Splunk Search

Community Activity

How to identify an unusual source sending a high volume of emails, excluding VCP public wifi from the 172 Host? Hi,I'm trying to build a search query for the Unexpected Host Sending a Large Amount of Email in which i need to Exc... by smith_ Builder in Splunk Search 06-20-2023 0 3	0	3
How to count specific field in a mini batch log events? Each log event has more than 1 transaction because we are logging a mini batch log events. So, for every 2 minutes a ... by VP1 Loves-to-Learn in Splunk Search 06-20-2023 0 2	0	2
How can I refer part of query as a table? I have a dbx query plus SPL commands that makes me a certain table, which I want to refer to via a table name, is it ... by jonvijay1993 Explorer in Splunk Search 06-20-2023 0 2	0	2
How to search a list of all enabled apps in Splunk and their versions on a search head? Hi, Could you please help me to create a search which can list all apps enabled in Splunk (on splunk search head) an... by thezero Path Finder in Splunk Search 06-20-2023 1 12	1	12
Index based search for user being added to multiple windows groups? Hello Folks, Needed help with index based search for any user being added to multiple windows groups (preferably more... by john-doe Engager in Splunk Search 06-20-2023 0 3	0	3
Splunk Search to get time if exceeds cut off time on account of day changed? Hai All,Good day,we have event in splunk for job_name Test job HAS START_TIME at 2023/06/15 23:30:33 and END_TIME 2... by sekhar463 Path Finder in Splunk Search 06-19-2023 0 4	0	4
How to calculate percentage based on 3 different searches with Joins? Is that possible? First query: index="raw_es2" app message="[Login][Password]Login simplified active." \| stats count by message \| renam... by francine0 New Member in Splunk Search 06-19-2023 0 1	0	1
How cache fields are computed in index _audit? Hello All,I need help to understand the cache related fields returned by _audit index for scheduled searches.duration... by Taruchit Contributor in Splunk Search 06-19-2023 0 0	0	0
How to find top 10 URLs with high response time? Hello Team, I need to have top 10 url's in the order of max average response time taken. Could you please help in tha... by Devi13 Path Finder in Splunk Search 06-19-2023 0 2	0	2
How to create a join when first search contains multivalues for single field? Hi,I'm trying to join two searches where the first search includes a single field with multiple values. The matching ... by Woodpecker Path Finder in Splunk Search 06-19-2023 0 1	0	1
How to combine events having one field value same and create single row? Hi, Require to combine events having one field value same and create single row . Query: index=webmethods_dev5555_in... by Abhineet Loves-to-Learn Everything in Splunk Search 06-19-2023 0 1	0	1
What is the best way to use if clause with where? Hello Community, I have a table: Filename Status file1 1 file2 0 \| eval Status=if(where S... by appsik Explorer in Splunk Search 06-19-2023 0 2	0	2
What is the difference between run_time and total_run_time? Hello all, I need help to understand the difference between two fields run_time (fetched from index: _internal) and t... by Taruchit Contributor in Splunk Search 06-19-2023 0 1	0	1
Is it possible to do eval and lookups with makeresult? Is it possible for me to do a main search and based on the results from main search I find the fileName and want to u... by Thulasinathan_M Contributor in Splunk Search 06-19-2023 0 3	0	3
Optimizing SLA Tracking - Caching/Indexing or Saving Results? Hi everyone, I have a pretty huge multisearch query with multiple inputlookups, untangling the spaghetti monster whic... by interrobang Explorer in Splunk Search 06-18-2023 0 1	0	1
Why are there a few fields are missing when importing data from DOORS next gen to Splunk? Hello All, I tried to extract data from DOORS Next Gen. After importing the data, I found that few fields are missing... by Sharmila Engager in Splunk Search 06-18-2023 0 1	0	1
How to display next 10 numbers? Hi Splunkers, Here I'm asking help on Splunk query. I have a csv file with some numbers between 101-999, I need to wr... by thippeshaj Explorer in Splunk Search 06-18-2023 0 2	0	2
How to dynamically select column in an XY series? Hello! I am currently trying to dynamically select columns in my output that are generated by an xyseries. I am compa... by ajones Explorer in Splunk Search 06-17-2023 0 2	0	2
How to remove null values then add fields? Hi all, would love help with this one. I currently have a query where I have 4 different processing times by session... by user33 Path Finder in Splunk Search 06-17-2023 0 5	0	5
How to exclude users from service account values: a generic approach? Hi,I'm attempting to create a method to exclude users from service account values without excluding a particular serv... by smith_ Builder in Splunk Search 06-17-2023 0 15	0	15
Extract multiple JSON fields I am trying to create a table whereby two of the values are within a JSON array. The data in each array entry is base... by srcno Loves-to-Learn in Splunk Search 06-16-2023 0 5	0	5
How to remove comms and parenthesis? index="myIndex" app_name="myappName" My.Message = "failed to retrieve the workOrder"\| rex "Order (?<Order>[^\s]+)"... by Sureshp191 Explorer in Splunk Search 06-16-2023 0 10	0	10
How do I create a search to show Cisco logins sorted by User? I can search through cisco logs easily enough, and can also sort for logins, or failed logins without issue - but sin... by Crabbok Engager in Splunk Search 06-16-2023 0 1	0	1
How to add unique count column on the stats result? Hi, I have data as below \| date \| buyer \| product \|\| Jun-1 \| A \| P-01 \|\| Jun-1 \| A \| P-02 \|\| Jun-1 \| B ... by mia Explorer in Splunk Search 06-16-2023 0 3	0	3
How to write query to find perimeter fw details? Hi, I am trying to build a query on perimeter firewall how we can find the ips hitting to the fw. Thanks by smith_ Builder in Splunk Search 06-16-2023 0 20	0	20