Splunk Search

Community Activity

How to count field values from two indexes and plot this on a graph? I have 2 indexes: index=report and index=fixed Both have the same field ticket. When a ticket is reported, it goes i... by tp92222 Explorer in Splunk Search 03-03-2016 0 4	0	4
How do I search Active Directory logon failure activity to display time, username, event id, and computer name in a table? Hi , I would like to write a search for logon failure on active directory and results should include the columns lik... by Urao Engager in Splunk Search 03-03-2016 0 1	0	1
Regex field values into new fields Hello Splunkers, I am trying to take the values from an existing field/value pair and put them into new fields. host... by lbogle Contributor in Splunk Search 03-03-2016 0 2	0	2
How do I group one field's values by another field? I have a search ...\|table measInfoId that gives output in 1 column with the values e.g. measInfoId 1x 2x 3x ... I ... by HattrickNZ Motivator in Splunk Search 03-03-2016 0 21	0	21
Why am I getting an invalid timestamp using append and appendcols in my search? I am working with append and appendcols in a search, but getting an invalid timestamp. My search looks like this, bu... by HattrickNZ Motivator in Splunk Search 03-03-2016 0 5	0	5
How do I edit my inputlookup search to alert on missing data sources? I've constructed a lookup table containing some key data sources that I expect to see events from on a daily basis. ... by pkeller Contributor in Splunk Search 03-03-2016 0 1	0	1
Regex for changing date Hi, I want to check daily if my file generated successfully. The filename is prefixed by date so e.g. 3 march i'll ... by aniketb Path Finder in Splunk Search 03-03-2016 0 3	0	3
After saving my search as a report on the dashboard, why is the chart data incomplete? We have data like this: TestPath 200 202 500 302 /test/v1 51 0 0 0 /tes... by kotig Path Finder in Splunk Search 03-03-2016 0 4	0	4
Wildcard search not working on splunk search bar. When I try to search for hostname (ks75rhel) typing it in the search bar, I'm not getting any results. I tried the fo... by prakash007 Builder in Splunk Search 03-03-2016 0 8	0	8
Why am I getting regex error "unrecognized character" with my current rex syntax? Hello Everyone, I have a problem with Splunk 6.3 when I am trying to run the rex statement: \| rex "WTIDCCN[-_]\d\d\... by cesar_tomas Explorer in Splunk Search 03-03-2016 0 3	0	3
How to configure Splunk to extract fields from XML tags? Hi! I know there are many topics on XML field extractions, but did not see one that matches my requirement! I recei... by rtestu_splunk Splunk Employee in Splunk Search 03-03-2016 0 2	0	2
Convert negative seconds to duration I have a column of seconds, some of which are negative (representing an outage). I want to use tostring(duration, "d... by joxley Path Finder in Splunk Search 03-03-2016 1 1	1	1
Error: [JobManager module] 'str' object has no attribute 'os_startIndex' We were running Splunk 6.2.2. When looking for jobs that ran, under "Activity - Jobs", it shows the first 10 results... by Greggis New Member in Splunk Search 03-03-2016 0 1	0	1
How to match IPs from two different sources, count the number of matches, and extract another value from the matching events? Hello, I have two different types of data inputs, both having a field that represents an IP (let's call the list of ... by raduonica New Member in Splunk Search 03-03-2016 0 2	0	2
How to edit my search to add a trend line to a Splunk line chart? Hi, I'm trying to add a trend line to my splunk line chart, but no trend line is appearing. Original search string:... by steveskinner New Member in Splunk Search 03-03-2016 0 2	0	2
How to Convert epoch time to human readable format? Hi everyone, I have the following event: "... src=218.2.3.256 act=block app=ips rt=1433065461040 ...." The rt field... by bugnet Path Finder in Splunk Search 03-03-2016 0 8	0	8
Why is my search to create a range of values not returning any results? Hello, I'm trying to run this search in order to range the values: index=prod GetClientStateNotFound \| rex "Account... by Rotema Path Finder in Splunk Search 03-03-2016 0 8	0	8
How to write a search to calculate percentages for success and failure rates from my user log data? I am trying to write a search that reports the percentage of total users impacted from log data. // All users will... by trunghung Path Finder in Splunk Search 03-03-2016 0 7	0	7
Can I control which y-axis is on the left and which is on the right? Can I control which y-axis is on the left and which is on the right? for instance in the below can i have percent o... by HattrickNZ Motivator in Splunk Search 03-02-2016 0 3	0	3
How to search Splunk API from a remote host with Forwarder installed via CLI with user and password If you wish to Search the API via command line (using the Splunk Binary included in the Forwarder package for example... by watkinst Engager in Splunk Search 03-02-2016 0 1	0	1
How to merge 2 messages into 1 message? Hi, Is there a way to merge 2 messages into 1 message? For example I have a sequence of messages: TestingData numT... by ceng New Member in Splunk Search 03-02-2016 0 4	0	4
Why is _time for my events showing a 1 hour difference compared to the _raw data? Hi , Here is my requirement: In my search, _time is showing 1 hour difference to _raw. Why it is _time is not picki... by mprreddy51 Explorer in Splunk Search 03-02-2016 0 1	0	1
How to replace multiple column/field names with a `(` with an `_` underscore I have a search that gives me a number of columns in the stats field. max(col1) max(col2) ... 1 2 ... Can I repla... by HattrickNZ Motivator in Splunk Search 03-02-2016 0 5	0	5
Is it bad practice to have fields with high values in them? I'm going through the limits.conf specs to see what the defaulted fields are and noticed that the default for max val... by skoelpin SplunkTrust in Splunk Search 03-02-2016 0 5	0	5
How to make multivalue comparisons against multivalue fields without mvexpand? I have an alert designed to examine Windows event logs (event 560 or 4663) for file access by unauthorized users. The... by pdoconnell Path Finder in Splunk Search 03-02-2016 0 6	0	6

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

How to count field values from two indexes and plot this on a graph?

How do I search Active Directory logon failure activity to display time, username, event id, and computer name in a table?

Regex field values into new fields

How do I group one field's values by another field?

Why am I getting an invalid timestamp using append and appendcols in my search?

How do I edit my inputlookup search to alert on missing data sources?

Regex for changing date

After saving my search as a report on the dashboard, why is the chart data incomplete?

Wildcard search not working on splunk search bar.

Why am I getting regex error "unrecognized character" with my current rex syntax?

How to configure Splunk to extract fields from XML tags?

Convert negative seconds to duration

Error: [JobManager module] 'str' object has no attribute 'os_startIndex'

How to match IPs from two different sources, count the number of matches, and extract another value from the matching events?

How to edit my search to add a trend line to a Splunk line chart?

How to Convert epoch time to human readable format?

Why is my search to create a range of values not returning any results?

How to write a search to calculate percentages for success and failure rates from my user log data?

Can I control which y-axis is on the left and which is on the right?

How to search Splunk API from a remote host with Forwarder installed via CLI with user and password

How to merge 2 messages into 1 message?

Why is _time for my events showing a 1 hour difference compared to the _raw data?

How to replace multiple column/field names with a `(` with an `_` underscore

Is it bad practice to have fields with high values in them?

How to make multivalue comparisons against multivalue fields without mvexpand?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation