Splunk Search

Discussions

Thread Info

How to generate a search that will target IP addresses with greater than 100 post requests as Spam?

We need to identify the unique IP addresses of the spammers who are generating more number of POST requests generatin...

by New Member in

Pie Chart max value vs active value

I want to create a pie chart that has a max value of 22000 (This is hard-coded in) then I have a variable list of Mac...

by Contributor in

Issue with splunk stop/restart command in CentOS 7.2

Hi All, Our distributed splunk setup contains a deployment server, an indexer cluster master, 3 peer indexers and ...

by Communicator in

i have to exclude particular host from this query?

| metadata type=hosts index=xx_prod| eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 180...

by Builder in

How to make field in splunk using the field inside the CSV file..??

why every input data from TCP/UDP, the field always inputted to the data inside, so the data did have field, caused t...

by New Member in

Why do I receive "Limit (50000 results) reached." Warning message ?

When I was searchng with the following query for one day, sourcetype=web_access | chart count by sourceIP The...

by Splunk Employee in

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is...

by Communicator in

How to select only unique events in a particular time interval with respect to host.

Hi Team, My search query return 100+ events out of which 60 events belong to host1 and remaining 40 events belong ...

by New Member in

how to merge data from different two source ?

my data is csv file My data below source = A1 field name = a1, b1, c1,... soruce = A2 field : a1, b2, c2,......

by New Member in

How to chart a list of key value pairs

Hi there, I am using Splunk's REST API Modular Input to input data from Apache Solr. Once a day a facet query is sent...

by Path Finder in

Joining fields from three different indexes and sourcetypes

I have three searches that I want to merge into one single table as search output. I will try to explain my case thro...

by Path Finder in

replacing and output

Hello all, I have the following search: index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP respon...

by Explorer in

Combining and comparing 2 date results

Hi Splunkers, I'm new to splunk and i'm working on a dashboard for a service/application. What i'm trying to do is...

by New Member in

Need help with REX and Panels

Hi, I am newbie to Splunk. Here's some of my sample logs, where I need to count the number of occurrences for each of...

by New Member in

Can find the string in event but count, timechart, where does not work

hi there, new to Splunk here..question: Event log: 4/14/2017 16:00:00 +0000, blah blah...., statusCode="'20'", sta...

by Communicator in

streamstats vs. tstats

Hi, I have a customer who is using streamstats to validate data is coming into Splunk. I recommended tstats, and d...

by Champion in

How to map every event which has a lat and long field?

I have 35 events. Each one has a lat and long field. How do I map each one of them to an individual point on a map? W...

by Contributor in

Can you expose an env variable as a field in events coming from that forwarder

I am trying to expose an environment variable and make it a field for events coming from a splunk universal forwarder...

by Path Finder in

How to generate a search to find a local account added to admin group within one hour?

How can I find if a local account/user has been created and then added to the admin/domain admin group within a span ...

by New Member in

Can I perform If-Then-Else logic within a search?

I have a field that I want to report on, but in some of my events, that field is missing (null) and so I'd like to us...

by Splunk Employee in

If function returning integers?

This code snippet is being used to calculate a time into a normal time in the H.M format. The numbers are something l...

by Explorer in

I am not being able to calculate time difference between two event codes that are 1100 and 13, and also i want to exclude the logs if the interval between these two codes are less than 15 seconds

Am trying below query but its not Working: index=* (sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Security)...

by Explorer in

How to find duration between multiple timestamps of different users?

Hi all, The boundary of the logs: date and user. Total logs is more than 1000 logs. How should I list the date?...

by Path Finder in

return command - exit (or return known value) if no results found

I have a search that is basically (there are actually 2 sub searches, but this makes it easier to understand): ind...

by Explorer in

Multiple values for table and values unique

Hi guys, Can you help me ? I need to do a table like this New date available | Origine date available ...

by Path Finder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How to generate a search that will target IP addresses with greater than 100 post requests as Spam?

Pie Chart max value vs active value

Issue with splunk stop/restart command in CentOS 7.2

i have to exclude particular host from this query?

How to make field in splunk using the field inside the CSV file..??

Why do I receive "Limit (50000 results) reached." Warning message ?

I have an event with status=0 status=0 status=0 .... I want if all status fields values are 0 then new_field value is "sucess " else new_field="failure"

How to select only unique events in a particular time interval with respect to host.

how to merge data from different two source ?

How to chart a list of key value pairs

Joining fields from three different indexes and sourcetypes

replacing and output

Combining and comparing 2 date results

Need help with REX and Panels

Can find the string in event but count, timechart, where does not work

streamstats vs. tstats

How to map every event which has a lat and long field?

Can you expose an env variable as a field in events coming from that forwarder

How to generate a search to find a local account added to admin group within one hour?

Can I perform If-Then-Else logic within a search?

If function returning integers?

I am not being able to calculate time difference between two event codes that are 1100 and 13, and also i want to exclude the logs if the interval between these two codes are less than 15 seconds

How to find duration between multiple timestamps of different users?

return command - exit (or return known value) if no results found

Multiple values for table and values unique

Splunk Smartness with Brandon Sternfield | Episode 3

Monitoring Postgres with OpenTelemetry

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

federated search in splunk

Notepad++ SPL syntax highlighting

Is there a way to add 3rd party python modules to ...

How to splunk api to get statistics in python

Some cloudwatch log collection errors