Splunk Search

Community Activity

	exclude logs from being tagged Hello, I'm trying to eliminate the "unknown action, hosts" etc. there is some log's that don't contain an Action, so... by ahmadjabr Engager in Splunk Search 12-11-2017 0 2	0	2
	Can I use a wildcard in the field to create a table of hostnames that match entries in the lookup table? Have seen a lot of Q&A about wildcards in the lookup table; this is the reverse. Here is the scenario. Lookup table ... by claatu Explorer in Splunk Search 12-11-2017 0 9	0	9
	Subsearch help - find the events from one source type based on the input searched from other source type. I want to find the number of events occurring in sourcetype=B based on the distinct Device_MAC_Address searched from ... by rafiqul New Member in Splunk Search 12-11-2017 0 2	0	2
	Has CIDR matching has changed between 6.3.x and 7.x? So I was doing some debugging for someone on CIDR matching and appeared to get inconsistent results between versions ... by cameronjust Path Finder in Splunk Search 12-11-2017 0 1	0	1
	evaluate if date field dd/mm is older than 5 working days. I have case such as : if date is older than 5 working (eg if today is Thursday 19th, then anything older than Thursd... by alfiyashaikh New Member in Splunk Search 12-10-2017 0 3	0	3
	Number of pages visited by each IP Hi, I am new in splunk and I would like to search for some info in my Logfile. I am just trying to count the total o... by luchin New Member in Splunk Search 12-09-2017 0 1	0	1
	how can I change the default search time for all users who are accessing a custom app i created? I would like to change the default search time for all users who select the custom app i have created from all time t... by splunkjpm Loves-to-Learn Lots in Splunk Search 12-08-2017 0 7	0	7
	Match IP address in Splunk to IP range in CSV index=logs ip_address=* has single ip addresses like 5.9.100.100 CSV file: range, owner 5.9.0.0/24 Owner1 5.10.64.0... by spark2310 Explorer in Splunk Search 12-08-2017 0 4	0	4
	Why shouldn't we search index=* I'm interested in knowing why it's frowned upon not to search index=*. I was asked by one of our employees and rememb... by sogeniusio Path Finder in Splunk Search 12-08-2017 0 2	0	2
	Why am I losing a field when dedup-ing values from two sourcetypes? I'm running the following search, but when I add the dedup line my d_name field goes blank. I have two sourcetypes bo... by glenngermiathen Path Finder in Splunk Search 12-08-2017 0 3	0	3
	How to compare two searches and count multiple fields and values? I have combined data from two searches and want to compare them to identify what is new in the second search, what is... by glenngermiathen Path Finder in Splunk Search 12-08-2017 0 15	0	15
	litte search: all src-ips whitch alled more than 4 dest. in a short timerange Hi there, I am new and I expect, that a have only a small Problem. I want to select all Source-IPs, whitch called mo... by DianaR New Member in Splunk Search 12-08-2017 0 8	0	8
	How can I use results of a stats table to output to another pipe or timechart? index=source earliest=-2h sourcetype=e \| bucket _time span=1h \|stats count by code _time\| delta count as difference ... by spark2310 Explorer in Splunk Search 12-08-2017 0 8	0	8
	I'm looking to extract out the sensor types that are designated by "sensor","q":"water" Hi, I have the below data. I'm looking to extract out the sensor types which are designated by "sensor","q":"water... by dbcase Motivator in Splunk Search 12-08-2017 0 2	0	2
	Trendline over time, displaying time values on x-axis Hi, I'm trying to plot a dataset over time. Here is my query: index=gpm AND (ExperimentStart OR runtimedatatransfer... by byu168 Path Finder in Splunk Search 12-08-2017 0 8	0	8
	Rex extraction of fields I have the following CVE results form a vulnerability report and would like to extract the CVEs to individual CVEs on... by leagawa New Member in Splunk Search 12-08-2017 0 4	0	4
	Deduping Results But Preserving Most Recent Value I'm running a query to pull data on some agents, which have each have a unique "aid". For example, my computer would... by cgalligan Explorer in Splunk Search 12-08-2017 0 2	0	2
	Regular expression for international characters Hi, I've written a regular expression to capture international characters, the only trouble I'm having with it now i... by mahbs Path Finder in Splunk Search 12-08-2017 0 3	0	3
	Counting regex matches only if another field is unique I've got a ordering log that includes two fields, order_id and shipped_date. I am playing with Splunk to see how har... by splunknoob408 Explorer in Splunk Search 12-08-2017 0 5	0	5
	Error in eval command Hi everyone i am runnig the following search and getting an error.i am sure it is something so simple that i am mi... by carlyleadmin Contributor in Splunk Search 12-08-2017 0 2	0	2
	Create a new field and populate it with normalized data? Hi, I have a field in my existing data set called mso. Within that field are company names Example CompanyA Compa... by dbcase Motivator in Splunk Search 12-08-2017 0 7	0	7
	Subsearch 2 fields with Match and 1 mismatch index =ttt beforeController [search index = ttt beforeController \| fields pnr, bnr, NOT(gnr)] How can I achieve tha... by rsharma1984 Explorer in Splunk Search 12-08-2017 0 5	0	5
	How to save practice data into the Splunk Enterprise as a student? Hello Spluksters, I installed the Splunk enterprise. I am also reading the free Splunk e-book. Chapter 2 talks of i... by LionKing18 Explorer in Splunk Search 12-08-2017 0 9	0	9
	Regex not accepted when searching Hi guys, I am trying to get a regex to just match if a process has been run from the C drive, root folder. I tried ... by robettinger Explorer in Splunk Search 12-08-2017 0 5	0	5
	Convert field values (e.g 15/12) to date format understandable to SPLUNK , and then check if the date is older than 5 working. I have field with values such as "06/12", "13/01", "20/05" i/e human readable dd/mm. I dont know weather splunk under... by alfiyashaikh New Member in Splunk Search 12-08-2017 0 9	0	9