Splunk Search

Community Activity

How to edit my search to create a table that shows number of attacks from each security device and summary ? Hey all, I'm trying to create table for SOC members that shows number of attacks from each security device + summary... by bugnet Path Finder in Splunk Search 04-19-2017 0 8	0	8
How to add a new field with constant value to table? Hi, I'm trying to to add a new field with constant value to my table. The new field is "Action" when "B" is constant... by bugnet Path Finder in Splunk Search 04-19-2017 0 8	0	8
Including Search Run Time in Search Results I'd like to be able to include the search run time in the search results. If we have two different searches and we a... by eepperman Engager in Splunk Search 04-19-2017 3 3	3	3
Is there a way to disable a field extraction within a search, so that a different field extraction can be performed instead? Hi, I have two different field extractions that i need to use. The 1st one is used all the time for my system and I'... by arrowecssupport Communicator in Splunk Search 04-19-2017 0 6	0	6
Append Non Matching Results to Lookup Table Hi, I wonder whether someone could help me please. I'm trying to run a search, compare it against fields in a lookup... by IRHM73 Motivator in Splunk Search 04-19-2017 0 5	0	5
create if statment whose result will create a new field with a constant value? Hi all, There is a way to create if statment whose result will create a new field with a constant value? For exemp... by bugnet Path Finder in Splunk Search 04-18-2017 1 2	1	2
How to make an alert if a result doesn't match? Hello, I need your help!!! I want to make an alert if a search doesn't accomplish a certain result! Example: index... by danielgp89 Path Finder in Splunk Search 04-18-2017 0 2	0	2
How to edit my search to find error code counts from my XML data? Splunk code to find Error description : index="inputfile" \| rex "^(?P<reasoncode>[^\t]*)" \| rex max_match=0 "<me... by x05311 Explorer in Splunk Search 04-18-2017 0 1	0	1
How to specifiy incoming source type to a specific index? I understand you have to modify the indexes.conf, props.conf, and transforms.conf inside of the $SPLUNK/etc/system/lo... by gingerpower121 Explorer in Splunk Search 04-18-2017 0 4	0	4
How to edit my alert search to set a trigger condition based on field value? Hi all, I am working on a search which triggers when the total failures by users is greater than 10 in last 30min. ... by guru865 Path Finder in Splunk Search 04-18-2017 0 3	0	3
How to generate a search that will combine my events based on user ID and transaction ID so that my end result will display just 2 events? I have an event which contains user id, and two more events which contains user id (same), transaction id (different... by nagarjuna280 Communicator in Splunk Search 04-18-2017 0 3	0	3
I have the IP address but need to search for what user is logged into that device. How would I go about doing that? Brand new to Splunk...... I have about enough experience with it to spell it. I have been tasked with a set of IP add... by TXITGUYII New Member in Splunk Search 04-18-2017 0 2	0	2
How to sort columns in chart with row-split Hi, I need to graph data per Area split by WeekNumber: \| chart Values by Area WeekNumber Both - Values and WeekNube... by lem New Member in Splunk Search 04-18-2017 0 4	0	4
Trouble with REX command on a multi-line event Hello, I'm running a streamstats command that prints out a series of previously-searched events. There are often more... by like2splunk Explorer in Splunk Search 04-18-2017 0 6	0	6
How to generate a search that will the display the count of two fields if the memory and CPU usage is greater than 80 per day? Hi, I am trying to create a report that looks at two fields: mem and cpu It should display the count of mem and cpu ... by mhassan24 Explorer in Splunk Search 04-18-2017 0 10	0	10
How to REX an entire line if it contains a keyword I want to REX an entire line if it contains a particular keyword. The event looks like this: 2017-03-08 10:34:34,067... by like2splunk Explorer in Splunk Search 04-18-2017 0 2	0	2
How to display a table row that expands with more than one level? I wonder if Splunk is able to display a table statistic with the following layout. Does anyone know? Thanks Catego... by splunkrocks2014 Communicator in Splunk Search 04-18-2017 0 2	0	2
How To Use tstats with nested data models - getting empty results I have a DataModel named "AccessLogs" and it has a DataSet hierarchy that looks like this RootSearchDS // sourcetyp... by theironcook Explorer in Splunk Search 04-18-2017 1 2	1	2
How to use regex determine whether a field is an IP address I extracted a field named "apche_zhuji_sip", but the content is not accurate, some are not IP, how do I use regular e... by xsstest Communicator in Splunk Search 04-18-2017 0 1	0	1
Search Query returns only 50000 Events/Results List totally though total Events/Results are almost 56Lakh Events. Hi Splunk Users, Observing an Issue while I try to Query the Splunk for Search Query returns only 50000 Events/Res... by dhsetty Explorer in Splunk Search 04-18-2017 0 7	0	7
If statement for earliest time I have a search that needs to either snap to 7am ( -7h@d+7h) or 7pm ( -7h@d+19h) depending on whether the time of sea... by mstark31 Path Finder in Splunk Search 04-18-2017 0 5	0	5
Add values to the end of table Hi guys, Can you tell me if is it possible to add a values on fields to the end of a table to an other fields Exem... by Abarny Path Finder in Splunk Search 04-18-2017 0 2	0	2
Single Value Sparklines Hi All, I've recently created a single value dashboard panel with % trend, and sparkline underneath showing the curr... by craigwilkinson Path Finder in Splunk Search 04-18-2017 1 2	1	2
How do I handle fields with nothing between a delimiter on a rex field extraction? Hello Splunkers, My problem is nearly similar to this one, only not spaces. https://answers.splunk.com/answers/36982... by lloydknight Builder in Splunk Search 04-17-2017 0 3	0	3
Problem with Cisco ASA search query (iplocation) Hi, I have a search string that shows the top 20 security related events by country on my Cisco ASA. eventtype=cisc... by madstylex New Member in Splunk Search 04-17-2017 0 4	0	4

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

How to edit my search to create a table that shows number of attacks from each security device and summary ?

How to add a new field with constant value to table?

Including Search Run Time in Search Results

Is there a way to disable a field extraction within a search, so that a different field extraction can be performed instead?

Append Non Matching Results to Lookup Table

create if statment whose result will create a new field with a constant value?

How to make an alert if a result doesn't match?

How to edit my search to find error code counts from my XML data?

How to specifiy incoming source type to a specific index?

How to edit my alert search to set a trigger condition based on field value?

How to generate a search that will combine my events based on user ID and transaction ID so that my end result will display just 2 events?

I have the IP address but need to search for what user is logged into that device. How would I go about doing that?

How to sort columns in chart with row-split

Trouble with REX command on a multi-line event

How to generate a search that will the display the count of two fields if the memory and CPU usage is greater than 80 per day?

How to REX an entire line if it contains a keyword

How to display a table row that expands with more than one level?

How To Use tstats with nested data models - getting empty results

How to use regex determine whether a field is an IP address

Search Query returns only 50000 Events/Results List totally though total Events/Results are almost 56Lakh Events.

If statement for earliest time

Add values to the end of table

Single Value Sparklines

How do I handle fields with nothing between a delimiter on a rex field extraction?

Problem with Cisco ASA search query (iplocation)

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation