Splunk Search

Community Activity

How to create summary index? I have a dashboard which contains 5 panels in table format.Query for panel1:index=xxxx sourcetype=xxxxx stroage_name... by Vani_26 Path Finder in Splunk Search 01-11-2024 0 5	0	5
best/fastest way to match results from two sets of data in the same index I have an index that is receiving JSON data from a HEC, but with 2 different data sets and about 2M per day:DS1{guid:... by loganramirez Path Finder in Splunk Search 01-11-2024 0 8	0	8
Return on certain field values in my search Hi Community,I'm fairly inexperienced when it comes to anything other than quite basic searches, so my apologies in a... by Clancy_Moped Engager in Splunk Search 01-11-2024 0 2	0	2
information about Splunk audit events Hi at all,I need to create some Correlation Searches on Splunk audit events, but I didn't find any documentation abou... by gcusello SplunkTrust in Splunk Search 01-11-2024 0 2	0	2
How to extract Title from this XML data HelloI have a very long xml record that I am trying to spath some data from but I cant seem to get it to work. Can so... by tkwaller1 Path Finder in Splunk Search 01-11-2024 0 5	0	5
Possibility to extend the hover description Hello everyone, I am still relatively new to Splunk. I would like to add an additionalTooltipField to my maps visuali... by sha Loves-to-Learn in Splunk Search 01-11-2024 0 0	0	0
Output of one String as an input to another search I have this query which is working as expected. There are two different body axs_event_txn_visa_req_parsedbody and ax... by jayeshrajvir Explorer in Splunk Search 01-11-2024 0 10	0	10
Performing Set operation using splunk query Hi ,I have two queries, that have a common field someFieldone helps me find inconsistencies:sourcetype="my_source" so... by darkhorse91 Loves-to-Learn in Splunk Search 01-10-2024 0 1	0	1
Splunk lookup (not inputlookup) and cidr matching Hello,I have a search that's coming back with 'src' which is the source IP of a client, and I have a lookup file cal... by cybersecnutant Explorer in Splunk Search 01-10-2024 0 2	0	2
How Can I search retrospectively in splunk I am working on building a query to search retrospectively and potentially run a report.Let's say the first search is... by darkhorse91 Loves-to-Learn in Splunk Search 01-10-2024 0 3	0	3
metrics-toolkit We are using splunk metrics-toolkit app to check the logs.created two indexes 1.metrics 2. platform_benefits and one ... by arun_questions New Member in Splunk Search 01-10-2024 0 1	0	1
Query should return last/latest available data when there is no data for the selected time range Query should return last/latest available data when there is no data for the selected time range by saichandjawari Explorer in Splunk Search 01-10-2024 0 5	0	5
Need help with json spath search Hello, I have seen a few of the spath topics around, but wasn't able to understand enough to make it work for my data... by madhav_dholakia Contributor in Splunk Search 01-10-2024 0 2	0	2
Having a base64 decoding problem in Splunk 9- How to decode Idap-events? After installing splunk 9 we have a problem with decoding ldap-events. We tried several apps but none of them gave us... by rrovers Contributor in Splunk Search 01-09-2024 0 3	0	3
How can I represent the stats for 5 minutes before and the top of the hour? I am looking to represent stats for the 5 minutes before and after the hour for an entire day/timeperiod. The search... by mark_groenveld Path Finder in Splunk Search 01-09-2024 0 7	0	7
search stats Hi, I have a log with several transactions, each one have some events. All event in one transaction share the same ID... by asncari Engager in Splunk Search 01-09-2024 0 2	0	2
using lookup without common field Hi Splunkers, I'm having a lookup country_categorization, which have the keyword and its equivalent country, we nee... by smanojkumar Contributor in Splunk Search 01-09-2024 0 2	0	2
Extracting a multivalue key-value pair to multivalue field for lookup Hello,As I want to get my email events CIM compliant, I have trouble parsing a "disposition" key-value pair.Example:H... by egrzeszczak Loves-to-Learn Everything in Splunk Search 01-09-2024 0 1	0	1
Can you help me build a search query for checking the latest version of Splunk Enterprise? Hello all, I know that Splunk regularly checks for Splunk Enterprise and app updates. There is the "New (maintenance... by whrg Motivator in Splunk Search 01-09-2024 0 3	0	3
Variance or Average Delta Between MV Field of timestamps I'm trying to calculate the variance and delta between a multivalue field that contains epoch timestamps. The purpose... by mhorch New Member in Splunk Search 01-08-2024 0 1	0	1
Find nearest value in numeric multivalue field to other numeric field I have events with a numeric field "Amount" and a field "User". In a KV Store collection I keep the Amount history va... by sematag New Member in Splunk Search 01-08-2024 0 2	0	2
Date and Time fields from the string I have a "myfiled" for the last update in format 2020-11-25T11:40:42.001198Z.I want to create two new fields UpdateDa... by bigll Path Finder in Splunk Search 01-08-2024 0 10	0	10
How to limit my search to return only the top 10 results based on the following search queries ? I am using these search queries and I want to restrict the search to return only the top ten results. How to do it ?... by ranjyotiprakash Communicator in Splunk Search 01-08-2024 4 13	4	13
Create dynamic url for Splunk search Hi Team,Hope this finds all well.I am trying to create a alert search query and need to create the splunk url as a dy... by man03359 Communicator in Splunk Search 01-08-2024 0 1	0	1
How to fetch timestamp for dates where events are lesser than average event count? Hello All,I need to fetch the dates in the past 7 days where events are lesser than average event count.I used the be... by Taruchit Contributor in Splunk Search 01-08-2024 1 4	1	4