Splunk Search

Community Activity

How to read data from a lookup table and then use these values to compare and make a decision (more like a matrix table)? I have a lookup table that looks like this: Variable1---variable2---Score 0--- null ---3 0---500---2 500---100... by sh254087 Communicator in Splunk Search 10-30-2017 0 1	0	1
Is it possible to use a lookup table to populate a search where the values in the table become a series of OR statements Right now I am tasked with creating a report for a department showing who is using elevated privileges in Linux and f... by Admiral_Marith Explorer in Splunk Search 10-30-2017 0 2	0	2
How to extract event_id and STATUS? I have a single row event that populates the below values and i would like to extract eventid=389643 and STATUS=FINIS... by jayakumar89 Explorer in Splunk Search 10-30-2017 0 3	0	3
splitting and inverting How do I go from: ”metrics=[a=1,b=2,c=3]” ”metrics=[a=2,b=5,c=6]” ”metrics=[a=1,c=3,c=4]” To: “a,b,c” “1,2,3”... by jamesrender New Member in Splunk Search 10-30-2017 0 12	0	12
How can I count different types of Splunk searches Hello, I am reading the following resource from Splunk documentation and I find that there are 8 types of searches in... by arpit_arora Explorer in Splunk Search 10-30-2017 0 3	0	3
Chart over multiple variables day_receive_time="Wed, Oct 25, 2017" device_name="apple" app="mssql-db" bandwidth_consumption="161" day_receive_time... by atulitm Path Finder in Splunk Search 10-30-2017 0 8	0	8
How to remove \x22 from raw results. I'm trying to replace the "\x22" entries in my raw results with the correct quotation marks so I can read the the ful... by jurjenterpstra New Member in Splunk Search 10-30-2017 0 3	0	3
Error with timechart command Hi, I'm having a bit of trouble with this query of mine. source="xxx" host="xxx" index="xxx" sourcetype="xxx" earl... by mahbs Path Finder in Splunk Search 10-30-2017 0 8	0	8
Search mechanics understanding Short and sweet: Why does the search: bf=1 (no quotes) take so much longer to run than "bf=1" (with quotes?) ... by blurblebot Communicator in Splunk Search 10-30-2017 4 2	4	2
Count does not shown as 0 when the username is not found in the sourcetype Hi, I want to shown the Total as 0 if username in lookup table has not event log . Using the fillnull value , it does... by florencegoh New Member in Splunk Search 10-30-2017 0 8	0	8
How to join 2 rows to only be 1 row Hi, How can I turn multiple rows into a single row? For example, Name Skill1 Skill2 Skill3 Shine Oracle Shine ... by mrccasi Explorer in Splunk Search 10-30-2017 0 4	0	4
Count values from fields that may not exist Hello, How to sums values from fields that may not exists? I want to sums fields (if exists ) with this pattern: netw... by Rialf1959 Explorer in Splunk Search 10-30-2017 0 4	0	4
How can I find network traffic at consecutive time intervals? I am trying to write some beaconing reports/dashboards. I have a few of them figured out, but now I am stuck trying ... by MonkeyK Builder in Splunk Search 10-29-2017 0 1	0	1
How do I optimize my search to return results faster? So here's my workflow. I have a request from an outside source that wants me to scrub my data for certain IP addres... by tmarlette Motivator in Splunk Search 10-29-2017 0 6	0	6
Correlate logins outside of business hours with incidents and change requests Hi, I am trying to make a table that shows the logins outside of business hours, and to show besides if the user had... by jorjiana88 Path Finder in Splunk Search 10-29-2017 0 1	0	1
How to use chart command to get data over 3 variables day_receive_time="Wed, Oct 25, 2017" device_name="apple" app="mssql-db" bandwidth_consumption="161" day_receive_time... by atulitm Path Finder in Splunk Search 10-28-2017 0 3	0	3
Textbox Validation Issue I am trying to validate the testbox to accept only numeric not any other character. How to do that? Thanks in Advance... by vivek_manoj Explorer in Splunk Search 10-28-2017 0 10	0	10
How to run multiple splunk 6.2 instances on Windows? How to run multiple splunk 6.2 instances on Windows? by cdo_splunk Splunk Employee in Splunk Search 10-28-2017 2 6	2	6
How to extract field names from Arris_log? I need help extracting alert numbers from these different raw logs. I need help extracting alert numbers from these different raw logs. I have tried using Field extractor and not having... by avishek08 New Member in Splunk Search 10-27-2017 0 3	0	3
How to delete fields that I created in sourcetypes? Hi, I created a source type. Then I created new fields using delimiters. I would like to delete those fields but I c... by Mat93 New Member in Splunk Search 10-27-2017 0 4	0	4
Can I match indexed data to a CSV with a lookup? I have an index called weblogs and a csv lookup called socialmedia that contains 3 columns called URL TYPE and NAME.... by bgill0123 Loves-to-Learn in Splunk Search 10-27-2017 0 1	0	1
Using rex to extract a string from an inner starting delimiter to a unique ending delimiter So I have events that have the following consistent layout: {value=1, key=a}, {value=2, key=b}, {value=3, key=c}, {v... by jimm Explorer in Splunk Search 10-27-2017 0 3	0	3
Search for multiple strings and put into one line chart. I have a search that currently has 3 search terms... host="s2a*" "Command Aborted" OR "Internal queue full" OR "Abor... by mdavis43 Path Finder in Splunk Search 10-27-2017 0 4	0	4
Compare two fields (IP addresss) from 2 different vendor firewalls Hi mates, I'm figuring out how I can show a table with matching IP addresses from 2 different vendor firewalls. So ... by rookie507SL New Member in Splunk Search 10-27-2017 0 6	0	6
How to sum correctly? Hello All, I am having an issue using the stats sum command. This is currently my search: source="Jan_Sept_FinanceS... by tonahoyos Explorer in Splunk Search 10-27-2017 0 6	0	6