Splunk Search

Community Activity

How to write a regular expression to extract this field from my sample sysmon log? I am cannot quite get the regex working that I am looking for. I want to extract AcroRd32.exe Here is the sample tex... by kinkster Explorer in Splunk Search 06-13-2017 0 9	0	9
A single event has two dates. How do I count the number of days excluding weekends and holidays between these two dates? A single event has two dates. How do I count the number of days excluding weekends and holidays between these two dat... by ahallak2016 Explorer in Splunk Search 06-13-2017 0 7	0	7
regex help! How to extract the IP OR hostname from the field "source"? source=/opt/var/log/splunk/ciscoasa/11.12.22.345/2017_06_... by kiran331 Builder in Splunk Search 06-13-2017 0 3	0	3
change hostname in data summary hi i have problem in splunk.our company has firewall and the logs of firewall is sending to splunk,i want to change t... by khanlarloo Explorer in Splunk Search 06-13-2017 0 3	0	3
i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. \| rex field=ER mode=sed "s/Modified\S+//g " Extesnded value Associaated With destiny: "LineIces" - "Actio1n Cod2e"; Modified: Extends Aribute - "Action"; Old Val... by DataOrg Builder in Splunk Search 06-13-2017 0 4	0	4
i want to ignore the text before modify and want to text after that. i want to pick from the first modify present and want entire text. it should not start from 2nd modify if present Ex : hello how are you. pls modify the request and update. modify request cant be done and failed. by DataOrg Builder in Splunk Search 06-13-2017 0 1	0	1
Problems with concurrent searches When I perform a search it shows me the message of having exceeded the limit of concurrent searches, however in the j... by jechevarria New Member in Splunk Search 06-12-2017 0 6	0	6
Unable to sendmail to multiple recipients Unable to send email to multiple people. How to send to multiple email recipients ? index="customscripts" sourcetype... by ibob0304 Communicator in Splunk Search 06-12-2017 0 5	0	5
Reading in a list of username, counting them and create comparison to previous month I need to read in a file of exchange mailboxes and usernames/accounts, provide the total number of mailboxes, usernam... by johnquinn Explorer in Splunk Search 06-12-2017 0 6	0	6
Success vs Entry (Effectiveness interval problem) Hi! I'm having trouble creating effectiveness indicators (focused on the end user) because some cases begin at the ... by cttorres Explorer in Splunk Search 06-12-2017 0 4	0	4
ESA field extraction using regex! Hi How to extract the field for the below sample ESA logs. Sun Jun 11 17:33:36 2017 Info: Double bounce: MID 112011... by kiran331 Builder in Splunk Search 06-12-2017 0 6	0	6
replacing parts inside string I had a field of this value nameSpaces = ["url1"] nameSpaces = ["url1", "url2"] I got rex to change ["url1", "ur... by exocore123 Path Finder in Splunk Search 06-12-2017 0 12	0	12
Regex a field into more fields For some reason the builtin field extractor is not working for me, and I am unable to successful create a .conf stanz... by packet_hunter Contributor in Splunk Search 06-12-2017 0 4	0	4
How to search a list of words from csv file (lookup) in specific index events I have a lookup table which contains only one column with hundreds of entries, now I would like to search every word ... by onkarkore1 Explorer in Splunk Search 06-12-2017 1 6	1	6
Handling XML Events With Embedded Carriage Returns I'm getting events from a device and on rare occasions the event data contains an embedded carriage return. I've tri... by jwhughes58 Contributor in Splunk Search 06-12-2017 0 3	0	3
Multiple line charts representing a single field for multiple hosts I have the log files of several hosts and wish to represent a single field CPU usage for each of them as a separate l... by AshimaE Explorer in Splunk Search 06-12-2017 0 3	0	3
Regex help involving double quote I have a whole bunch of these and I need what comes after ?desktop= and before the " - for this particular log I ne... by kmaron Motivator in Splunk Search 06-12-2017 0 13	0	13
Merge 2 columns into one I have a query that returns a table like below Component Hits ResponseTime Req-count Co... by premraj_vs Path Finder in Splunk Search 06-12-2017 0 3	0	3
Ignoring multiple values from field Brain must not be working today. This should be a simple one. I am trying to ignore multiple values from a field... T... by JoshuaJohn Contributor in Splunk Search 06-12-2017 0 1	0	1
Add count to user journey flow in Splunk App for Web Analytics Dear Community, I have a problem. I'm trying to add the count per bar to my user journey flow in "Splunk App for Web... by JohannesGmelin Path Finder in Splunk Search 06-12-2017 0 7	0	7
grouping by host I have to calculate the change of a field(xyz) over the past 6 hours on a per host basis. I have calculated the same ... by AshimaE Explorer in Splunk Search 06-12-2017 0 5	0	5
Compute row differences Hello everyone! I have a very simple result table that looks like this: _time ... by guilhem Contributor in Splunk Search 06-12-2017 1 7	1	7
Splunk Table UI - How to render this UI When i use table command to count the number of events and average response time of Component 1, i get table as below... by premraj_vs Path Finder in Splunk Search 06-12-2017 0 2	0	2
Reset map drilldown I have created map in dashboard. Initially a Bar chart appears having data of all states. Drill down on map is applie... by rvisj New Member in Splunk Search 06-12-2017 0 8	0	8
Comparison between Future date and current date I have a date field 'Start Time' in csv. I have to filter if date in this field is current week date or future week d... by dsiob Communicator in Splunk Search 06-11-2017 2 5	2	5