Splunk Search

Community Activity

how to use metadata to find the last reporting time of a list of hosts from a lookuptable without getting the "Metadata results may be incomplete: 100000 entries have been received from all peers" Warning The following is my query \| metadata type=hosts \| search [\| inputlookup hostnames.csv \| rename my_hostname as host ... by pavanae Builder in Splunk Search 09-14-2017 0 5	0	5
How do I resolve a warning about incomplete metadata results (after 100000+ entries)? How to resolve the warning "Metadata results may be incomplete: 100000 entries have been received from all peers , an... by pavanae Builder in Splunk Search 09-14-2017 1 4	1	4
Key-value pair extraction -- regex help We have some snmp data and want to extract the data as a key-value pair Sample var.12345.5.5 = INTEGER: 10 myTag::v... by koshyk Super Champion in Splunk Search 09-14-2017 0 2	0	2
Is it possible to divide results into buckets of varying sizes? I'd like to be able to provide a chart that divides data into sets (buckets) of different sizes. The underlying sear... by Glenn Builder in Splunk Search 09-14-2017 3 4	3	4
Append * to the end of values in a multivalue input I have created a multivalue parser from suggestions in the Splunk answers in the following form: [stats count \| eval... by JeffBothel Explorer in Splunk Search 09-14-2017 0 4	0	4
Tried to add a search peer: Error while sending public key to search peer: Connection closed by peer (attempting 1 Indexer, +1 SH setup) Tried the Following the Instructions from Splunk 1. Log into Splunk Web on the s... by Jarohnimo Builder in Splunk Search 09-13-2017 0 3	0	3
Search to see which forwarders reported in the previous 24 hours or if there is a delay in logs? Hi there, is there any query to find out the forwarders which are reporting for last 1 day or f there is a delay in... by kteng2024 Path Finder in Splunk Search 09-13-2017 0 3	0	3
How do I dynamically set earliest from subsearch? Hi folks, been all over this site and google, not finding a working solution. I'm trying to perform a search using a... by richarddicaire Path Finder in Splunk Search 09-13-2017 0 5	0	5
Creating a transposed table in conjunction with stats command (index=geniachip AND (geniaComplete.flag OR "DVT ready" OR "transfer complete for all banks" OR "lz4.complete*" OR "O... by byu168168 Path Finder in Splunk Search 09-13-2017 0 3	0	3
How do you set a default maximum data transfer rate? Dear Splunkers, is there a maximum KB/s of traffic a forwarder sends to the indexer? I mean is there a limit you can... by jan_wohlers Path Finder in Splunk Search 09-13-2017 1 5	1	5
How to get earliest datetime I have a field which contains first_found_date and due to some reason it keeps on changing for some of the assets. E... by poojak2579 Path Finder in Splunk Search 09-13-2017 0 5	0	5
Is there a forensic-type report that handles AD user account properties for PCI and SSAE compliance? Hello, I'm looking for a way to track total property changes within an AD user's account. As an example, per PCI an... by dhaertel Path Finder in Splunk Search 09-13-2017 0 3	0	3
Search help -- my search is inaccurately showing if hosts have been online in the past 24 hours. I have a query as follows \| inputlookup ABCD \| search Forward="Yes" \| table Region,IPHost, ip_address \| rename Re... by pavanae Builder in Splunk Search 09-13-2017 0 7	0	7
How to preserve order of json array in search results? We are on Splunk 6.2.1 We have logging raw json including 'stack_trace' as a json array like this: {"exception_clas... by rgsage Path Finder in Splunk Search 09-13-2017 1 2	1	2
How to rearrange table by values in a column So I have the following data as output statistics from a search: User Group Number Andy A ... by andrewhlui Explorer in Splunk Search 09-13-2017 0 5	0	5
Average of web requests blocked - span of 10 minutes Hi mates, I'm trying to get the most 10 IP addresses with blocked web requests during a month, but the threshold sho... by rookie507SL New Member in Splunk Search 09-13-2017 0 2	0	2
How do time based lookups apply user time zone? I have a time based lookup set up with a lookup file containing time values of full days, such as 2017-08-14 (with a ... by jeffland SplunkTrust in Splunk Search 09-13-2017 2 12	2	12
Stats values Into timechart -- I can't get timechart to work Hi, I wonder whether someone could help me please. I've put together this query: \| multisearch [ search `frontenda_... by IRHM73 Motivator in Splunk Search 09-13-2017 0 7	0	7
Trying to extract these three fields from XML using regex Hi! I can not extract three fields from xml using regex. Please tell me how it can be done <VULN number="MP-413771" ... by sphc Explorer in Splunk Search 09-13-2017 0 3	0	3
How can I rearrange the columns of my search in this specific order? I want my to rearrange the columns of my query in a particular order as shown below ,but due to dates (01-jun-2017) ,... by srikarbaswa446 New Member in Splunk Search 09-13-2017 0 2	0	2
How can I create the same fields with different values within the same event? I need to extract cveid, cvss, vulnerability number, etc.. here is my log: ...... cveid="1234" cvss= "abcd" .......... by sphc Explorer in Splunk Search 09-13-2017 0 5	0	5
Search to check whether keys are matching I have the below expression and which is a keys and i want to check whether the same keys are matching so help me in ... by DataOrg Builder in Splunk Search 09-13-2017 0 1	0	1
Change color of pie chart based on percentage automatically I want to change color of slices of pie chart based on the percentage values. slice that have highest percentage shou... by isha_rastogi Path Finder in Splunk Search 09-13-2017 0 11	0	11
Set zero value if there is nothing found in the search Hi, I'm running Splunk 6.6 and I like to set something like a "default" value in the case that there was nothing fou... by bosch_softtec Path Finder in Splunk Search 09-13-2017 0 2	0	2
Regex to extract from start until a specific character I have a test field in a CSV called description: Completed changes are not shown as complete in channels for a while ... by Sukisen1981 Champion in Splunk Search 09-13-2017 0 10	0	10