Splunk Search

Community Activity

	How to compare Field Values of Two Different Fields from Two Lookups? \|inputlookup lookup1,csv \|fields IP Host_Auth \|lookup lookup2.csv IP output Host_Auth as Host_Auth.1 Some of the fiel... by atebysandwich Path Finder in Splunk Search 06-06-2023 0 1	0	1
	How to count total with only displaying one stat? I am looking to display only one statistic row being named Total with the count of all of the hosts added up, which s... by jialiu907 Path Finder in Splunk Search 06-06-2023 0 3	0	3
	Correlation Analysis Labs- How do I modify search to display the transactions in table? index=web sourcetype=access_combined \| transaction _time,clientip, JSESSIONID,action How do I Modify my search to dis... by Nadeem New Member in Splunk Search 06-06-2023 0 3	0	3
	Why is this search returning the wrong result? The search query it showing only the roles for currently logged-in user. But this is not what we are looking for, we ... by Lavani Observer in Splunk Search 06-06-2023 0 2	0	2
	How to combine values from fields in different indexes using it to sort? Hi, I'm trying to combine values from two different fields in two different indexes. But it seems to come up blank. I... by FGAnders Explorer in Splunk Search 06-06-2023 0 4	0	4
	How to compare the date from the lookup and write new value? Hello, Splunkers.Problem Statement:I've searched the data with "date" and "score" to get the latest data and got the ... by zen29d Explorer in Splunk Search 06-06-2023 0 5	0	5
	How to get count ? I have a table in splunk with columns\|table _time idx Event_count IsOutlier Actual_outlier atf_hour_of_day atf_day_o... by MG Engager in Splunk Search 06-06-2023 0 2	0	2
	How to compare two inputlook kv columns? Hi There, we have two inputlook kv (File1 and File2) files and I want to compare 3 columns (AvsA, BvsB, CvsC) betwee... by akshaycloud11 Loves-to-Learn Lots in Splunk Search 06-06-2023 0 8	0	8
	What is the SPL for cancelled / timed out searches? Hi everyone, I've a scenario where Splunk is timing out in querying customer SIEM environments and reporting as poten... by McMac84 Engager in Splunk Search 06-06-2023 0 2	0	2
	How to get the 0 data rows using tstats query? Original query: index=app-data sourcetype=clientapp-code \|rex field=_raw "\Status\:(?<Code>.*?)\\|" \|eval Failed=if... by Vani_26 Path Finder in Splunk Search 06-06-2023 0 2	0	2
	How to merge the field value and its count into one field? I am relatively new to Splunk and I am trying to create a field that contains the field value and its count into one... by man03359 Communicator in Splunk Search 06-06-2023 0 5	0	5
	How to genterate list of data by giving max and min limit? Hi,I need genterate list of data by giving max and min range.But I can't find a command (function) doing that.I will ... by DS904458 Explorer in Splunk Search 06-05-2023 0 2	0	2
	How to search multiple strings from lookup and provide count? Hi All, I am working on search to search fields values from the lookup in an index and i have created the below searc... by Splunk4 Explorer in Splunk Search 06-05-2023 0 1	0	1
	Is it possible to use \| format to get !=? I have a search and in the initial part of the search I have a subquery that returns some IP addresses formatted like... by fredclown Builder in Splunk Search 06-05-2023 0 3	0	3
	Warning in internal log: unable to parse site_label I recently noticed a huge amount of warnings in the _internal logs for our search heads. events are all like this:02-... by mortf Explorer in Splunk Search 06-05-2023 0 7	0	7
	Can someone help me adjust my regex to only capture "P3820 Houston to A345 Atlanta Line Down" for the field "Details"? I can't use the field extractor because the field configurations are frequently very different and it gives me errors... by michaeler Communicator in Splunk Search 06-05-2023 0 2	0	2
	Join all objects with specific object within the same file? Hi, i have a lot of files, the size of each file can be 4M.the structure of each JSON file: Events/objects. Each even... by maayan Path Finder in Splunk Search 06-05-2023 0 7	0	7
	How can I search not only filter messages also couple of messages around it? How can I search not only filter messages also couple of messages around it? by Uday1 New Member in Splunk Search 06-05-2023 0 6	0	6
	How to get new exceptions stats by comparing two time ranges? Hello splunk, I'm trying to compare the exceptions between time ranges and get the new exceptions list. Suppose co... by Kk Path Finder in Splunk Search 06-05-2023 0 14	0	14
	How would I use lookup in this search? Hi everyone, I created a CSV lookup that has one column named "IP" which contains public IP list, and now I want to u... by faiq1999 Explorer in Splunk Search 06-04-2023 0 3	0	3
	Is it possible to do a regex at search time or preferably at index time to do this? Hi, I have below raw event. Data is ingested via reading logfiles from dedicated location on monitored server with UF... by mbasharat Builder in Splunk Search 06-04-2023 0 4	0	4
	How to extract URL and text after a string? Hi, I would like to extract fields from an unstructured data that contain multiple labels followed by its HTML href t... by firoagni Engager in Splunk Search 06-04-2023 0 3	0	3
	How to extract and count email address? Hello. How to extract and count personal email address? Say the destination email field (d-email) contains email as b... by stick-o New Member in Splunk Search 06-04-2023 0 3	0	3
	Replace Characters- How can I replace \\\\ for \ ? Hi guys how are you doing? I'm reading this link Solved: How to use replace in search? - Splunk Community but I can... by Tincho Engager in Splunk Search 06-03-2023 0 3	0	3
	How can I search vlookup data from CSV? Hello I have injested CSV data in lookup. The common data is Service_Method in CSV and dt.entity.service_method in Sp... by naujla85 Explorer in Splunk Search 06-03-2023 0 1	0	1