Splunk Search

Community Activity

Is it possible to use a search value or a token in the outputlookup name? Hi! Is it possible to pass into lookup's name created by outputlookup command a token or a search value? Smth like ... by iKate Builder in Splunk Search 07-07-2016 1 2	1	2
How to dynamically fill null values with the last known field value based on the results of search? I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known... by jtuni Engager in Splunk Search 07-07-2016 0 4	0	4
How to edit my search with appendcols to alert on a 99% drop in logging from an app_pool? alt text I want an alert if an application pool drops more than 99% of logging. (We have an issue where before a JVM ... by daniel333 Builder in Splunk Search 07-07-2016 0 2	0	2
How to gather a span of 5 Seconds for the Max EPS/TPS for a given Day Span? So I've posted a question a week ago regarding finding the max EPS for a timespan of a day. The query that I am using... by mgrimes New Member in Splunk Search 07-07-2016 0 8	0	8
How to search for two groups of field values? So I've got 2 different values I'm trying to use; letters & numbers. I want to be able to say If letters = a b or c... by arrowecssupport Communicator in Splunk Search 07-07-2016 0 1	0	1
What is the best way to join a row with rows in another table? Hi guys, I need to create a join with a row, and this row has multiple occurrences in another table. What is the bes... by Buscatrufas Path Finder in Splunk Search 07-07-2016 0 2	0	2
how to place commas in the output of a chart with columns that varies depending on the search how to place commas in the output of a chart with columns that varies depending on the search (example is date). Sam... by jonathan_yan5 Explorer in Splunk Search 07-07-2016 0 12	0	12
Why is my search with an eval case condition resulting in error "The expression is malformed. Expected )."? Hi All, When I execute the search below, it works fine: index="X" sourcetype="xx" "applicationCode: 123" "provider... by saradachelluboy Explorer in Splunk Search 07-06-2016 0 12	0	12
Why does my search with the mvexpand command never finalize? Hi guys, I have a problem with a table with 78k of register. I'm trying to expand a multivalue field, but the searc... by Buscatrufas Path Finder in Splunk Search 07-06-2016 0 2	0	2
Simple Json formatting into table Hi, I posted similar question earlier but I dont see it anymore as posted so reposting simplified version. json has ... by psable Explorer in Splunk Search 07-06-2016 0 3	0	3
How to search email logs for potential SPAM IOC via character count or special characters in a field? We are ingesting some of our email logs, and one of the fields is 'Subject'. I was wondering if anyone has created ... by jwalzerpitt Influencer in Splunk Search 07-06-2016 0 4	0	4
How do I extract a string of numbers using rex? I am dealing with a SQL log file. The field I am attempting to extract a string of numbers from is called 'SQL_BIND'.... by drewabrams New Member in Splunk Search 07-06-2016 0 3	0	3
Which is the best way to extract fields: field extractor, rex and eval commands, or props and transforms? Out of three ways to extract the fields, 1. BY using rex or eval command in search 2. By using field extractor opti... by vkakani60 Path Finder in Splunk Search 07-06-2016 0 3	0	3
How to use inputlookup to check if hosts in a CSV have been sending events to Splunk, then use eval to output "yes" or "no"? I want to inputlookup a CSV and search the hosts in the CSV to see if they have been reporting into Splunk, and then ... by sbattista09 Contributor in Splunk Search 07-06-2016 0 6	0	6
Wildcard in Lookup: Why am I getting error "The lookup table 'ssIdlookup' does not exist. It is referenced by configuration data_sourcetype"? All, I've seen this: https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html... by jwhughes58 Contributor in Splunk Search 07-06-2016 0 2	0	2
How do I map these fields from my sample log file at index or search-time? Hello. I have the following log file: 2016-06-28T10:08:08.152Z: pass proto tcp from 10.60.13.19:33099 to 10.193.44.1... by brent_weaver Builder in Splunk Search 07-06-2016 0 2	0	2
How to get a timechart for two values, but not sort by the split-by field alphabetically? I'm trying to plot to two separate values against another value like this timechart avg(x) avg(y) by z And I want ... by Skamensky Engager in Splunk Search 07-06-2016 0 3	0	3
Is it possible to extract a multivalue field from an already extracted field using fields.conf? I was wondering if it's possible to extract an mv field, from an already extracted field, using fields.conf? For exa... by tmarlette Motivator in Splunk Search 07-06-2016 0 1	0	1
Too many search jobs found in the dispatch directory + Keep on extending the job expiry time + Search artifacts not removed as per ttl I see too many search jobs present in the dispatch directory. Even after completing the jobs the expiry date keep on ... by splunker12er Motivator in Splunk Search 07-06-2016 1 3	1	3
Using dedup with multiple fields I can do the following separately, and I get the results I want. index="wineventlog" EventIdentifier="4624" \| dedup ... by tmontney Builder in Splunk Search 07-06-2016 0 12	0	12
My weekly timespan shows bins that are more than week boundaries I have set up an accelerated summary for a report with summary range of 1 month. I want to report summary by week. Wh... by tambepc New Member in Splunk Search 07-06-2016 0 3	0	3
How to extract and report on field values from a large CSV file in a directory on my Splunk server that is updated daily? I have a bit of a non-traditional application, but one which Splunk is pretty good at 95% of: There's a big file (ca... by apnetmedic Explorer in Splunk Search 07-06-2016 0 2	0	2
How can I track employees' website usage? Hello My firm currently has the dashboard below that shows top employees utilization and top sites visited. I am lo... by jVolpi New Member in Splunk Search 07-06-2016 0 2	0	2
Calculate percentage Hello, I have this query: index=dm counter="Short Equity Loop Duration" \| timechart span=1h max(Value),median(Value) ... by Rotema Path Finder in Splunk Search 07-06-2016 0 5	0	5
Why am I getting error "The events associated with this job have no sourcetype information" trying to extract a field in Hunk? I am trying to extract a field in Hunk, and I get the following error: The events associated with this job have no ... by jwalzerpitt Influencer in Splunk Search 07-06-2016 0 7	0	7

