Splunk Search

Community Activity

Help with rex mode= query- doesn't show error but doesn't show anything at all? I am trying to eventually get to the point where I can add this to props.conf but am trying out the searches in splun... by secphilomath1 Explorer in Splunk Search 05-05-2023 0 15	0	15
How to create root search and base search in dashboard? We have created base serach query but I required to created root search base on that . by Sekhar Explorer in Splunk Search 05-04-2023 0 3	0	3
How to write Splunk search different lookup depending on IF statement? Hi I have a search that will display result that will fall under device1 and device2. If device1 i need to check look... by glennthechamp Engager in Splunk Search 05-04-2023 0 1	0	1
Splunk search query to create a table from JSON search result I am relatively new to Splunk search and I am trying to build a table from my splunk search results.Can someone pleas... by Karanreddy Engager in Splunk Search 05-04-2023 0 0	0	0
Searching a field over a specifc date Hi,I'm creating a query in splunk and need to search a field over a specific date.Field example; lastLogonTimestamp=0... by kamronnikkhah Engager in Splunk Search 05-04-2023 0 5	0	5
Why does adding to search clear existing search? Hi, There seems to be an error in Cloud Splunk, can anyone reproduce? Make a search that returns some data (in JSON).... by stianahj Engager in Splunk Search 05-04-2023 0 0	0	0
How to trigger an custom alert condition of multiples from the basic search of Splunk? I am new to Splunk and facing an issue while setting up the custom alert. The results as shown in Table 1.I have trie... by AjayTakur Loves-to-Learn Everything in Splunk Search 05-04-2023 0 8	0	8
How can I make those authentication credentials editable through a graphical interface/dashboard in Splunk? I have a Python script in an External Lookup app which makes REST GET calls to a third party endpoint which requires ... by JerryLives Engager in Splunk Search 05-04-2023 1 1	1	1
How to store two time-ranges events and compare? Hi Splunkers, I have been using Splunk for a while and went through many proposed solutions in this community and fo... by kakar Explorer in Splunk Search 05-04-2023 0 5	0	5
Limits.conf window not acting on setting that UNIX is - is it a bug? HIWhen I was developing the app I was testing on UNIX, these settings (below) worked very well and kept the number of... by robertlynch2020 Influencer in Splunk Search 05-04-2023 0 3	0	3
Why does extracted field search work for certain dates but not some other dates? I created an extracted field called remote_user. My search for certain dates do bring the field value properly. Howe... by gnshah12345 Observer in Splunk Search 05-04-2023 0 5	0	5
How can I resuse the output of a query to compute larger timeframes? I am currently running a query that is quite inefficient, and it fails when run for extended periods.Splunk only allo... by yk010123 Path Finder in Splunk Search 05-03-2023 0 1	0	1
How to plot multiple datasets on the same chart? I'm trying to implement a chart, so users can select their options from a multi-select input box, and automatically u... by GaryZ Path Finder in Splunk Search 05-03-2023 0 1	0	1
How to remove decimal value from values in a table? Hello everyone, I need your help for something, please. I need to remove the decimal value for this fields: - total -... by anissabnk Path Finder in Splunk Search 05-03-2023 0 6	0	6
How to assign current week # to events? I have a list of events that happened over the last couple of weeks but the will be appended as it will be ran each w... by atebysandwich Path Finder in Splunk Search 05-03-2023 0 1	0	1
Is there a way to remove entire row from Kv Store lookup by running scheduled search?? we have a search which is feeding data to kv store lookup let say lookup name 'sample_test'.now i want to run a weekl... by Srubhi Path Finder in Splunk Search 05-03-2023 0 1	0	1
Can I add constant field/value conditionally? I have the following query: "MyToken" status >= 400 \| stats count by status,action That produces a t... by yk010123 Path Finder in Splunk Search 05-03-2023 0 2	0	2
Splunk time format conversions? How do I convert the below time format 2023-05-02T02:35:47Z into2023-05-03 15:37:22 by pavanae Builder in Splunk Search 05-03-2023 0 1	0	1
How to resolve Splunk "StatsFileWriterLz4" write failed file? HI Splunk pals, I am getting an error when trying to write a relatively large file using tstats. splunk "StatsFileWri... by Keysofsandiego Path Finder in Splunk Search 05-03-2023 0 0	0	0
How to make Search Visualization where count=0? Complete novice here, but I was able to get my search result thanks to others who have had questions. Currently I'm s... by ToddClayton Engager in Splunk Search 05-03-2023 0 2	0	2
How can I view Splunk results via GUI when job was started via API? I have a problem where I need to use the Splunk API to return timechart graphs as an image, however as the API cannot... by Tosheey123 Loves-to-Learn in Splunk Search 05-03-2023 0 1	0	1
How to onboard Sophos Firewall logs in Splunk Cloud instance? Team, I am new to Splunk Cloud. I need someone's help to get stated with Splunk. I have the Splunk cloud instance up ... by ravikm_bdvt New Member in Splunk Search 05-03-2023 0 1	0	1
Large-scale index deduplication-What are the best practices for managing duplicates over a large index? My team has duplicate events in our index (~600 GB). We have fixed duplicate source and need to remove the existing d... by brayps Explorer in Splunk Search 05-03-2023 0 3	0	3
How to perform TTest in Splunk? Hi Team, I want to calculate p value of tTest from Splunk query any suggestions? by Veerendra Loves-to-Learn Lots in Splunk Search 05-03-2023 0 0	0	0
How to use foreach to extract value from another json object? I am trying to get the values from one json object using the keys from another json array. \| makeresults\| eval lim... by GaryZ Path Finder in Splunk Search 05-02-2023 0 3	0	3