Splunk Search

Community Activity

How do I combine two searches and only return results from Search2 that are missing from Search1? Hello Splunkers, I am running two separate searches, both of which are running fine. The results of these two search... by lbogle Contributor in Splunk Search 12-29-2015 0 1	0	1
How to add search peers in a search head cluster? Is there a trick to adding search peers with a search head cluster? I have to add 20 new indexers very soon and I don... by daniel333 Builder in Splunk Search 12-29-2015 0 3	0	3
How to write a search to match Event 3 with Event 1 and match Event 4 with Event 2? Hello All, Need help in building a search. Below is my log file events format: Event 1 -- RequestType1 Event 2 -- R... by bharathkumarnec Contributor in Splunk Search 12-29-2015 0 2	0	2
Merge two indexes (ids with proxy) for more alert depth correlation I have two indexes for ids (suricata) and proxy (Cisco WSA), I'd like to correlate when splunk finds an IDS alert and... by JSkier Communicator in Splunk Search 12-29-2015 0 5	0	5
How to write a search to find which user did a sudo to root for the last 2 days on Linux servers? Would it be something like: sourcetype="/var/log/secure" eventtype="su_authentication" by sandyganti13 New Member in Splunk Search 12-29-2015 0 2	0	2
How to count how many times a field value has changed from one to another? Hi, In my data I have a "Status" field. The status can be in one of 3 states: Connected, Connecting, Disconnected. I ... by anphan1992 Engager in Splunk Search 12-29-2015 0 1	0	1
Trouble Joining Firewall and DHCP logs by IP address Hello All, been banging the head against the desk for awhile on this one; tried join, transaction, and a few other th... by tjr1775 Path Finder in Splunk Search 12-29-2015 3 9	3	9
How to update a lookup periodically? Hi All, I'm wondering what would be the best way to download the latest CSV from http://cyberthreatalliance.org/cryp... by CYBR_AH Explorer in Splunk Search 12-29-2015 0 3	0	3
How to troubleshoot why I'm missing events in my search results? Hi, I have an issue with a search, that I also use as an alert, which is not finding current events: So the searc... by omuelle1 Communicator in Splunk Search 12-29-2015 0 2	0	2
JSChart Drilldown - Show drilldown table when page loads I would like to know if there is a way to perform and inline drilldown from a JSChart to a Table but have the table s... by plarkin01 Explorer in Splunk Search 12-29-2015 0 2	0	2
How to make a search run or populate a dropdown if condition is met using simple xml? So I have a dropdown called Repository, that populates a search and another dropdown called Namespace that has set ch... by dreamwork801 Path Finder in Splunk Search 12-29-2015 0 8	0	8
How to search the count of both fail and total numbers from a data model? I want to get fail number and total number from one data model, but I cannot figure out how to do this. My search is ... by HedyLu New Member in Splunk Search 12-29-2015 0 2	0	2
How to retrieve time\date after distinct count search? Hi, My search is: mysearch \| stats dc(Errorcode) as Errors By Name I want to get results for 2 options: optio... by abovebeyond Communicator in Splunk Search 12-28-2015 0 3	0	3
How to change the chart label size in Simple XML in Splunk 6.3? Hi I want to change chart label size in Simple XML. I find in Splunk 6.2 there is one option that can be used : <... by zhulongshiny Engager in Splunk Search 12-28-2015 0 1	0	1
Can Splunk Web Console through IPv6 Do anyone know how to enable Splunk Web to be access via IPv6 address schema? Can dual-stack (IPv4 and IPV6) access ... by hcwong Engager in Splunk Search 12-28-2015 0 3	0	3
Is there a way for different users/departments to only view their respective lookup files based on their assigned user roles? Hey Everyone, I'd like to make sure that different user/department will only be able to view their respective lookup... by Imjusttesting Explorer in Splunk Search 12-28-2015 0 10	0	10
How to make a timechart/graph from a search result? I have some events with message field as Bar Hello.., Bar Hi..., Bar Foo... and so on. I do not know beforehand how m... by anirban_nag Explorer in Splunk Search 12-28-2015 0 5	0	5
How do I use the transpose command header_field argument to reformat my table? I have a table from a timechart like this : Month LE11 LE12 LE41 January 1680 ... by splk_clheureux Explorer in Splunk Search 12-28-2015 0 6	0	6
How to write a search to display a particular string if a certain condition is met? If AVSResponse = x, then I need to display "matched" in the dashboard report. Likewise, if I have more than 10 value ... by Rias New Member in Splunk Search 12-25-2015 0 4	0	4
Why are there differences between _time, _raw time, and indexed_time for my event? query: Search to find latency: Index=XXX source=abcd.csv \| eval indexed_time=strftime(_indextime, "%+") \| eval late... by mprreddy51 Explorer in Splunk Search 12-24-2015 0 3	0	3
How to delete logs permanently from an indexer in an indexer cluster using a search? I want to delete logs from the last 3 months permanently from each indexer present inside the indexer cluster using a... by himapate Explorer in Splunk Search 12-24-2015 0 1	0	1
Multiple Firewall Denies followed by an allow from the same source IP I'm looking for a way to create a splunk query (and then into a real time alert) when the below conditions are met. ... by bhymel5 Engager in Splunk Search 12-24-2015 2 2	2	2
How to find first and last occurence of a value in a field when that value in the field gets changed? We have a requirement to count the total number of unscheduled outages in a month. The scenario is as follows: 1) W... by Arminder_Bhalla New Member in Splunk Search 12-24-2015 0 3	0	3
Change color scheme for test environment It doesn't look like there's an easy way to change the colors, etc. for splunk, but it would be very helpful to ident... by mikesangray Path Finder in Splunk Search 12-24-2015 0 2	0	2
search results sum count by date? Hi, Im trying to sum results by date: CreatedDate ------ count 2015-12-2 ------ 1 2015-12-1 -----... by abovebeyond Communicator in Splunk Search 12-24-2015 0 6	0	6

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Splunk Search

How do I combine two searches and only return results from Search2 that are missing from Search1?

How to add search peers in a search head cluster?

How to write a search to match Event 3 with Event 1 and match Event 4 with Event 2?

Merge two indexes (ids with proxy) for more alert depth correlation

How to write a search to find which user did a sudo to root for the last 2 days on Linux servers?

How to count how many times a field value has changed from one to another?

Trouble Joining Firewall and DHCP logs by IP address

How to update a lookup periodically?

How to troubleshoot why I'm missing events in my search results?

JSChart Drilldown - Show drilldown table when page loads

How to make a search run or populate a dropdown if condition is met using simple xml?

How to search the count of both fail and total numbers from a data model?

How to retrieve time\date after distinct count search?

How to change the chart label size in Simple XML in Splunk 6.3?

Can Splunk Web Console through IPv6

Is there a way for different users/departments to only view their respective lookup files based on their assigned user roles?

How to make a timechart/graph from a search result?

How do I use the transpose command header_field argument to reformat my table?

How to write a search to display a particular string if a certain condition is met?

Why are there differences between _time, _raw time, and indexed_time for my event?

How to delete logs permanently from an indexer in an indexer cluster using a search?

Multiple Firewall Denies followed by an allow from the same source IP

How to find first and last occurence of a value in a field when that value in the field gets changed?

Change color scheme for test environment

search results sum count by date?

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation