Splunk Search

Community Activity

Number of events found not matching number of events displayed Our Splunk Enterprise deployment has started returning inconsistent results, and I've been unable to track the source... by elliotproebstel Champion in Splunk Search 01-03-2018 1 6	1	6
Is there a Splunk search command that will give an organized summary listing of all field alias definitions? Hello, I was wondering if there is an SPL command that will give an organized summary or listing of all field aliase... by kdwsplunk Explorer in Splunk Search 01-03-2018 0 2	0	2
EVAL for multiple conditions check I have a search which checks if the values within con_splunkUL exist within con_UL (or visa versa). I need a field ... by davidcraven02 Communicator in Splunk Search 01-03-2018 0 1	0	1
In a table how to calculate sum of the values of one column between two specific value of another column ? The table output of my splunk query gives me an output like this. uri \| tra... by zacksoft Contributor in Splunk Search 01-03-2018 0 7	0	7
I would like to index and make the KV that are in the JSON available as searchable fields I am using Splunk Cloud which means I do not have access to the server. I have log lines that look like this: Jan ... by andrewbeak Path Finder in Splunk Search 01-03-2018 0 6	0	6
Geostats Map Drilldown I have a lookup file that contains the name, ID, Latitude and Longitude of all our branches. I have designed a map to... by kakarsu New Member in Splunk Search 01-02-2018 0 4	0	4
How to extract date:time format from raw data using REGEX? Below is part of my sample data .. I want to extract date and time from the data. 00.111.222.1 va10n40596.abcdefgt.c... by jsuryaprakash Path Finder in Splunk Search 01-02-2018 0 3	0	3
FULL NULL Values based on certain values The OverAllStatus only displays on the first row but I require the OverAllStatus to be displayed on each row for each... by davidcraven02 Communicator in Splunk Search 01-02-2018 0 3	0	3
Is there any way to get the top 10 hosts with event count spike compared to Yesterday's event count in splunk from a lookup which contains hosts? I have lookup file which contains a list of hosts around 500 as follows host A B C d Now, how to write a query to i... by pavanae Builder in Splunk Search 01-02-2018 0 2	0	2
Combining two searches into one search Hi all, I'm having an issue combining two searches into one search. I have a sourcetype that logs information about... by Zerophage New Member in Splunk Search 01-02-2018 0 7	0	7
Does each Splunk event have a unique identifier? I would like to tag some specific events to group them together for incident response and forensics purposes. Is thi... by araitz Splunk Employee in Splunk Search 01-02-2018 12 10	12	10
Can you help me understand the syntax of this rex feld and where such commands are used? rex field=GB"(?[^]+)" Hi Team, can any help me to understand each syntax in above command and also would like to kno... by maheshsat Explorer in Splunk Search 01-02-2018 0 8	0	8
How to specify earliest and latest time modifiers to display previous week and current week results? Hi, We are having option of previous week and current week in time modifier in search.Can anyone tell how I will get... by sxp5686 Explorer in Splunk Search 01-02-2018 0 2	0	2
How to add Total grouped by a field ? My table output gives me values in two columns . Column 1 gives different user name, Column 2 gives transaction time.... by zacksoft Contributor in Splunk Search 01-02-2018 0 5	0	5
Transaction by field not grouping correctly when amount of data is huge Hi there, I have an index storing information about network connections which receives information of such connectio... by leosanchezcasad Explorer in Splunk Search 01-02-2018 0 4	0	4
Rex to Extract Specific Word Hi, I wonder whether someone maybe able to help me please. I'm using the following rex to extract the word ID from a... by IRHM73 Motivator in Splunk Search 01-01-2018 0 13	0	13
Count string value over 7 days I need to display the LastBackupStatus of all servers over the last 7 days. (The values of this field are only Succes... by davidcraven02 Communicator in Splunk Search 01-01-2018 0 3	0	3
how to change the color of a table cell depending on the numerical value row wise KPI \| Week1 \| Week2 \| Week3 \| Week4 \| Aging \| 42 \| 48 \| 50 \| 60 \| SLA \| 0 ... by 9738078959 Engager in Splunk Search 01-01-2018 0 4	0	4
status of data feeds coming in Is there a way to show total feeds coming in per sourcetype etc. everyday? Would be good if I can see the data within... by ecanmaster Explorer in Splunk Search 12-30-2017 0 8	0	8
How to insert the values if match is found? I have duration 00:00:10.000000 i.e 00 hrs 00 mins 10 secs .But I want to add days also as my field has many valu... by chitreshakumar Communicator in Splunk Search 12-30-2017 0 5	0	5
How to extract days ,hours minutes and secs?? I have got the duration in this format 11+09:45:25.591549.I want to convert it to 11 days 9 hours 45 mins 25 secs. by chitreshakumar Communicator in Splunk Search 12-30-2017 0 4	0	4
Filtering Lines in multilines events Hello all, Just would like to understand how to proceed with the filtering lines in multiline events. My events have... by danillopavan Communicator in Splunk Search 12-30-2017 0 15	0	15
user ldap results in my search I have an ldap search that pulls computers from active directory group and works great. something like: \|ldapsearch... by chadman Path Finder in Splunk Search 12-29-2017 0 3	0	3
Regex - Extracting a string between two records Okay, here we go. Let's get the basics out of the way. We run Splunk Enterprise 6.6.4, on-prem, from Linux based se... by mgranger1 Path Finder in Splunk Search 12-29-2017 0 11	0	11
removing zero values or using where clause with multiple eval statements I am running the query below: index=onelogin_roll role_id{} != null email!="surfspamfree.com" email!="littler.com"... by agreer New Member in Splunk Search 12-29-2017 0 5	0	5

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Splunk Search

Number of events found not matching number of events displayed

Is there a Splunk search command that will give an organized summary listing of all field alias definitions?

EVAL for multiple conditions check

In a table how to calculate sum of the values of one column between two specific value of another column ?

I would like to index and make the KV that are in the JSON available as searchable fields

Geostats Map Drilldown

How to extract date:time format from raw data using REGEX?

FULL NULL Values based on certain values

Is there any way to get the top 10 hosts with event count spike compared to Yesterday's event count in splunk from a lookup which contains hosts?

Combining two searches into one search

Does each Splunk event have a unique identifier?

Can you help me understand the syntax of this rex feld and where such commands are used?

How to specify earliest and latest time modifiers to display previous week and current week results?

How to add Total grouped by a field ?

Transaction by field not grouping correctly when amount of data is huge

Rex to Extract Specific Word

Count string value over 7 days

how to change the color of a table cell depending on the numerical value row wise

status of data feeds coming in

How to insert the values if match is found?

How to extract days ,hours minutes and secs??

Filtering Lines in multilines events

user ldap results in my search

Regex - Extracting a string between two records

removing zero values or using where clause with multiple eval statements

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Break the Build: Inside the KubeDoom Lounge at .conf26

Splunk Auto Ingestion Parallel Pipeline Scaling

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation