Splunk Search

Community Activity

How to create Timechart count by ip by fw_name over time with trellis? I'm trying to build a search that displays the count of individual source IP addresses based on some criteria for eac... by nsnelson402 Explorer in Splunk Search 09-11-2023 0 8	0	8
How to create Search output replicating fields for other fields? Hi, I am trying to run a search and have tokens setting various search items, what I need is to create a search from ... by Cranie Explorer in Splunk Search 09-11-2023 0 5	0	5
Lookup in main search and subsearch - how to compare the results? Hello I want to find in subsearch autonomous_system for the IP address which I provided (in this example for 1.1.1.1... by dsms Engager in Splunk Search 09-11-2023 0 2	0	2
How to modify search result? I have asset management data that i need to create weekly reports. When i make query for the data like query below: i... by Akmal57 Path Finder in Splunk Search 09-11-2023 0 2	0	2
How to extract field using rex? Hi I need regular expression to extract field "timed out " by using below log .... "Description":"Job-2069950 Error ... by lucky Explorer in Splunk Search 09-11-2023 0 22	0	22
How to create Timechart when no splitby available? Hi Splunkers Need some help with a timechart query please. index=linux host IN (a,b,c,d,e) \| timechart span=1week eva... by dvg06 Path Finder in Splunk Search 09-10-2023 1 1	1	1
How to monitor smbv1 access on a domain via splunk ? Hi, We wonder how to monitor the smbV1 access in a domain. We are already enabled the eventcode 3000 log on windows l... by darphboubou Explorer in Splunk Search 09-10-2023 0 3	0	3
How to calculate the count for each field in the past 3 days? how to calculate the count for each field in the past 3 days. If the count for all 3 days is 0, and the count for to... by rick1168 Engager in Splunk Search 09-10-2023 0 5	0	5
How to perform lookup on inconsistent IPv6 format in CSV file from index? Hello,How to perform lookup on inconsistent IPv6 format in CSV file from index?For example:Index has collapsed format... by LearningGuy Motivator in Splunk Search 09-08-2023 0 9	0	9
Tstats: How to Include new field? I want to use the new search signature="test" in the below search. I don't want to add this new signature to the exis... by alex4 Loves-to-Learn Lots in Splunk Search 09-08-2023 0 0	0	0
How to perform search using 2 csv file to match 2 different values 1from first csv and other values from second csv? I have indexes created and i have 2 csv first is ipv6.csv and its has coulmn called ip and second csv is cmd.csv it c... by happylearning Loves-to-Learn in Splunk Search 09-08-2023 0 1	0	1
Search with limited time clause Hello all,I'm quite new to the wonderful world of Splunk, but not new to monitoring or IT in general. We are optimizi... by Bastiaan Engager in Splunk Search 09-08-2023 0 5	0	5
How to create a table with multiple fields? Hi, I want to create a table in the below format and provide the count for them.I have multiple fields in my index an... by suvi6789 Path Finder in Splunk Search 09-08-2023 0 3	0	3
How to store multiple values in one token and pass into another search I have "Product Brand" multiselect filter in a Splunk dashboard. It is a dynamic filter rather than static. I also ha... by itnewbie Explorer in Splunk Search 09-08-2023 0 2	0	2
Using stolen or forged user tickets (TGT) hi guys, I want to detect a service ticket request (Windows event code 4769) and one of the following corresponding e... by Dustem Explorer in Splunk Search 09-07-2023 0 6	0	6
How to use custom key field in tstats? I'm having trouble capturing the custom key - "UserKey_ABC" in the following script. With the following code, I'm n... by GaryZ Path Finder in Splunk Search 09-07-2023 0 3	0	3
Best tool in the toolkit to access and correlate multivalue fields Hi all, I've worked with multivalue fields in a limited capacity and I'm having trouble with a particular instance. G... by ft_kd02 Path Finder in Splunk Search 09-07-2023 0 1	0	1
Determined which host doesnt have a particular software installed index=xxxx sourcetype="Script:InstalledApps" DisplayName="Carbon Black Cloud Sensor 64-bit"I am trying to get the lis... by Olatundeny Engager in Splunk Search 09-07-2023 0 5	0	5
Why does "geom geo_us_states" search display a world map instead of North America map? Working my way through the Splunk e-learning offerings, I came across a lab exercise where the resulting query was ... by gl89 Engager in Splunk Search 09-07-2023 0 4	0	4
Convert seconds in days, hours and minutes? Hi, i have a duration in seconds and want to convert it to days, hours and minutes. The additional seconds should be ... by simon_b Path Finder in Splunk Search 09-07-2023 0 3	0	3
Need help with a splunk search with appendcols I am trying to get data from 2 indexes and combine them via appendcols.The search is index="anon" sourcetype="test1" ... by phularah Communicator in Splunk Search 09-07-2023 0 5	0	5
ldapsearch: Trying to search last 2 days in whenChanged attribute dynamically. I need to run a daily ldap search that will grab only the accounts that have change in the last 2 days. I can hard co... by mafruma Explorer in Splunk Search 09-07-2023 0 5	0	5
How to split comma separated values in single event and make each value as one row of table with individual values If I am having list of comma separated numbers in single splunk event field:I am having too many event fields like b... by Naga1 Loves-to-Learn Lots in Splunk Search 09-07-2023 0 18	0	18
How to check if values are incremental by 1 for a specific category If the above displayed data is the result for my stats command [stats values(Values) as Values by Category], how can ... by Nikitha Explorer in Splunk Search 09-07-2023 0 4	0	4
Rex not yielding result Data: {"Field1":"xxx","message1":"{0}","message2":"xxx","message3":{"TEXT":"xxxx: xxx\r\n.xxxxx: {\"xxxxx\":{\"@CDI\"... by harryhcg Explorer in Splunk Search 09-07-2023 0 8	0	8