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

Is it possible to use a search value or a token in the outputlookup name?

How to dynamically fill null values with the last known field value based on the results of search?

How to edit my search with appendcols to alert on a 99% drop in logging from an app_pool?

How to gather a span of 5 Seconds for the Max EPS/TPS for a given Day Span?

How to search for two groups of field values?

What is the best way to join a row with rows in another table?

how to place commas in the output of a chart with columns that varies depending on the search

Why is my search with an eval case condition resulting in error "The expression is malformed. Expected )."?

Why does my search with the mvexpand command never finalize?

Simple Json formatting into table

How to search email logs for potential SPAM IOC via character count or special characters in a field?

How do I extract a string of numbers using rex?

Which is the best way to extract fields: field extractor, rex and eval commands, or props and transforms?

How to use inputlookup to check if hosts in a CSV have been sending events to Splunk, then use eval to output "yes" or "no"?

Wildcard in Lookup: Why am I getting error "The lookup table 'ssIdlookup' does not exist. It is referenced by configuration data_sourcetype"?

How do I map these fields from my sample log file at index or search-time?

How to get a timechart for two values, but not sort by the split-by field alphabetically?

Is it possible to extract a multivalue field from an already extracted field using fields.conf?

Too many search jobs found in the dispatch directory + Keep on extending the job expiry time + Search artifacts not removed as per ttl

Using dedup with multiple fields

My weekly timespan shows bins that are more than week boundaries

How to extract and report on field values from a large CSV file in a directory on my Splunk server that is updated daily?

How can I track employees' website usage?

Calculate percentage

Why am I getting error "The events associated with this job have no sourcetype information" trying to extract a field in Hunk?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation