Splunk Search

Community Activity

Limits.conf window not acting on setting that UNIX is - is it a bug? HIWhen I was developing the app I was testing on UNIX, these settings (below) worked very well and kept the number of... by robertlynch2020 Influencer in Splunk Search 05-04-2023 0 3	0	3
Why does extracted field search work for certain dates but not some other dates? I created an extracted field called remote_user. My search for certain dates do bring the field value properly. Howe... by gnshah12345 Observer in Splunk Search 05-04-2023 0 5	0	5
How can I resuse the output of a query to compute larger timeframes? I am currently running a query that is quite inefficient, and it fails when run for extended periods.Splunk only allo... by yk010123 Path Finder in Splunk Search 05-03-2023 0 1	0	1
How to plot multiple datasets on the same chart? I'm trying to implement a chart, so users can select their options from a multi-select input box, and automatically u... by GaryZ Path Finder in Splunk Search 05-03-2023 0 1	0	1
How to remove decimal value from values in a table? Hello everyone, I need your help for something, please. I need to remove the decimal value for this fields: - total -... by anissabnk Path Finder in Splunk Search 05-03-2023 0 6	0	6
How to assign current week # to events? I have a list of events that happened over the last couple of weeks but the will be appended as it will be ran each w... by atebysandwich Path Finder in Splunk Search 05-03-2023 0 1	0	1
Is there a way to remove entire row from Kv Store lookup by running scheduled search?? we have a search which is feeding data to kv store lookup let say lookup name 'sample_test'.now i want to run a weekl... by Srubhi Path Finder in Splunk Search 05-03-2023 0 1	0	1
Can I add constant field/value conditionally? I have the following query: "MyToken" status >= 400 \| stats count by status,action That produces a t... by yk010123 Path Finder in Splunk Search 05-03-2023 0 2	0	2
Splunk time format conversions? How do I convert the below time format 2023-05-02T02:35:47Z into2023-05-03 15:37:22 by pavanae Builder in Splunk Search 05-03-2023 0 1	0	1
How to resolve Splunk "StatsFileWriterLz4" write failed file? HI Splunk pals, I am getting an error when trying to write a relatively large file using tstats. splunk "StatsFileWri... by Keysofsandiego Path Finder in Splunk Search 05-03-2023 0 0	0	0
How to make Search Visualization where count=0? Complete novice here, but I was able to get my search result thanks to others who have had questions. Currently I'm s... by ToddClayton Engager in Splunk Search 05-03-2023 0 2	0	2
How can I view Splunk results via GUI when job was started via API? I have a problem where I need to use the Splunk API to return timechart graphs as an image, however as the API cannot... by Tosheey123 Loves-to-Learn in Splunk Search 05-03-2023 0 1	0	1
How to onboard Sophos Firewall logs in Splunk Cloud instance? Team, I am new to Splunk Cloud. I need someone's help to get stated with Splunk. I have the Splunk cloud instance up ... by ravikm_bdvt New Member in Splunk Search 05-03-2023 0 1	0	1
Large-scale index deduplication-What are the best practices for managing duplicates over a large index? My team has duplicate events in our index (~600 GB). We have fixed duplicate source and need to remove the existing d... by brayps Explorer in Splunk Search 05-03-2023 0 3	0	3
How to perform TTest in Splunk? Hi Team, I want to calculate p value of tTest from Splunk query any suggestions? by Veerendra Loves-to-Learn Lots in Splunk Search 05-03-2023 0 0	0	0
How to use foreach to extract value from another json object? I am trying to get the values from one json object using the keys from another json array. \| makeresults\| eval lim... by GaryZ Path Finder in Splunk Search 05-02-2023 0 3	0	3
How to compile 3 searches into one to get the following Information: SAML Group, Splunk Role, index? These are the 3 searches I have found, but I need to combine them so that I can get the information all out on one se... by NanSplk01 Communicator in Splunk Search 05-02-2023 0 6	0	6
How do I get the sum of similar values in chart? Hello, thank you in advance for your time.I need to perform the sum of similar fields that results in a chart.My curr... by Borys New Member in Splunk Search 05-02-2023 0 2	0	2
If my field value name changed, can I still search to chart all the data? my field value name got modify. under network config field name. field value used to be "port 80 blocked"now it got c... by abi2023 Path Finder in Splunk Search 05-02-2023 0 4	0	4
How can I share a lookup script with other apps? I have a lookup script that is placed in my apps bin folder. How can I use this external lookup from other apps? Whe... by jameshgibson Path Finder in Splunk Search 05-02-2023 3 3	3	3
What is the most efficient way to reconcile the data from 2 indexes and create a report? I wanted to reconcile the data from 2 indexes say index=A and index=B both indexes have some common fileds like field... by iamsplunker Communicator in Splunk Search 05-02-2023 0 3	0	3
Is there a way to replace values that say null with nothing? We use Axonius to pull in identities. When creating the the search some of the values come in with the word "null". ... by lmmills Explorer in Splunk Search 05-02-2023 0 2	0	2
How to parse field data with delimiter from dbxquery result? how to parse field data with delimiter from dbxquery result?For example: Dbxquery result isFW Rule name: DNSFW Rule: ... by LearningGuy Motivator in Splunk Search 05-02-2023 0 3	0	3
Why are field values not displaying? I was running a search to display the last one week count for each notable and i used a query like this below index=n... by krish9vuda New Member in Splunk Search 05-02-2023 0 1	0	1
Is there anyway in Splunk to search in Date field? my Spl is my base search \| transaction ID \| stats count values(Date) as Date value(field1) as field1 by ID I get resu... by abi2023 Path Finder in Splunk Search 05-02-2023 0 3	0	3