Splunk Search

Community Activity

Can I write a search that contains the source of an event to identify the client that originated a proxy request? (With a common field) Hello, I have a report that shows me network events - most of the events will have "source ip" coming from a proxy ... by ptur Path Finder in Splunk Search 10-06-2017 0 1	0	1
Could you please anyone help me to write the time_format for bellow logs. Hi Folks, could you please anyone help me to write the TIME_FORMAT , TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD for bel... by lksridhar Explorer in Splunk Search 10-06-2017 0 3	0	3
Table command versus stats command for this search (for efficiency)? My Query is as follows index=x source=y COMPLETED \| stats values(process_key) as "Process Key", values(process_st... by delgendy Explorer in Splunk Search 10-06-2017 0 1	0	1
JSON Field Extraction names with curly brackets Hello I'm currently searching over a collection of events that contains some JSON structure, when applying SPATH over... by dmonsag Explorer in Splunk Search 10-06-2017 0 4	0	4
Compare two fields tables I have one saved search which returns list of successful job runs e.g jobname A B C D I also have a lookup table w... by gauravmishra15 Path Finder in Splunk Search 10-06-2017 0 2	0	2
Combine a search and subsearch to create a table with all values Hi guys, Quick question here: I have the following queries: Q1: Sub-Search for userID Q2: Main search, which provid... by robettinger Explorer in Splunk Search 10-06-2017 0 5	0	5
After using a JOIN i now have multiple lines, however this has affected my maths as before i have sumed up maths, now i have maths per line Hi I use a JOIN and now i have multiple lines and not unique ones. It returned one line per unique Context+Command. ... by robertlynch2020 Influencer in Splunk Search 10-06-2017 0 5	0	5
Calculating a sum with conditions Hi all! The case is that I want to calculate sum of purchase price of the applications where the application status ... by Jurala Explorer in Splunk Search 10-06-2017 0 2	0	2
how to sum consecutive success of sequential order of events fileds comes? My fields contains " search \| eval status=if(value>10,Success,failure) \| table Name message status Name Message Sta... by karthikeyan_k14 New Member in Splunk Search 10-05-2017 0 3	0	3
Dynamic Search based on previous search output and if condition Hello Splunk Community, Business requirements pushing my knowledge on Splunk so far... just wondering if Splunk quer... by cabauah Path Finder in Splunk Search 10-05-2017 0 1	0	1
Help with search to create a table Hello folks, I am new to Splunk and need to get a report in CSV file or table. I like to see only URL and values of ... by BaharJ New Member in Splunk Search 10-05-2017 0 2	0	2
Is it possible to use id and base in the same search in Simple XML? Hello, Is there an available post-processing method to use a base search and produce a secondary search id? I'm putt... by jocobknight Explorer in Splunk Search 10-05-2017 0 5	0	5
What is the best way to format _time when values become unreadable after transpose? So I have to queries... First one gives me a normal time/date format which is human-readable i.e. (2017-10-05 15:20:... by packet_hunter Contributor in Splunk Search 10-05-2017 0 1	0	1
Kind of inner join Hello, Hopefully, you will understand what I mean...It was not clear how I could formulate a search to find some doc... by adamski007 Explorer in Splunk Search 10-05-2017 0 11	0	11
Convert a string with percentage sign to a number so it can be evaluated? Hello, I have this query to alert me when percentage_q_full reaches greater than certain number eval alert=case((PE... by charanramireddy New Member in Splunk Search 10-05-2017 0 2	0	2
Grouping by two fields, want to get distinct count of values in second field Hi, I wrote the following Splunk query which returns a list of distinct USER_AGENTs for each SESSION_ID: index=abc ... by jbrenner Path Finder in Splunk Search 10-05-2017 0 2	0	2
join and compare the values in 2 different field which values are same from different in my search contcxtid and sourceSession has the same vales but indexing in to different places how could i compare ... by svemurilv Path Finder in Splunk Search 10-05-2017 0 2	0	2
What can be done when an indexer doesn't join the cluster? We have a cluster of four nodes and one of them just crashed. We brought it up, but it hasn't joined the cluster. Rol... by ddrillic Ultra Champion in Splunk Search 10-05-2017 0 2	0	2
Regex to filter security events does'nt work, need help Hi Guys, We have UFs on our DCs and 2 indexers and on both indexers, to drop the unwanted text from events I tried... by hrithiktej Communicator in Splunk Search 10-05-2017 0 4	0	4
How to list my splunk admin users list and last login details. I have a about 250 Admin users and I would like to to know when was the last time each of them have logged in. Is the... by RASHO123 New Member in Splunk Search 10-05-2017 0 1	0	1
What is best approach to implement kv store to replace using lookups? HI! I have two search heads in cluster and multiple lookups in Splunk but currently started facing issues of replica... by MousumiChowdhur Contributor in Splunk Search 10-05-2017 7 3	7	3
Data Summary is not showing all host. When I am on the Search Head and I go to data summary under Search and Reporting, it only shows 2 host but they come ... by andsmith2 Explorer in Splunk Search 10-05-2017 0 3	0	3
Getting count per day for a specific splunk query I run index=hydra bu=dmg env="prod-*" ERROR everyday and record the count. I lost the statistics I had kept and would... by manish41711 Engager in Splunk Search 10-05-2017 0 3	0	3
How to quickly count total events in an index? Besides running "index=foo *" is there a way to quickly check the total number of events indexed in an index? by muebel SplunkTrust in Splunk Search 10-05-2017 3 4	3	4
Help rebuilding subsearch that keeps timing out So here's my issue. We are creating a chart that shows each user and which desktops they use. The desktops are div... by kmaron Motivator in Splunk Search 10-05-2017 0 4	0	4