Splunk Search

Ask a Question

Discussions

Thread Info

Difference between earliest -2d and earliest -2d@d?

Hello, Could someone please delineate the difference between these two earliest commands: earliest=-2d earli...

by Explorer in

How do I edit my regex to extract this field from my sample event?

Want to extract only /ubi-v2/api/scoresummary from the below mentioned event in a field. Rex used: `| rex "(?<rem...

by Communicator in

How do I get span=1m to work with eventstats in the same search?

This is my search so far. sourcetype="spam" |eventstats count as total|search block_code="*" |eventstats count as...

by Engager in

How to write the regex to extract numbers between two hyphens?

I have the following string 2016-02-17 field and I would like to extract the 02 between the hyphens. Does someone hav...

by Engager in

|metadata - Need results for Custom time range

|metadata type=hosts earliest=-1d latest=now This displays the overall eventcounts for the available hosts but no...

by Motivator in

How can I search IPs within the Rapid 7 App for Splunk Enterprise?

I'm trying to search for some IPs of interest within the Rapid 7 App for Splunk Enterprise. Is there a way to do that...

by Engager in

How to configure transforms.conf for different count values while not breaking current existing regexes that are working?

Is there a way to create a transforms for separate values while not breaking current regex instances that are working...

by Contributor in

How to use each value in a column to determine count of "success", "failure", or "error", then calculate the success percentage?

I have a search, something like this: search stuff | rex "extract cat" | rex "extract field2" | rex "e...

by Engager in

How to configure REGEX in a props.conf source stanza to match all sources except ones including "/splunk/"?

Hello, We would like to match all sources except the ones including /splunk/ in props.conf. Example: No match f...

by Path Finder in

How to edit my search to extract Splunk user accounts and the dates they were created?

Hi, I wonder whether someone may be able to help me please. I'm using the search below to extract the date when Sp...

by Motivator in

Using multiple searchTemplates in a dashboard, why is the search from the first panel being run in the second panel?

Hi, I wonder whether someone may be able to help me please. I've put together the following form. <form> ...

by Motivator in

Alternatives to left outer join on large dataset and processing inline logic ?

I have two searches with the result as displayed below. Here I want to find the service related to each activity base...

by New Member in

How can filter top search in a month with timeframe

Hello, How can i display latest dates of searches with time frame, I need to filter top search in a month, any opt...

by New Member in

How to search the owner of reports and dashboards?

A user no longer exists in Splunk, but their reports and dashboards are still there. Is there a search to fix this?

by New Member in

How do I write a search to replace an asterisk character in a string?

I want to replace the * character in a string with the replace command. How do I apply the * by escaping it, not to r...

by Communicator in

Adding Index-time field on intermediate forwarder

I need to trace the data from the originating forwarder through intermediate forwarders or directly onto indexers. I ...

by Communicator in

How can I compare the results of the same search by a particular date or day of the week/month?

How can I compare the result by a particular week or date for this search? sourcetype="rum" u=* |stats count,avg(t...

by New Member in

How to delete user in splunk?

Hi All, I need to remove users from splunk, which they are no longer exist in company but user is still exists in ...

by New Member in

Search Query For Time Difference

Hi All, My use case to find out 1st search user logon time in AD and same user logon time in 2nd search with his a...

by Path Finder in

How do I extract these 2 fields from my sample multiline event?

Hi Guys, I would like to be able to extract fields from the sample log below. In bold I have highlighted IP addres...

by Engager in

How to hide the search string from end users on drilldown of graphs/charts?

I would like to hide the SPL search query when we drill down on a chart or a graph. I tried MACRO's and saved sea...

by Explorer in

How to write a search to produce a table with specified fields based on certain tags found in results?

I want to build a table with different fields depending on the search result. If a certain tag or another tag is f...

by Path Finder in

How do I use my regular expression to extract values in a column?

I have the following search ... | stats dc() | transpose | which gives me this: column row 1 dc(ID) 273 dc(SBC)...

by Motivator in

How do I add the results from Search2 (last 5 minutes) to Search1 (last 30 days) with respect to differences in time ranges?

Hi there, I have two searches that work great independently, however, I now have a need to combine them both. The...

by New Member in

Opinions on Index Optimization

Hi, all. I'm trying to fix some optimization issues I'm having with Splunk indexes and wanted some input on a prop...

by Path Finder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Difference between earliest -2d and earliest -2d@d?

How do I edit my regex to extract this field from my sample event?

How do I get span=1m to work with eventstats in the same search?

How to write the regex to extract numbers between two hyphens?

|metadata - Need results for Custom time range

How can I search IPs within the Rapid 7 App for Splunk Enterprise?

How to configure transforms.conf for different count values while not breaking current existing regexes that are working?

How to use each value in a column to determine count of "success", "failure", or "error", then calculate the success percentage?

How to configure REGEX in a props.conf source stanza to match all sources except ones including "/splunk/"?

How to edit my search to extract Splunk user accounts and the dates they were created?

Using multiple searchTemplates in a dashboard, why is the search from the first panel being run in the second panel?

Alternatives to left outer join on large dataset and processing inline logic ?

How can filter top search in a month with timeframe

How to search the owner of reports and dashboards?

How do I write a search to replace an asterisk character in a string?

Adding Index-time field on intermediate forwarder

How can I compare the results of the same search by a particular date or day of the week/month?

How to delete user in splunk?

Search Query For Time Difference

How do I extract these 2 fields from my sample multiline event?

How to hide the search string from end users on drilldown of graphs/charts?

How to write a search to produce a table with specified fields based on certain tags found in results?

How do I use my regular expression to extract values in a column?

How do I add the results from Search2 (last 5 minutes) to Search1 (last 30 days) with respect to differences in time ranges?

Opinions on Index Optimization

Index This | Divide 100 by half. What do you get?

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

Splunk and Fraud

Splunk Data Export

Using splunk-sdk in user-defined functions in Spar...

Verification of SAML assertion using IDP's cert fa...

ジョブを消しても復活する現象について

splunk threat intelligence taxii data