Splunk Search

Discussions

Thread Info

Join two search queries - two indices.

Hi we try to join the information of two indices. INDEX_A contains the GC-Logfiles for a specific environment. To ...

by Explorer in

Can splunk identify bank details being changed on a legacy trading system?

Can Splunk identify a pattern in which fraud is occurring, for example, emails asking to change bank accounts, emails...

by New Member in

Determine daily change rate for ESXi Hosts

Hello, we need to determine the Daily Change rate for logs on our ESXi Hosts (deployment sizing). Can anyone offer...

by New Member in

Not able to get response queries with special characters in If statement

Hi, I am trying to get response time between events using below query but for some reason i am not being returned...

by New Member in

AND OR not working correctly

I am getting the below error when trying to form an AND & OR in my query. Error in 'eval' command: The expression...

by Communicator in

Eval and stats not bring friendly

index=ios host=1.1.0.2 src_ip="1.2.2.1" "NBRCHANGE" | head 1 | eval status = if(like(_raw, "%down%"), 1 , 0) | sta...

by New Member in

Count occurrences of all values of a field for another field

Hello all, I am trying to count all the occurrences of keywords that show up in logs. Here is an example: Here is ...

by Path Finder in

How does one search for a CIDR range of addresses?

If I want to search for a range of addresses, say anything in 10.0.1.0/24 from anywhere in the log, how do you do tha...

by New Member in

Data stored using the collect command takes a long time to become searchable.

Hi, I am using a DBXquery and then collecting the returned data into an index. I am doing this on a search head which...

by Engager in

EVAL causes a field to be blank

I need the field "Location" added to my search as seen in the screenshot attached. However, in this query below the L...

by Communicator in

Watt to kWh

Hi all, I monitor my electricity consumption using a device which takes the current Watt consumption every minute ...

by New Member in

Regex for multline events

Hi , The Logstash client on the application box is configured to identify multiline events and send each event as ...

by Path Finder in

How can I get total duration of time for which each user logged in to splunk for this month.

We have many users using splunk dashboards and we want to know total time for a user logged in to splunk system for t...

by Path Finder in

How to retrieve the events based on the selected values from the Statistics table

Hey, I am trying to retrieve the events based on the selected values from the Statistics table IBD TOTAL SUCCES...

by New Member in

Splunk ML app not looking at the entire data

Hi, We are evaluating Splunk for our ML use case. We are using "Free splunk" at this point of time for the evaluat...

by New Member in

How to dynamically change number of rows displayed in the table with simple XML using Splunk 6.1.x?

I am using Splunk 6.1.2 and have a panel with a table developed in simple xml. I would like to allow users to be a...

by Revered Legend in

DF details not rolling in servers

We are trying to get df details in our log. these details are rolling in few servers but it is not rolling in few ser...

by New Member in

i want to keep the SSED_BUS-number as it is and i want mask other number and email id

SSED-BUS-0123 the package is failed to accept SSED-BUS-1466 master id 1-fjdfh23 SSED-BUS-13583 master 85793 SSED-BUS-...

by Builder in

pls help with regular expression

i want to keep the pattern of specific word which starts with OS0003/SSED-BUS-0015 as it is and want to mask others n...

by Builder in

the search job terminated unexpectedly

This search take only a few second to come back index=* sourcetype=* (source="/opt/data/-AA_.csv" OR source="/opt/dat...

by Path Finder in

Convert multi-value expression to field names and values

I have a string, "one:isone,two:istwo,three:isthree" The goal is to convert these to fields and values...

by Path Finder in

Rex extraction

I have a field called "user", i'm trying to extract the username from the string and create a new field called extrac...

by New Member in

Run Alert Every Few Hours Between Specific Hours/Days

I have some events that only happen every few hours between the hours of 8AM and 6PM, M-F. So, I want to set up a los...

by Path Finder in

Changing of management port still pointing to DS & receiving the logs.

My question might be weird. I change the management port on one of endpoint(universal forwarder)from multiple forwar...

by Path Finder in

Why Doesn't Coalesce work in an If/Case Statement?

I am trying to write a search that if the field= Email then perform a coalese, but if the field isn't Email- just put...

by Path Finder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Join two search queries - two indices.

Can splunk identify bank details being changed on a legacy trading system?

Determine daily change rate for ESXi Hosts

Not able to get response queries with special characters in If statement

AND OR not working correctly

Eval and stats not bring friendly

Count occurrences of all values of a field for another field

How does one search for a CIDR range of addresses?

Data stored using the collect command takes a long time to become searchable.

EVAL causes a field to be blank

Watt to kWh

Regex for multline events

How can I get total duration of time for which each user logged in to splunk for this month.

How to retrieve the events based on the selected values from the Statistics table

Splunk ML app not looking at the entire data

How to dynamically change number of rows displayed in the table with simple XML using Splunk 6.1.x?

DF details not rolling in servers

i want to keep the SSED_BUS-number as it is and i want mask other number and email id

pls help with regular expression

the search job terminated unexpectedly

Convert multi-value expression to field names and values

Rex extraction

Run Alert Every Few Hours Between Specific Hours/Days

Changing of management port still pointing to DS & receiving the logs.

Why Doesn't Coalesce work in an If/Case Statement?

Preparing your Splunk Environment for OpenSSL3

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

How do I Exclude null/empty fields from a lookup r...

return results even when the count of a field valu...

Need Help with Splunk Alert

Using Machine Learning Toolkit to detect auth abus...

How to check MQ reconnects after a connection is d...