Splunk Search

Community Activity

If my field value name changed, can I still search to chart all the data? my field value name got modify. under network config field name. field value used to be "port 80 blocked"now it got c... by abi2023 Path Finder in Splunk Search 05-02-2023 0 4	0	4
How can I share a lookup script with other apps? I have a lookup script that is placed in my apps bin folder. How can I use this external lookup from other apps? Whe... by jameshgibson Path Finder in Splunk Search 05-02-2023 3 3	3	3
What is the most efficient way to reconcile the data from 2 indexes and create a report? I wanted to reconcile the data from 2 indexes say index=A and index=B both indexes have some common fileds like field... by iamsplunker Communicator in Splunk Search 05-02-2023 0 3	0	3
Is there a way to replace values that say null with nothing? We use Axonius to pull in identities. When creating the the search some of the values come in with the word "null". ... by lmmills Explorer in Splunk Search 05-02-2023 0 2	0	2
How to parse field data with delimiter from dbxquery result? how to parse field data with delimiter from dbxquery result?For example: Dbxquery result isFW Rule name: DNSFW Rule: ... by LearningGuy Motivator in Splunk Search 05-02-2023 0 3	0	3
Why are field values not displaying? I was running a search to display the last one week count for each notable and i used a query like this below index=n... by krish9vuda New Member in Splunk Search 05-02-2023 0 1	0	1
Is there anyway in Splunk to search in Date field? my Spl is my base search \| transaction ID \| stats count values(Date) as Date value(field1) as field1 by ID I get resu... by abi2023 Path Finder in Splunk Search 05-02-2023 0 3	0	3
Is it possible to event break from a single field? I do have a multivalue field with the letters cls and tenant at the end of it. Is it possible to break the data into ... by rpraveena03 New Member in Splunk Search 05-02-2023 0 3	0	3
How to solve Error parsing URL in Splunk? Hello, I'm trying to parse URLs in Java logs (*.trace), it works for complete URL with this following request : index... by Badab New Member in Splunk Search 05-02-2023 0 2	0	2
How to achieve difference between rate_sum and rate_avg aggregations using mstats command? Hi, I am trying to create a timechart using mstats command but I have some questions as follows, I would appreciate i... by tankelvi New Member in Splunk Search 05-02-2023 0 2	0	2
Subquery - How can I modify format with multiple conditions? Hello,The default format of my subsearch result looks like: (( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid... by emilep Explorer in Splunk Search 05-02-2023 0 5	0	5
How can I get the latest result? my spl base search \|transaction ID \| table date field1 field2 ID my result Date field1 fiel2 ... by abi2023 Path Finder in Splunk Search 05-01-2023 0 2	0	2
How can I lookup update field value question? I have sanitized the index names-I have users that have propagated a lookup command in dashboards that is now a major... by Dallastek1 Path Finder in Splunk Search 05-01-2023 0 2	0	2
How to match my lookup table? my lookup table is history data for the search I am running. from my search and my lookup table I have command field ... by abi2023 Path Finder in Splunk Search 05-01-2023 0 1	0	1
How do I search for outdated data in the index and delete it, retaining only the latest information? Hello, I'm working on IOC but unfortunately, keeping them in a lookup table is already getting messy and we have to i... by wvpony Engager in Splunk Search 05-01-2023 0 2	0	2
Can I have a rex ending with "/" or "?" ? index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfd... by naujla85 Explorer in Splunk Search 05-01-2023 0 3	0	3
Why is there no link between the two data points in Splunk trendline line chart? So i have a trendline like below: CodingMaestro_0-1682930328040.png I dont know why is there no link between the two ... by CodingMaestro Path Finder in Splunk Search 05-01-2023 0 2	0	2
What's the best way to find out events that have field values that DO NOT match? I have two lookups: one is the scan results from the current week and the other is historical lookup of scan results ... by atebysandwich Path Finder in Splunk Search 05-01-2023 0 3	0	3
How to include quote within LIKE keyword in Dbxquery? how to include quote within LIKE keyword in Dbxquery?For example: There are 10k people in the DB and I would like ... by LearningGuy Motivator in Splunk Search 05-01-2023 0 1	0	1
How to parse json into rows? Hi, I have issue similar to: https://community.splunk.com/t5/Getting-Data-In/how-to-split-the-json-array-into-multipl... by maayan Path Finder in Splunk Search 05-01-2023 0 3	0	3
Splunk display a value when no logs are found Hi ,I have a field which has 3 values i.e., 0 , 1 & 2.0 for Green , 1 for Blue and 2 for Red. I'm using this values t... by Dayalss Engager in Splunk Search 04-30-2023 0 3	0	3
How to find records based on input from user date? I have set of records where the data has time column in it.Eg: agupta13_0-1682724463553.png Here I will have an input... by agupta13 Engager in Splunk Search 04-29-2023 0 2	0	2
How to get the ingest bytes for internal logs? I know how to get the ingest bytes for non-internal logs using this ... index=_internal source="*license_usage.log"... by fredclown Builder in Splunk Search 04-29-2023 0 10	0	10
Longer time frame does not return results? When I run the following query: "com.server" \| table id uri statusCode _time \| join type=inner saga_id [search "Secon... by yk010123 Path Finder in Splunk Search 04-28-2023 0 3	0	3
How to create a search for Hosts that failed Authentication this week but were successful last? I have a table that has the following fields: IPHost_Auth _time The _time field shows the time the host was authenti... by atebysandwich Path Finder in Splunk Search 04-28-2023 0 8	0	8