03-10-2018 5 5	5	5
How to filter multiple values with pivot command - is the 'in' operator broken? Based on the Splunk pivot command documentation, one should be able to use: \| pivot ..... splitrow fieldname f... by wcooper003 Communicator in Splunk Search 03-09-2018 1 4	1	4
How do i subtract values from the same field and table results by another field in this case Field B How do i subtract values from the same field and table results by another field in this case Field B subtract 400 - ... by Bentash Explorer in Splunk Search 03-09-2018 0 7	0	7
REST endpoints /data/indexes and/data/indexes-extended give different number of event counts I'm trying to obtain the total number of events stored in an index. However, using 2 REST endpoints give me two diffe... by thenhaque Explorer in Splunk Search 03-09-2018 0 1	0	1
Pass a selected value to a join after calculations and other join with the same eventtype This is the question; In general, I have been able to resolve my doubts after the publications here, but I have had p... by ricardocastille New Member in Splunk Search 03-09-2018 0 3	0	3
How to customize stats using simple math? If I wanted a count of all the events in all my indices, I can just do: index=* \| stats count, which just returns a s... by flow2k Explorer in Splunk Search 03-09-2018 0 6	0	6
Why is Splunk Service not starting with 'authDb' error? Hi - any idea why my Splunk service is failing with this error? What is 'authDb'? ~]# service splunk start Starting... by NicholasLeader New Member in Splunk Search 03-09-2018 0 1	0	1
How to combine the output of 2 different fields into one single field? I have two fields I would like to combine into one field. field1 \| field2 \| combined field 1. ... by snix Communicator in Splunk Search 03-09-2018 0 3	0	3
Using `eval` to match all values (or existence) of a field Often, we can use eval(myField=someValue)) with aggregate functions like count and avg, as well as time function like... by flow2k Explorer in Splunk Search 03-09-2018 0 6	0	6
Is there a way to make use of a list of IP addresses for servers which have sensitive information in a Splunk search? Our campus is putting together a database of systems with sensitive or restricted information on them. I'd like to ex... by wrangler2x Motivator in Splunk Search 03-09-2018 0 10	0	10
Search not returning results from lookup table Hi all, Been racking my brain trying to create this search and I can't seem to get it working, so I was hoping you a... by celestekiyoko Explorer in Splunk Search 03-09-2018 0 3	0	3

Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Splunk Search

Refining Threat Activity Search

Anyone interested in doing a session during splunkconf18 with AWS SA?

eval shown in my email?

Is it possible to have SPLUNK reporting every computer usage on the network and how?

Custom command with splunklib not working

How would I find characters displayed in a XSS probe and how would I use splunk to decode the URL?

Group by field and sum by previously summed column?

Better way of getting the series of events and all the field values

How to get the real time status of a job?

Group records by two fields

Calculate diff in timings of down and up consecutive events and show if more than 10 days

Assign colour's based on the field value

How to calculate moving standard deviation in Splunk?

Is there a more efficient way to remove stop words from a text field than using the makemv and mvexpand combo?

eventstats

How to filter multiple values with pivot command - is the 'in' operator broken?

How do i subtract values from the same field and table results by another field in this case Field B

REST endpoints /data/indexes and/data/indexes-extended give different number of event counts

Pass a selected value to a join after calculations and other join with the same eventtype

How to customize stats using simple math?

Why is Splunk Service not starting with 'authDb' error?

How to combine the output of 2 different fields into one single field?

Using `eval` to match all values (or existence) of a field

Is there a way to make use of a list of IP addresses for servers which have sensitive information in a Splunk search?

Search not returning results from lookup table

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Unlock Database Monitoring with Splunk Observability Cloud

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

MLTKC how should i check jupyter notebook func in ...

Splunk Search

Join the Conversation