Splunk Search

Community Activity

How to search my Sonicwall logs for multiple values for the same field? Very much a newb looking to get some basic information from my Sonicwall logs. Setting up the search using multiple c... by Rockn New Member in Splunk Search 07-29-2016 0 2	0	2
How to search a specific user's internet activity for a certain time range? (websites visited, search history, timestamps) I am trying to complete a request for a specific employees internet search history. I need to specify a date range, l... by RobertKepner New Member in Splunk Search 07-29-2016 0 7	0	7
Why do search results return nothing on a calculated check? I have a summary index that is holding lead information. One of the data points I created was the numeric day the lea... by jsilverbears Path Finder in Splunk Search 07-29-2016 0 3	0	3
Should you specify or not specify the index in your search? What are everyone's thoughts on whether you should or should not specify the index in your search? Is sourcetype=val... by sjaworski Communicator in Splunk Search 07-29-2016 0 5	0	5
Count Sourcetype by Day In 6.4.2 version, when i try to count the integrated volume by sourcetype last day for example with this search : ea... by laberthelemy Engager in Splunk Search 07-29-2016 0 7	0	7
Getting duplicate rename fields error after upgrade from 6.3.0 to 6.4.2 The following search worked prior to upgrade: \| stats sparkline count dc(sourcetype) as sourcetype last(_raw) as las... by bandit Motivator in Splunk Search 07-29-2016 0 2	0	2
Are there recommendations on teaching users how to get current data from reports without hitting concurrent search limits? A ticket has come across my desk today where a customer is getting different results from different search heads for ... by jamesoconnell Path Finder in Splunk Search 07-29-2016 0 8	0	8
Does lookup command support OR Boolean operation? Hello, I have events in index 1 and I have lookup table 1 created from a CSV file. I want to lookup events from index... by vpao Engager in Splunk Search 07-29-2016 0 1	0	1
left join multivalue hi, i try to use left join to match between two index. index="myfirst_Index" \| rex max_match=0 field=multivalu... by sfatnass Contributor in Splunk Search 07-29-2016 0 5	0	5
How to include all rows from a lookup? Hi folks, newbee here, I'm trying to do this: \| stats values(duration) as DaysSinceLastAccess, count(duration) as Ac... by yma8000 New Member in Splunk Search 07-29-2016 0 1	0	1
Compare time of the output of the query Hi All I am trying to compare the result of the query. In am getting this result from my query Hostname date time ... by Anshumaan12 New Member in Splunk Search 07-29-2016 0 4	0	4
Universal Forwader Regex - no special field Hey Guys, any chance to set a blacklist entry in the universal forwarders input.conf for not sending events where in... by sdf5496d8f New Member in Splunk Search 07-29-2016 0 2	0	2
How to calculate Weighted Average After the base search such as: ...... \| stats sum(r1) as t_r1 sum(r2) as t_r2 sum(duras) as total_dura c(member) ... by tac24 New Member in Splunk Search 07-29-2016 0 2	0	2
How to write a search to show events that do not meet transaction requirements? Hello, I am trying to find a way to show events which are not meeting transaction requirements. So of course I can't... by Fleshwriter Explorer in Splunk Search 07-29-2016 0 4	0	4
[hope someone could help me!] How can reduce records in each row in splunk table. Hi, I was preparing a dashboard but i have some problems while generating the table. I am using sort and stats to gr... by jujis008 Explorer in Splunk Search 07-28-2016 0 2	0	2
Is there a way to do calculation on streamstats values? Hi folks, newbie here, trying to use Splunk to do some stuff... I have a search that ends like below: \| table DaysS... by yma8000 New Member in Splunk Search 07-28-2016 0 2	0	2
How to set the x-axis limits of a line chart? I am trying to display a timechart on a line graph. The timechart looks back 24 hours to find specific events. My iss... by pschellen New Member in Splunk Search 07-28-2016 0 2	0	2
Average load of universal forwarder and heavy forwarder Hello Splunkers, What is the average CPU/memory usage of a universal forwarder and heavy forwarder ? ( The average f... by DavidHourani Super Champion in Splunk Search 07-28-2016 0 2	0	2
Fetching data fro a limited time in to csv for lookup Hi All I am trying to schedule a job that will run every day to pull data of last 30 days into a csv file for lookup... by nirmalya2006 Path Finder in Splunk Search 07-28-2016 0 2	0	2
How to rename a field that was recently extracted? I recently extracted a few fields such as GBPS and now I would like to rename this particular field Bps. Thank You, ... by UsualSuspect7 Engager in Splunk Search 07-28-2016 0 2	0	2
How to search the average percentage of two different stats and display both on the same timechart? I'm having trouble displaying the count of 400-499 errors as 1 series on a timechart, and 500-599 errors as a separat... by bgeshk Engager in Splunk Search 07-28-2016 0 1	0	1
How do I extract this date time field from my sample data using rex? I used this search, but it is not extracting the date time field properly. I will use this date time as a common fiel... by cyberportnoc Explorer in Splunk Search 07-28-2016 0 2	0	2
How to search for dashboards and reports created by a specific user/owner? Hi Team, I was looking for reports, searches, saved searches, and Dashboards created by specific users/owners. Some ... by vinodsinha Explorer in Splunk Search 07-28-2016 1 9	1	9
How to replace URLs in multivalue fields in my logs with values from a CSV lookup file? Hi. I have a lookup which contains a list of URLs and 3 more fields loaded from a CSV file: Example: URL, value1, ... by Dosambela1 New Member in Splunk Search 07-28-2016 0 4	0	4
Splunk and QRadar integration Hello, I am interested in examples of integration of Splunk as data source to QRadar. May be somebody has any? What ... by andrey2007 Contributor in Splunk Search 07-28-2016 1 7	1	7