Splunk Search

Community Activity

What should be added to my search to convert all the results to be lower case? I have a Splunk query as follows \| inputlookup hosts.csv \| rename Hostname as my_hostname \|rex mode=sed field=my_h... by pavanae Builder in Splunk Search 10-21-2017 0 6	0	6
How do you specify x-axis intervals on ChartView (type column)? Hi all, I am using the object ChartView (type column) however I am not able to set the intervals (units) in axis X f... by danillopavan Communicator in Splunk Search 10-21-2017 0 5	0	5
How to extract password field in the events with regex? (Password is a string of numbers) How to extract password field in the events? I need to extract " 123456-222245-666565-151063-123456-222365-333111-... by kiran331 Builder in Splunk Search 10-21-2017 0 2	0	2
How to regex events with "==========================" as event breaker? How to break the events with using regex with "==========================" as event breaker? event: PS C:\tetst\te... by kiran331 Builder in Splunk Search 10-20-2017 0 5	0	5
How to create a table depending on quarters and intervals? Hi Team, I have data of several years sorted by specific dates and numbers. And I would like to display them on qua... by Terka117 New Member in Splunk Search 10-20-2017 0 3	0	3
How can I search for all domains for "All Time" and limit results by second criteria -- First seen date of today or yesterday? Hey All, Sorry if this is a duplicate, or already been answered, but I've tried numerous ideas from posts, and the d... by ag100 Explorer in Splunk Search 10-20-2017 0 4	0	4
How do you write rex to extract unstructured field? I have the below log. I want to extract the sixth column as a field, in that column I have different types values. So... by haja4nhn New Member in Splunk Search 10-20-2017 0 7	0	7
How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process. Hi ,For my current project i need to implement a Tracker functionality which basically shows various phases of Onboar... by shivendra_infy Path Finder in Splunk Search 10-20-2017 0 10	0	10
Use other events fields as a field for your search Hi, I need to use events on a data source as a reference for other events Example: ID . \| Name . \|Type . \| IDC... by pmgahan New Member in Splunk Search 10-20-2017 0 9	0	9
Search data for All Time but only graph a specified time range Hello, I am charting IT help desk tickets and I need to make a chart showing how many tickets are opened and closed ... by kyule New Member in Splunk Search 10-20-2017 0 6	0	6
Why Raw events table (populated using tokens) displays raw events for some events but not the others? Hi, Would really appreciate if someone could help me with this issue: I have a Table that displays Host and "Error ... by aina_sloan New Member in Splunk Search 10-20-2017 0 4	0	4
Need to make a new field with values of new made fields from two indexes Hi, Maybe a simple question, but im struggling with it. I would like to make a new field with eval which consist of ... by jpsolognier New Member in Splunk Search 10-20-2017 0 9	0	9
How to filter out the list of hosts that are in the lookup but not in my search result? I have a query as follows which displays the list of hosts and their host details as follows host field_A fiel... by pavanae Builder in Splunk Search 10-20-2017 0 4	0	4
streamstats and exclude field values that changed their state to a particular value Hi All, I am hoping you can help me out with the following : I am preparing a report from the logs of our monitori... by saurabhkunte Path Finder in Splunk Search 10-20-2017 0 3	0	3
How can I create a table with the currently logged in VPN users? Hi, I wanted to display in a form of a table the current logged in VPN users. my search command is this host="" u... by 5plunked Explorer in Splunk Search 10-19-2017 0 3	0	3
eval wildcards I have a search that uses some wildcards: sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT \| rex fie... by gnovak Builder in Splunk Search 10-19-2017 4 5	4	5
Combining unique field values I have the following problem I would like to solve Numbers1 Numbers 2 1 6 2 ... by sahr Path Finder in Splunk Search 10-19-2017 0 3	0	3
My count is double. Can I use field from search to search lookup table? 1) I have got a query whose output are events that contains a field called CV4_TExCd. The base query looks like this:... by mmdacutanan Explorer in Splunk Search 10-19-2017 0 6	0	6
Linechart with multiple lines of data on one chart? Dummy question. I have a CSV file that contains three columns (fields) <date>, <value>,<group> 2017-01-01, 10, ... by sed1565 New Member in Splunk Search 10-19-2017 0 1	0	1
Is there any benefit to explicit field extraction vs letting splunk do it on it's own? All, I have a soucetype that is quite complex. So I need to leave autoKV extractions on. In one of the logs there i... by daniel333 Builder in Splunk Search 10-19-2017 0 1	0	1
Can I use relative time for bin span? I want to run a query with rolling time span (rolling every minute) and want to count events in last 1 hour relative ... by mpatel11 Explorer in Splunk Search 10-19-2017 0 9	0	9
set timezone in search most of my data sets to UTC, and all data sources are properly tagged to convert to UTC if they are not. My user is ... by GeorgeStarkey Path Finder in Splunk Search 10-19-2017 0 2	0	2
How to modify the results in required format? I have a lookup query as follows \| inputlookup hosts.csv \| rename hostname as my_hostname \| table my_hostname the ... by pavanae Builder in Splunk Search 10-19-2017 0 1	0	1
How would I configure my regex to also include Windows data? I have a query that will identify all the logs in my instance for a certain index, it list everything running except ... by bluemarvel Path Finder in Splunk Search 10-19-2017 0 8	0	8
Time field always gives nanoseconds without format variable `xd_index`_alerts SiteName="*" ServerType="Member"\| eval _time=_time-(strptime(strftime(_time,"%Y-%m-%dT%H:%M:%S")." ... by jooi New Member in Splunk Search 10-19-2017 0 1	0	1

Get Updates on the Splunk Community!

Developer Spotlight with Denis Gladkikh

From Splunk Engineer to Kubernetes App Builder Denis GladkikhWhat happens when a lifelong developer turns a ...

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Splunk Search

What should be added to my search to convert all the results to be lower case?

How do you specify x-axis intervals on ChartView (type column)?

How to extract password field in the events with regex? (Password is a string of numbers)

How to regex events with "==========================" as event breaker?

How to create a table depending on quarters and intervals?

How can I search for all domains for "All Time" and limit results by second criteria -- First seen date of today or yesterday?

How do you write rex to extract unstructured field?

How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.

Use other events fields as a field for your search

Search data for All Time but only graph a specified time range

Why Raw events table (populated using tokens) displays raw events for some events but not the others?

Need to make a new field with values of new made fields from two indexes

How to filter out the list of hosts that are in the lookup but not in my search result?

streamstats and exclude field values that changed their state to a particular value

How can I create a table with the currently logged in VPN users?

eval wildcards

Combining unique field values

My count is double. Can I use field from search to search lookup table?

Linechart with multiple lines of data on one chart?

Is there any benefit to explicit field extraction vs letting splunk do it on it's own?

Can I use relative time for bin span?

set timezone in search

How to modify the results in required format?

How would I configure my regex to also include Windows data?

Time field always gives nanoseconds without format variable

Developer Spotlight with Denis Gladkikh

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation