Splunk Search

Community Activity

How to add x-axis labels show on a timechart when data contains epoch time? Hi, I am still fairly new in Splunk as I just started last week. Any help is appreciated!! This is what i currently ... by Michellework New Member in Splunk Search 07-12-2017 0 3	0	3
Windows CPU by Process - How do I divide field value #1 by field value #2? I am trying to get a representation of the percentage of CPU used per windows process based on the amount of processo... by mightaswelby Explorer in Splunk Search 07-12-2017 0 4	0	4
Data masking HI , i want to masking the cookie value in the the log file i just write the regx but its not displaying the data bef... by svemurilv Path Finder in Splunk Search 07-12-2017 0 5	0	5
transaction calculate duration betweeen 2 events I'm trying to use transactions to generate a timeline of events where the events are grouped by an eventId I'm reci... by preben12 Communicator in Splunk Search 07-12-2017 1 8	1	8
Use Join but also display non matching datasets I'm currenty trying to combine data from our firewall and sysmon which is running on a testclient. I want to join the... by davidb89 Engager in Splunk Search 07-12-2017 0 4	0	4
How to Extract value from Source Field Hi, I want to Extarct Filed from Source file and Below are some Sorce file. /opt/si/logs/taopwssid1/admin/paas-cli... by saroj005 Engager in Splunk Search 07-12-2017 1 2	1	2
how to show 0 when no search result found after succeed with "Infected files:" \| rex field=_raw "Infected files: (?<Infected>\d*)" \| convert timeformat="%Y-%m... by cyberportnoc Explorer in Splunk Search 07-12-2017 0 5	0	5
moving rex to props and transforms not woking Hi, I am monitoring print events from windows event logs using WinEventLog:Microsoft-Windows-PrintService/Operationa... by sajeshpp Path Finder in Splunk Search 07-12-2017 0 13	0	13
Connect two points on map based on two coordinates Hello, I have this search: index=ip \| lookup list.csv pop as POP_A OUTPUTNEW LAT as LAT_A LON as LON_A \| lookup list... by ngerosa Path Finder in Splunk Search 07-12-2017 0 3	0	3
Using the like operator for raw text Hi Can someone help me with a query please. So I have a field called message which displays the following: "messag... by dadomor Engager in Splunk Search 07-12-2017 0 2	0	2
How to edit my search to find the time frame window with the least amount of events? Hi there, I am trying to return the top 3 results of three hour windows where an event is least likely to happen bas... by bamalone New Member in Splunk Search 07-12-2017 0 2	0	2
What is the best way to get the running average and standard deviations for external port connects? So I am looking at cisco asa logs and wondering what the best way method would be to create an alert when the number ... by packet_hunter Contributor in Splunk Search 07-11-2017 0 2	0	2
Extract data for last 3 months Hi All, I am searching from a csv lookup. The CSV contains fields --> 1. Reporting Month & Year -->17-Jan, 17-Feb, ... by aartivig289 Engager in Splunk Search 07-11-2017 0 1	0	1
How can I reset the "search timeframe" based on data in results? Is there any way to "reset" the "search timeframe" so that all the "commands that bin" will honor a new "search timef... by vbumgarner Contributor in Splunk Search 07-11-2017 0 4	0	4
How to create a line chart with 2 lines Hi, We have a Database query which runs on every 15 minutes and provide event results with a field by name NumOfOrd... by roopeshetty Path Finder in Splunk Search 07-11-2017 0 3	0	3
How to search for all Indexes and sort by amount indexed per day / license ? I'm trying to write a search where I can list all indexes in our Splunk environment, and ingestion rate per day. i.e.... by shandman Path Finder in Splunk Search 07-11-2017 0 2	0	2
restful call search Data format \|rest /services/authentication/users splunk_server=local \|stats count by updated in this search how could we get t... by svemurilv Path Finder in Splunk Search 07-11-2017 0 1	0	1
How to plot a line graph to display state change of machines based on timestamp? We have a list of machines in our system with their state change as On or Off along with timestamp. 2017-07-11 12:39... by rakes568 Explorer in Splunk Search 07-11-2017 0 2	0	2
Syntax for 'top x entries per y' I am trying to find the top 5 UrlDestHosts per IP address for the top 25 ip addresses. I have a search which returns ... by timbCFCA Path Finder in Splunk Search 07-11-2017 0 6	0	6
Compare unknown number of fields with previous values Hi all, This is a challenge.... I do have some basic SPL knowledge but I can't get my head around this one. I have a... by FrankSPL Path Finder in Splunk Search 07-11-2017 0 7	0	7
How to make regex not search specific fields? Basically, I want to perform a regex search for a number that is, for example, 50 digits long, but I know for sure th... by funghorn Explorer in Splunk Search 07-11-2017 0 7	0	7
Multi-line event and props.conf I've got something that is confusing me. I've got a file, /logs/oud_ds/audit, of raw events that looks like this #... by jwhughes58 Contributor in Splunk Search 07-11-2017 0 3	0	3
Search lookup for non-matching values I have the following search (MySearch), which is tied to an alert. index=exchange_smtp Context=authenticated OR EHL... by ldunzweiler Engager in Splunk Search 07-11-2017 0 1	0	1
Substring of URL in own field - remove everything prior to first / and everything after ? I am trying to pull out a substring from a field and populate that information into another field. Its a typical URL ... by Seenon01 Explorer in Splunk Search 07-11-2017 0 2	0	2
Comma separated field value, adding a carriage return Hi folks, I think this should be easy, but it is hard to search for the solution because the terms I'm using are bro... by jravida Communicator in Splunk Search 07-11-2017 0 10	0	10