Splunk Search

Community Activity

Re-apply extraction during search time for access_combined_wcookie data source Is there anyway to apply access_combined_wcookie extraction to some historical data during search time? Some of the d... by etam New Member in Splunk Search 05-18-2017 0 3	0	3
How to determine how long a search will run for? I've been waiting for over an hour and my search is still running with over 50 million events so far. I'm tempted to... by bayman Path Finder in Splunk Search 05-18-2017 0 2	0	2
where and eval clause does not work with "AND" condition? Firstly, with below search, there are events returned: \|from datamodel foo.fooo \|search Counterparty=abc Transaction... by leonjxtan Path Finder in Splunk Search 05-18-2017 0 6	0	6
stats on transaction Hello, I wonder about how can I do stats operation like counting of something inside of a transaction? I have a tra... by psobisch Path Finder in Splunk Search 05-18-2017 0 5	0	5
How to search for a user and then be able to see the computer he/she is logging into? How would i search for a user and then be able to see the computer he/she is logging into? by whitt New Member in Splunk Search 05-18-2017 0 3	0	3
what does the coalesce and eval in my query do? Could anyone explain what does the below search string means ? \| eval fieldA=coalesce(abc, "def") by pavanae Builder in Splunk Search 05-18-2017 0 3	0	3
Sparkline and Trend Indicator splunk Hi, I did Sparkline and Trend Indicator splunk as compared to lastweek. In the result it showing as 92 means in 2 d... by dchalasani Path Finder in Splunk Search 05-18-2017 0 6	0	6
How can i concatenate fields in my data then compare? I am trying to find problems created by imaged systems running Alertus software. Scenario: Client checks into Alertu... by mauricio_sandov Explorer in Splunk Search 05-18-2017 0 4	0	4
My extracted field contains special characters in extracted value. How can I replace it with actual string value? Hi, My extracted field contains some special characters instead of actual string. For ex: Email_Address is the fi... by santosh_hb Explorer in Splunk Search 05-18-2017 0 2	0	2
How to combine multiple fields? I have multiple fields with the name name_zz_(more after this) How would I be able to merge all of the like tests in... by zkenaga New Member in Splunk Search 05-18-2017 0 6	0	6
eval searchmatch command OR if command Hi, I need some help. I have two fields that mark the status alert, PROBLEM and OK, I'm trying to compare them with t... by joseag New Member in Splunk Search 05-18-2017 0 3	0	3
Do you have a better way to monitor brute force attacks on Linux Servers? This is the Linux system's secure log（/var/log/secure）。I tried to crack the user and password to login SSH . now,I e... by xsstest Communicator in Splunk Search 05-18-2017 0 7	0	7
limiting error per event Hi, I am new to splunk and would like guidance about how to only count 1 occurrence of the word ERROR per event. ex... by cloud111 New Member in Splunk Search 05-18-2017 0 2	0	2
How to generate a search for new events based on index time not event timestamp? I want to build a system where an external event consumer periodically pulls newly indexed events from Splunk on a sc... by techols New Member in Splunk Search 05-18-2017 0 3	0	3
Compute time difference between events I have events like Event EndDateTime Launch 2017-05-16 13:00:00 . . . Open 2017-... by pranaynanda Path Finder in Splunk Search 05-18-2017 1 15	1	15
Lookup in splunk I want to use lookup in splunk . I am very new to lookup command . I have uploaded a csv file , suppose named lookupf... by loveforsplunk Explorer in Splunk Search 05-18-2017 0 3	0	3
Pleasse help me with IF then ELSE condition in search query If my search result has any count I want to append my search with OUTPUTCSV command else null. Something like if Job... by ankitgupta1700 New Member in Splunk Search 05-18-2017 0 1	0	1
How to search my JSON data to output Name, Sum(items_sold), and grouped by Name? I've following JSON format data...below is one sample record. I'm looking for output in the format [ name , sum(items... by ronak Path Finder in Splunk Search 05-18-2017 2 4	2	4
extract a string into readable datetime format Hi, I have string in a format as "YYYYMMDD.HHMM" i.e. 20140120.1815 I want to display this in any readable date ti... by harshal_chakran Builder in Splunk Search 05-18-2017 1 8	1	8
Issue with strptime and strftime I have a time input like below, Mon Jul 13 09:30:00 PDT 2015 \| eval human_readable_time= strftime(strptime(my_time... by deepak312 Explorer in Splunk Search 05-18-2017 1 2	1	2
How to filter a multivalue field so it returns results containing 3 or more values? Hello, thanks in advance for the help. I'd like to filter a multivalue field to where it will only return results tha... by cm22486 Path Finder in Splunk Search 05-17-2017 1 8	1	8
Correlate most recent event ‘a’ with event ‘b’ I have a need to pull a field from the most recent event type ‘a’ and add it to event type ‘b’ for those records with... by larryp Explorer in Splunk Search 05-17-2017 0 7	0	7
Rounding to -2 works but not -3? Working on a search that will monitor when the searches that populate a summary index run and I'm needing to round th... by kearaspoor SplunkTrust in Splunk Search 05-17-2017 0 5	0	5
Flood Splunk with test data to performance test real time dashboards and to war game Hi, I want to flood splunk with a high number of test data to be able to identify flaws in the current alerting and ... by neleisla New Member in Splunk Search 05-17-2017 0 2	0	2
Can you force the transaction command to keep duplicate entries in a multivalue field output? I have a search using the transaction command that returns the following (as a single transaction, not as separate ev... by jaredswarren200 Engager in Splunk Search 05-17-2017 1 3	1	3

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Index This | What has goals but no motivation?

June 2026 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Splunk Search

Re-apply extraction during search time for access_combined_wcookie data source

How to determine how long a search will run for?

where and eval clause does not work with "AND" condition?

stats on transaction

How to search for a user and then be able to see the computer he/she is logging into?

what does the coalesce and eval in my query do?

Sparkline and Trend Indicator splunk

How can i concatenate fields in my data then compare?

My extracted field contains special characters in extracted value. How can I replace it with actual string value?

How to combine multiple fields?

eval searchmatch command OR if command

Do you have a better way to monitor brute force attacks on Linux Servers?

limiting error per event

How to generate a search for new events based on index time not event timestamp?

Compute time difference between events

Lookup in splunk

Pleasse help me with IF then ELSE condition in search query

How to search my JSON data to output Name, Sum(items_sold), and grouped by Name?

extract a string into readable datetime format

Issue with strptime and strftime

How to filter a multivalue field so it returns results containing 3 or more values?

Correlate most recent event ‘a’ with event ‘b’

Rounding to -2 works but not -3?

Flood Splunk with test data to performance test real time dashboards and to war game

Can you force the transaction command to keep duplicate entries in a multivalue field output?

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation