Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
Options
- Mark all as New
- Mark all as Read
- Float this item to the top
- Subscribe
- Bookmark
- Subscribe to RSS Feed
- Threaded format
- Linear Format
- Sort by Topic Start Date
Community Activity
 | Hello, All of the sudden we have some uncertain usage and trying to under the usage, here are the same lines .... ... by ananthan123 Explorer in Splunk Search 08-02-2017 0 1 | 0 | 1 | |
 | host=dummy | eval Pattern='arb_usg_mps%06' | where like (source,'%Pattern%') doesnot work . can you help what's wro... by smuderasi Explorer in Splunk Search 08-02-2017 0 2 | 0 | 2 | |
| | I am receiving the audit.log data from a universal forwarder running on a Linux box Hello below is my search string ... by jcorkey Explorer in Splunk Search 08-02-2017 0 1 | 0 | 1 | |
| | trying to search for when sudo user1 adds user2 to a group and I want to extract the name of the user2 that was added... by jcorkey Explorer in Splunk Search 08-02-2017 0 1 | 0 | 1 | |
 | Want to label sc_status <= 304 as Ok and sc_status >= 400 as Error and get the Ok and Error counts and table the clie... by lim2 Communicator in Splunk Search 08-02-2017 0 1 | 0 | 1 | |
| | I have a simple search query to look for vpn alerts index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="*karachi*... by ringbbg Engager in Splunk Search 08-02-2017 0 3 | 0 | 3 | |
 | I am very new to regex and I need to extract anything that comes between "device_" and "_1_vol" as volume name. "de... by jerin1982 New Member in Splunk Search 08-02-2017 0 4 | 0 | 4 | |
| | I want to create a timechart based on 5 tags. I have tried | timechart count by tag |regex tag="Working|No_Images|Oth... by sarahw3 Explorer in Splunk Search 08-02-2017 0 3 | 0 | 3 | |
| | I trying figure out what is the best search query for reporting on the count of different unique status. Following i... by t_splunk_d Path Finder in Splunk Search 08-02-2017 0 3 | 0 | 3 | |
| | Hi there, i try to buildup a firewall report: "sourcetype="firewall" action=blocked | table host src dest src_port ... by Aufex Explorer in Splunk Search 08-01-2017 0 3 | 0 | 3 | |
| | I am using the following splunk query to combine the events in to one transaction based on the referenceid. It work... by nkannan1984 Engager in Splunk Search 08-01-2017 0 3 | 0 | 3 | |
| | Hi, I'm trying to replace the host value using a field in the data. I tried to find any previous similar solution bu... by tamakg Path Finder in Splunk Search 08-01-2017 0 4 | 0 | 4 | |
| | THis is my query i want to display a time chart where it should display the last 4week ( week by week) in a time char... by rijinc Explorer in Splunk Search 08-01-2017 0 12 | 0 | 12 | |
| | Below is my search string: index=* host=* sourcetype="*" "usermod" "add" "to shadow group" | rex "^(?:[^'\n]*'){3}(?... by jcorkey Explorer in Splunk Search 08-01-2017 0 2 | 0 | 2 | |
| | What is the difference between with or without using OUTPUT parameter in lookup command. by ankithreddy777 Contributor in Splunk Search 08-01-2017 0 2 | 0 | 2 | |
| | I'm running a query for a 1 hour window. I need to group events by a unique ID and categorize them based on another ... by wormfishin Engager in Splunk Search 08-01-2017 1 4 | 1 | 4 | |
| | I need only amber and severe but i am not getting any result base search|eval responseTime=TransactionEndtime-Trans... by karthi2809 Builder in Splunk Search 08-01-2017 0 2 | 0 | 2 | |
| | | inputlookup kv_adani | where (tag="CHP.Device1.C1 BELT VW" ) | eval _time=tagtime |dedup _time| stats max(_time) a... by mintucs New Member in Splunk Search 08-01-2017 0 3 | 0 | 3 | |
| | I'm trying to sum a count from one event and group all of these summations by another events unique ID. The two event... by jl19 Explorer in Splunk Search 08-01-2017 0 4 | 0 | 4 | |
| | My current search (below) returns 3 results that has a field called "import_File" that contains either the text "Acco... by griffinpair Path Finder in Splunk Search 08-01-2017 0 5 | 0 | 5 | |
| | I have a collection of log data in an index and for the purposes of this discussion _time has the value I want. When ... by mumblingsages Path Finder in Splunk Search 08-01-2017 0 8 | 0 | 8 | |
| | I want to get IP addresses that is not duplicated There is two example search that A and B. A search is index=AV ... by superhm Explorer in Splunk Search 08-01-2017 0 4 | 0 | 4 | |
 | Hello, For same base query I am getting different distinct count result in timechart and stats for same time range (... by hemendralodhi Contributor in Splunk Search 07-31-2017 0 5 | 0 | 5 | |
| | Hi There, Can i please know the ports to be opened for heavy forwarder , indexer , universal forwarder ? by kteng2024 Path Finder in Splunk Search 07-31-2017 0 3 | 0 | 3 | |
| | Hello, Does anybody see something wrong with this regex ? \w{3}S*ALTSIP*\d{1,2} When testing against my host lis... by sylbaea Communicator in Splunk Search 07-31-2017 0 2 | 0 | 2 |
Get Started
Explore Essential Splunk Resources
Get Expert Help at Community Office Hours
Join the #search-help Slack channel
Get Expert Help at Community Office Hours
Join the #search-help Slack channel
Become An Expert
Top Labels
-
administration
3 -
alert action
3 -
alert condition
2 -
Analytics Workspace
2 -
authentication
1 -
chart
946 -
Classic dashboard
1 -
configuration
2 -
correlation search
1 -
count
1,007 -
Dashboard Studio
3 -
data
3 -
data model
1 -
development
6 -
distributed search
1 -
drilldown
1 -
email
1 -
eval
2,616 -
field extraction
2,022 -
fields
2,064 -
host
1 -
index
4 -
indexer
2 -
inputs.conf
1 -
intermediate forwarder
1 -
introduction
5 -
join
1,060 -
JSON
2 -
Linux
2 -
login
1 -
lookup
1,567 -
metadata
310 -
monitoring console
2 -
Other
188 -
panel
2 -
PDF
1 -
Python
1 -
regex
1,499 -
report acceleration
2 -
rex
1,250 -
SAML
1 -
saved search
5 -
scheduled search
4 -
scripted input
1 -
search
2 -
search head
3 -
search job inspector
685 -
search peer
1 -
simple XML
1 -
source
1 -
sourcetype
4 -
Splunk Web Framework
1 -
splunk-assist
1 -
splunkd
1 -
stats
3,566 -
subsearch
1,732 -
summary indexing
4 -
table
1,756 -
time
1 -
timechart
1,158 -
transaction
453 -
transforms.conf
1 -
troubleshooting
8 -
tstats
570 -
universal forwarder
5 -
using Splunk Cloud
2 -
using Splunk Enterprise
13 -
Windows
3
- « Previous
- Next »
Get Updates on the Splunk Community!
Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26
You use Splunk every day, come and help shape what's next.
Save Your Seat: Product-Focused Sessions at ...
Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM
The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...
Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas
Watch Now
Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas
Do you ever feel ...
Unanswered Topics
