Splunk Search

Discussions

Thread Info

How to add a new field with constant value to table?

Hi, I'm trying to to add a new field with constant value to my table. The new field is "Action" when "B" is consta...

by Path Finder in

Including Search Run Time in Search Results

I'd like to be able to include the search run time in the search results. If we have two different searches and we ar...

by Engager in

Is there a way to disable a field extraction within a search, so that a different field extraction can be performed instead?

Hi, I have two different field extractions that i need to use. The 1st one is used all the time for my system and ...

by Communicator in

Append Non Matching Results to Lookup Table

Hi, I wonder whether someone could help me please. I'm trying to run a search, compare it against fields in a look...

by Motivator in

create if statment whose result will create a new field with a constant value?

Hi all, There is a way to create if statment whose result will create a new field with a constant value? For e...

by Path Finder in

How to make an alert if a result doesn't match?

Hello, I need your help!!! I want to make an alert if a search doesn't accomplish a certain result! Example: ...

by Path Finder in

How to edit my search to find error code counts from my XML data?

Splunk code to find Error description : index="inputfile" | rex "^(?P<reasoncode>[^\t]*)" | rex max_match=0 "<mes...

by Explorer in

How to specifiy incoming source type to a specific index?

I understand you have to modify the indexes.conf, props.conf, and transforms.conf inside of the $SPLUNK/etc/system/lo...

by Explorer in

How to edit my alert search to set a trigger condition based on field value?

Hi all, I am working on a search which triggers when the total failures by users is greater than 10 in last 30min...

by Path Finder in

How to generate a search that will combine my events based on user ID and transaction ID so that my end result will display just 2 events?

I have an event which contains user id, and two more events which contains user id (same), transaction id (different)...

by Communicator in

I have the IP address but need to search for what user is logged into that device. How would I go about doing that?

Brand new to Splunk...... I have about enough experience with it to spell it. I have been tasked with a set of IP add...

by New Member in

How to sort columns in chart with row-split

Hi, I need to graph data per Area split by WeekNumber: | chart Values by Area WeekNumber Both - Values and WeekNu...

by New Member in

Trouble with REX command on a multi-line event

Hello, I'm running a streamstats command that prints out a series of previously-searched events. There are often more...

by Explorer in

How to generate a search that will the display the count of two fields if the memory and CPU usage is greater than 80 per day?

Hi, I am trying to create a report that looks at two fields: mem and cpu It should display the count of mem and cp...

by Explorer in

How to REX an entire line if it contains a keyword

I want to REX an entire line if it contains a particular keyword. The event looks like this: 2017-03-08 10:34:34,0...

by Explorer in

How to display a table row that expands with more than one level?

I wonder if Splunk is able to display a table statistic with the following layout. Does anyone know? Thanks Catego...

by Communicator in

How To Use tstats with nested data models - getting empty results

I have a DataModel named "AccessLogs" and it has a DataSet hierarchy that looks like this RootSearchDS // sourcetype=...

by Explorer in

How to use regex determine whether a field is an IP address

I extracted a field named "apche_zhuji_sip", but the content is not accurate, some are not IP, how do I use regular e...

by Communicator in

Search Query returns only 50000 Events/Results List totally though total Events/Results are almost 56Lakh Events.

Hi Splunk Users, Observing an Issue while I try to Query the Splunk for Search Query returns only 50000 Events/R...

by Explorer in

If statement for earliest time

I have a search that needs to either snap to 7am ( -7h@d+7h) or 7pm ( -7h@d+19h) depending on whether the time of sea...

by Path Finder in

Add values to the end of table

Hi guys, Can you tell me if is it possible to add a values on fields to the end of a table to an other fields ...

by Path Finder in

Single Value Sparklines

Hi All, I've recently created a single value dashboard panel with % trend, and sparkline underneath showing the cu...

by Path Finder in

How do I handle fields with nothing between a delimiter on a rex field extraction?

Hello Splunkers, My problem is nearly similar to this one, only not spaces. https://answers.splunk.com/answers/369...

by Builder in

Problem with Cisco ASA search query (iplocation)

Hi, I have a search string that shows the top 20 security related events by country on my Cisco ASA. eventtype=...

by New Member in

How to write a search to determine a slow and low attack from authentication logs?

Hi Is there a way to determine a slow and low attack from authentication logs? I have a situation where I have to ...

by Builder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How to add a new field with constant value to table?

Including Search Run Time in Search Results

Is there a way to disable a field extraction within a search, so that a different field extraction can be performed instead?

Append Non Matching Results to Lookup Table

create if statment whose result will create a new field with a constant value?

How to make an alert if a result doesn't match?

How to edit my search to find error code counts from my XML data?

How to specifiy incoming source type to a specific index?

How to edit my alert search to set a trigger condition based on field value?

How to generate a search that will combine my events based on user ID and transaction ID so that my end result will display just 2 events?

I have the IP address but need to search for what user is logged into that device. How would I go about doing that?

How to sort columns in chart with row-split

Trouble with REX command on a multi-line event

How to generate a search that will the display the count of two fields if the memory and CPU usage is greater than 80 per day?

How to REX an entire line if it contains a keyword

How to display a table row that expands with more than one level?

How To Use tstats with nested data models - getting empty results

How to use regex determine whether a field is an IP address

Search Query returns only 50000 Events/Results List totally though total Events/Results are almost 56Lakh Events.

If statement for earliest time

Add values to the end of table

Single Value Sparklines

How do I handle fields with nothing between a delimiter on a rex field extraction?

Problem with Cisco ASA search query (iplocation)

How to write a search to determine a slow and low attack from authentication logs?

3 Ways to Make OpenTelemetry Even Better

What's New in Splunk Cloud Platform 9.2.2406?

Enterprise Security Content Update (ESCU) | New Releases

Splunk dashboard table panel with dynamic token

Notepad++ SPL syntax highlighting

Is there a way to add 3rd party python modules to ...

How to splunk api to get statistics in python

Some cloudwatch log collection errors