Splunk Search

Community Activity

Metadata fields of custom search command Hi guys, could you give me a documentation of the metadata fields of the custom search command? Im searching for som... by ays7abt New Member in Splunk Search 05-18-2017 0 3	0	3
Writing a search that will catch sourcetypes that have logged in x amount of time We are wokring on coming up with a methd to detect data that stops coming in based on sourcetype. I believe I will wa... by brent_weaver Builder in Splunk Search 05-18-2017 0 3	0	3
Re-apply extraction during search time for access_combined_wcookie data source Is there anyway to apply access_combined_wcookie extraction to some historical data during search time? Some of the d... by etam New Member in Splunk Search 05-18-2017 0 3	0	3
How to determine how long a search will run for? I've been waiting for over an hour and my search is still running with over 50 million events so far. I'm tempted to... by bayman Path Finder in Splunk Search 05-18-2017 0 2	0	2
where and eval clause does not work with "AND" condition? Firstly, with below search, there are events returned: \|from datamodel foo.fooo \|search Counterparty=abc Transaction... by leonjxtan Path Finder in Splunk Search 05-18-2017 0 6	0	6
stats on transaction Hello, I wonder about how can I do stats operation like counting of something inside of a transaction? I have a tra... by psobisch Path Finder in Splunk Search 05-18-2017 0 5	0	5
How to search for a user and then be able to see the computer he/she is logging into? How would i search for a user and then be able to see the computer he/she is logging into? by whitt New Member in Splunk Search 05-18-2017 0 3	0	3
what does the coalesce and eval in my query do? Could anyone explain what does the below search string means ? \| eval fieldA=coalesce(abc, "def") by pavanae Builder in Splunk Search 05-18-2017 0 3	0	3
Sparkline and Trend Indicator splunk Hi, I did Sparkline and Trend Indicator splunk as compared to lastweek. In the result it showing as 92 means in 2 d... by dchalasani Path Finder in Splunk Search 05-18-2017 0 6	0	6
How can i concatenate fields in my data then compare? I am trying to find problems created by imaged systems running Alertus software. Scenario: Client checks into Alertu... by mauricio_sandov Explorer in Splunk Search 05-18-2017 0 4	0	4
My extracted field contains special characters in extracted value. How can I replace it with actual string value? Hi, My extracted field contains some special characters instead of actual string. For ex: Email_Address is the fi... by santosh_hb Explorer in Splunk Search 05-18-2017 0 2	0	2
How to combine multiple fields? I have multiple fields with the name name_zz_(more after this) How would I be able to merge all of the like tests in... by zkenaga New Member in Splunk Search 05-18-2017 0 6	0	6
eval searchmatch command OR if command Hi, I need some help. I have two fields that mark the status alert, PROBLEM and OK, I'm trying to compare them with t... by joseag New Member in Splunk Search 05-18-2017 0 3	0	3
Do you have a better way to monitor brute force attacks on Linux Servers? This is the Linux system's secure log（/var/log/secure）。I tried to crack the user and password to login SSH . now,I e... by xsstest Communicator in Splunk Search 05-18-2017 0 7	0	7
limiting error per event Hi, I am new to splunk and would like guidance about how to only count 1 occurrence of the word ERROR per event. ex... by cloud111 New Member in Splunk Search 05-18-2017 0 2	0	2
How to generate a search for new events based on index time not event timestamp? I want to build a system where an external event consumer periodically pulls newly indexed events from Splunk on a sc... by techols New Member in Splunk Search 05-18-2017 0 3	0	3
Compute time difference between events I have events like Event EndDateTime Launch 2017-05-16 13:00:00 . . . Open 2017-... by pranaynanda Path Finder in Splunk Search 05-18-2017 1 15	1	15
Lookup in splunk I want to use lookup in splunk . I am very new to lookup command . I have uploaded a csv file , suppose named lookupf... by loveforsplunk Explorer in Splunk Search 05-18-2017 0 3	0	3
Pleasse help me with IF then ELSE condition in search query If my search result has any count I want to append my search with OUTPUTCSV command else null. Something like if Job... by ankitgupta1700 New Member in Splunk Search 05-18-2017 0 1	0	1
How to search my JSON data to output Name, Sum(items_sold), and grouped by Name? I've following JSON format data...below is one sample record. I'm looking for output in the format [ name , sum(items... by ronak Path Finder in Splunk Search 05-18-2017 2 4	2	4
extract a string into readable datetime format Hi, I have string in a format as "YYYYMMDD.HHMM" i.e. 20140120.1815 I want to display this in any readable date ti... by harshal_chakran Builder in Splunk Search 05-18-2017 1 8	1	8
Issue with strptime and strftime I have a time input like below, Mon Jul 13 09:30:00 PDT 2015 \| eval human_readable_time= strftime(strptime(my_time... by deepak312 Explorer in Splunk Search 05-18-2017 1 2	1	2
How to filter a multivalue field so it returns results containing 3 or more values? Hello, thanks in advance for the help. I'd like to filter a multivalue field to where it will only return results tha... by cm22486 Path Finder in Splunk Search 05-17-2017 1 8	1	8
Correlate most recent event ‘a’ with event ‘b’ I have a need to pull a field from the most recent event type ‘a’ and add it to event type ‘b’ for those records with... by larryp Explorer in Splunk Search 05-17-2017 0 7	0	7
Rounding to -2 works but not -3? Working on a search that will monitor when the searches that populate a summary index run and I'm needing to round th... by kearaspoor SplunkTrust in Splunk Search 05-17-2017 0 5	0	5