Splunk Search

Community Activity

the search job terminated unexpectedly This search take only a few second to come back index=* sourcetype=* (source="/opt/data/-AA_.csv" OR source="/opt/dat... by srobinsonxtl Path Finder in Splunk Search 01-04-2018 0 4	0	4
Convert multi-value expression to field names and values I have a string, "one:isone,two:istwo,three:isthree" The goal is to convert these to fields and values, without k... by rharrisssi Path Finder in Splunk Search 01-04-2018 0 1	0	1
Rex extraction I have a field called "user", i'm trying to extract the username from the string and create a new field called extrac... by redferrari New Member in Splunk Search 01-04-2018 0 4	0	4
Run Alert Every Few Hours Between Specific Hours/Days I have some events that only happen every few hours between the hours of 8AM and 6PM, M-F. So, I want to set up a lo... by SplunkLunk Path Finder in Splunk Search 01-04-2018 0 2	0	2
Changing of management port still pointing to DS & receiving the logs. My question might be weird. I change the management port on one of endpoint(universal forwarder)from multiple forwar... by N92 Path Finder in Splunk Search 01-04-2018 0 1	0	1
Why Doesn't Coalesce work in an If/Case Statement? I am trying to write a search that if the field= Email then perform a coalese, but if the field isn't Email- just put... by katzr Path Finder in Splunk Search 01-04-2018 0 10	0	10
How do you include a literal double quote character in a Splunk Regex I'm using the _rex command and I want to create a regular expression that contains a literal double quote character. ... by jbrenner Path Finder in Splunk Search 01-04-2018 1 4	1	4
Sort and Sum...a more elegant way? New to dbs and Splunk. Querying against a CSV file of buy events. Want to return top 10 Users by purchase totals. ... by JamesPineda New Member in Splunk Search 01-04-2018 0 1	0	1
How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text? Hi, I have URIs like this: /appliance/detail/v3.0/vendor/3423434erts/fridge /appliance/detail/v3.0/vendor/6757dfs32... by xvxt006 Contributor in Splunk Search 01-04-2018 0 5	0	5
Combine Dynamic Fields Starting with same value So I have multiple fields whose field names could end with a different values. Examples of these fields are below: fo... by DanielWick New Member in Splunk Search 01-04-2018 0 1	0	1
How to split and retrieve a value ? I think we may need regex for this and I am not good at it. I need to be able to extract the last part i.e. (TMNT-17... by zacksoft Contributor in Splunk Search 01-04-2018 0 19	0	19
SPLUNK Search if word form file appears in logs Hi I have the following issue. I'm using SPLUNK for real-time monitoring of chat bot. I have as well file with bann... by swdowiarz Path Finder in Splunk Search 01-04-2018 0 9	0	9
AddColTotal value in a new column I use addcoltotal for one of my columns . But my result has a lot of rows, so I have to browse a lot of pages to find... by zacksoft Contributor in Splunk Search 01-04-2018 0 9	0	9
How to extract the fields for the Multiline- Each line has different Formats I'm having problem with a multi-line field extraction which I have been struggling to figure out. Below the log file... by rajeswariramar New Member in Splunk Search 01-04-2018 0 5	0	5
How to count the number of eventts starting at 9 am each day? Hi Guys, I have the below query using that is using the shared timepicker: today, which is counting the events from ... by auaave Communicator in Splunk Search 01-03-2018 0 5	0	5
Check values exist within two columns I tried to apply this logic as I want to check if the values from con_splunkUL exists within con_UL, but for me it se... by davidcraven02 Communicator in Splunk Search 01-03-2018 0 8	0	8
Splunk dashboard base search gives result which is different from that of an identical non-base search I am using Splunk Enterprise 6.6.2, and today I noticed an alarming problem. In order for me to troubleshoot the pro... by patng_nw Communicator in Splunk Search 01-03-2018 0 16	0	16
How to search comunication between a inputlookup with some ip's and traffic of an index ? Hi, I have a doubt about an inputlookup, i have a inputlookup with some ip's and i want to know how can see comunic... by Said7 Explorer in Splunk Search 01-03-2018 0 6	0	6
regex help I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below... by alanhowlett New Member in Splunk Search 01-03-2018 0 7	0	7
Basic math operation applied to stats Hi all, Student, new to Splunk and dbs. I need some help performing basic math operation against stats results. I... by JamesPineda New Member in Splunk Search 01-03-2018 0 2	0	2
Writing a regular expression to capture null values Hi, I've got fields which contain null values. I'm writing a regular expression to capture instances where fields co... by mahbs Path Finder in Splunk Search 01-03-2018 0 3	0	3
Number of events found not matching number of events displayed Our Splunk Enterprise deployment has started returning inconsistent results, and I've been unable to track the source... by elliotproebstel Champion in Splunk Search 01-03-2018 1 6	1	6
Is there a Splunk search command that will give an organized summary listing of all field alias definitions? Hello, I was wondering if there is an SPL command that will give an organized summary or listing of all field aliase... by kdwsplunk Explorer in Splunk Search 01-03-2018 0 2	0	2
EVAL for multiple conditions check I have a search which checks if the values within con_splunkUL exist within con_UL (or visa versa). I need a field ... by davidcraven02 Communicator in Splunk Search 01-03-2018 0 1	0	1
In a table how to calculate sum of the values of one column between two specific value of another column ? The table output of my splunk query gives me an output like this. uri \| tra... by zacksoft Contributor in Splunk Search 01-03-2018 0 7	0	7

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

the search job terminated unexpectedly

Convert multi-value expression to field names and values

Rex extraction

Run Alert Every Few Hours Between Specific Hours/Days

Changing of management port still pointing to DS & receiving the logs.

Why Doesn't Coalesce work in an If/Case Statement?

How do you include a literal double quote character in a Splunk Regex

Sort and Sum...a more elegant way?

How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

Combine Dynamic Fields Starting with same value

How to split and retrieve a value ?

SPLUNK Search if word form file appears in logs

AddColTotal value in a new column

How to extract the fields for the Multiline- Each line has different Formats

How to count the number of eventts starting at 9 am each day?

Check values exist within two columns

Splunk dashboard base search gives result which is different from that of an identical non-base search

How to search comunication between a inputlookup with some ip's and traffic of an index ?

regex help

Basic math operation applied to stats

Writing a regular expression to capture null values

Number of events found not matching number of events displayed

Is there a Splunk search command that will give an organized summary listing of all field alias definitions?

EVAL for multiple conditions check

In a table how to calculate sum of the values of one column between two specific value of another column ?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation