Splunk Search

Community Activity

I need to set 24hours default search intervals for user role We have 3 custom roles (user, power user and admin) and i would like to set 24hours as default search interval or blo... by jayakumar89 Explorer in Splunk Search 04-05-2017 0 3	0	3
How to get duration of transactions within the earliest and latest time? Hi all, Below is how the data I have. currentDate user _time 2017-02-01 aaa 8:00:00 2017-02-01 aaa 9:12... by limalbert Path Finder in Splunk Search 04-05-2017 0 4	0	4
Is there a way to write a splunk query which displays our props.conf , transform.conf , indexes.conf configuarion as outputs I would like to see in props.conf how data parsing is done My query should return results stating sourcetype ... by nasamajh09 New Member in Splunk Search 04-05-2017 0 2	0	2
How to Display Each Event of User with "X" Number of Failed Logins Good morning, I have the following search: index=[my index] source=[my source] sourcetype=[my sourcetype] event=log... by SplunkLunk Path Finder in Splunk Search 04-05-2017 0 5	0	5
User has left the company, but audit shows failed logins every 15 minutes. How can I find the source of these failed attempts? Hello everyone, I have inherited shared responsibility for a Splunk instance. We recently had a user departure, and ... by grittonc Contributor in Splunk Search 04-05-2017 0 5	0	5
How can I tag or mark _internal events from different environments? We have a requirement to collect data from testing enclaves (that have copies of production devices) to our primary S... by sniderwj Explorer in Splunk Search 04-05-2017 0 4	0	4
Calculating data with multiple transactions per order Hi, I have the following data with the following columns, OrderNo, Transaction Start, Transaction Stop. I wrote a se... by timm747747 Path Finder in Splunk Search 04-05-2017 1 5	1	5
Merging search results into lookup file I am having lookup file with list of Jobs to be monitored. I want to create a table with the jobs name from lookup fi... by Kwip Contributor in Splunk Search 04-05-2017 0 2	0	2
Use inputlookup to find servers not reporting Here's the scenario: server102 has not reported data in the last 15 minutes. I want to use my inputlookup in conjunct... by hippe21 Explorer in Splunk Search 04-05-2017 0 10	0	10
Nedd regex help to use part of a filepath as source type I have a source of /var/log/opscode/desired_sourcetype/current. I need to get the part of the filename that is called... by brent_weaver Builder in Splunk Search 04-05-2017 0 6	0	6
How to correct timestamp parsing and field extraction of XML log? Hi, novice splunker here. I'm having an issue in getting all the timestamps correctly parsed from the DATE and TIME ... by user290317 Explorer in Splunk Search 04-05-2017 0 2	0	2
How to search a area based on a given lat/lon Hi, I have a requirement - the user will enter a lat,lon in the filter and expects Splunk to search the "nearby 10km... by meenal901 Communicator in Splunk Search 04-05-2017 0 1	0	1
Change the evaluation direction of streamstats? The streamstats last function is very close to a very important tool in my workflow; however, I would like it to eval... by keycoldstorage Explorer in Splunk Search 04-05-2017 1 4	1	4
Splunk 6.5.0: How to access the first row from the search result in a dashboard? Recently upgraded to Splunk 6.5.0. I am trying to access the first row from the search result in a dashboard. In vers... by adevi Explorer in Splunk Search 04-04-2017 1 7	1	7
How to get a count of stats list that contains a specific data? Hi all, How to get a count of stats list that contains a specific data? Data is populated using stats and list() com... by limalbert Path Finder in Splunk Search 04-04-2017 0 3	0	3
How to show non number values on y axis on a chart I have the following search and I would like to present instead of the 40 dummy values, the actual name of the field ... by matansocher Contributor in Splunk Search 04-04-2017 0 2	0	2
Comparing the firewall ip to the inputlook which contains the blacklisted ip and need to display the count and source Hi, I have a blacklisted inputlookup csv which contains 20000 blacklisted ip. I need to compare the inputlookup with... by renjujacob88 Path Finder in Splunk Search 04-04-2017 0 10	0	10
How to create a search to compare a lookup CSV file of blacklisted IPs with firewall logs? Hi All, I have a blacklisted IP CSV file (Placed in lookup folder of search(app)). I need to compare with firewall l... by sumit29 Path Finder in Splunk Search 04-04-2017 0 4	0	4
How to edit my transaction search so that it will only return grouped results? This seems like it would be easy to figure out through search but I'm coming across a dead end. I have a transaction ... by EricLloyd79 Builder in Splunk Search 04-04-2017 0 5	0	5
Top10 in percent with lookup This is my first attempt to create a "bigger" splunk search. I tried it the last two weeks but am stuck now. Hopefull... by spotypoti1 Engager in Splunk Search 04-04-2017 0 4	0	4
How do I pull only specific status entries from a sourcetype at a given time? I have one source-type with column names srno for a ticket. Scenario: Ticket status gets updated per it's life cycle... by AShah_2 Engager in Splunk Search 04-04-2017 0 5	0	5
How to search files compressed using Snappy from virtual indexes? Hi all, I have a few files (containing syslog events) in my Hadoop HDFS compressed using Snappy, and I configured Sp... by chaychoong New Member in Splunk Search 04-04-2017 0 1	0	1
How to optimize my lookup search with large amounts of data? I'm currently collecting IoCs in terms of IPs and Domain names and want to run searches towards my historical log-dat... by JetteBra New Member in Splunk Search 04-04-2017 0 3	0	3
How can I calculate the term frequency for all the words in a field's values? I am trying to calculate some term frequency on the field. The field is defined as follow. rex field=_raw "Notes : (... by mhqssyh Explorer in Splunk Search 04-04-2017 1 5	1	5
Updating LookUp Table Data Externally - 'Auto-magically' I am wanting to create a process that will make it really simple and easy for my users to update their lookup table f... by rgcurry Contributor in Splunk Search 04-04-2017 3 6	3	6