Splunk Search

Community Activity

Whitelisting using lookups Hi, I don't know if this is the right way to do it, but I have a list of COMMANDS which I have associated a Classifi... by lemikg Communicator in Splunk Search 02-24-2013 1 3	1	3
Regex - match all ocurances of a character Hi guys, I have been playing around trying to match multiple ocurances of a pattern and replace it with a regex in t... by kenchisho Path Finder in Splunk Search 02-22-2013 0 2	0	2
Get counts of more than one field in same event Let's say I have log records that look like this Field 1 Field 2 ABC XYZ ABC KLM XYZ ABC... by tnkoehn Path Finder in Splunk Search 02-22-2013 0 1	0	1
Using Splunk to Find Unused Firewall Policies We run a report every week that counts how many times a firewall policy was used. (A firewall policy is represented ... by aferone Builder in Splunk Search 02-22-2013 0 5	0	5
Evaluate a combination of sourcetypes Hi Everyone, I am doing the following search sourcetype="a" OR sourcetype="b" OR sourcetype="c" CPU_IDLE<40 \| tim... by dannux Path Finder in Splunk Search 02-22-2013 0 2	0	2
Regexes and the replace function Hello, I'm wondering if there's a way to trim characters from an unknown field value during search. I'm tracking pe... by cphair Builder in Splunk Search 02-22-2013 4 4	4	4
cannot eval a field obtained from rex and i am pretty sure the field is only digits I cannot seem to "eval" a field obtained from a "rex" and i am pretty sure the field is only digits... this is simili... by kingsizebk Path Finder in Splunk Search 02-22-2013 0 3	0	3
Cleaning raw data at index time or search time? I have raw data that looks like this: (4)example(3)domain(3)com(0). In my search, I've been using a macro that looks ... by aapittts Path Finder in Splunk Search 02-22-2013 0 1	0	1
How to integrate separate graphs into one board Hi Splunkers I have two searches I want to compare, but unfortunately can't find my way around it. First is: CPU lo... by lemikg Communicator in Splunk Search 02-22-2013 0 2	0	2
Lookup Can't Find File I am in a clustered indexer environment and some but not all of my indexers are showing this error "The lookup table... by hartfoml Motivator in Splunk Search 02-22-2013 0 4	0	4
Complex subsearch: Need to extract value of field and pipe into another search So I’m trying to link a couple different fields together to get the data I’m looking for, but it involves a couple st... by whateverman Explorer in Splunk Search 02-21-2013 2 2	2	2
Use of "NOT" vs "!=" I'm working on a search which should return all events, except those where the "User_Name" or the "Account_Name" fiel... by rtadams89 Contributor in Splunk Search 02-21-2013 2 4	2	4
To remove a specific field from the pull-down list, what should I do? I found a field, b1, c1, d1, e1 a1 to the search field. What if you want to view the rest of the fields except for e1... by qfjp Explorer in Splunk Search 02-21-2013 0 1	0	1
How to detect if logs stopped from regular source Hi Support team, I just wanna check with you guys on how to detect if logs stopped from regular source? Best regard... by WilliamF Engager in Splunk Search 02-21-2013 0 1	0	1
subsearch returning an empty set causes unexpected results I am using a subsearch to qualify an outer search. Simplified, it looks something like this: Index =AAAA [index=AAA... by timpgray Path Finder in Splunk Search 02-21-2013 1 3	1	3
Search for event X and Y, but only Y during business hours? Hey Guys, This is my current search (It looks for SQL I/O delays) = sourcetype="WinEventLog:Application" MSSQLSERVER... by johnpof Path Finder in Splunk Search 02-21-2013 1 7	1	7
find broken events How to figure which events are broken or truncated by splunk. I know that the default is 256 lines for multiline even... by mataharry Communicator in Splunk Search 02-21-2013 1 3	1	3
Index an Event based on the results of a Splunk Query. I have an custom search command. It is scheduled to run every 5min. The results are indexed in a summary index. I ne... by lpolo Motivator in Splunk Search 02-21-2013 0 2	0	2
Using indexed DHCPD logs to find MAC address for IP I'm trying to leverage my indexed DHCPD logs to provide additional information about internal IP's that show up in ot... by Adam_Sealey Explorer in Splunk Search 02-21-2013 0 5	0	5
Splunk Regex Expression Below is the raw data that am getting. I want to extract the events where category is Error. For this am doing this i... by pdash Path Finder in Splunk Search 02-21-2013 0 6	0	6
Using a lookup to search values that are NOT in logs I've tried using info from the following 2 KB posts, but I am still having trouble: http://splunk-base.splunk.com/an... by aferone Builder in Splunk Search 02-21-2013 0 5	0	5
Auto Group Result Hi, I would like to group my product based on weight. Sample logs are: Product ID \| Weight 00368001a1 \| 1.4... by yap Explorer in Splunk Search 02-21-2013 0 2	0	2
Iterative fields with spaces in values I'm having trouble with the way Splunk parses some of my logs which has field=value pairs that have values with unquo... by michaelbrunetto New Member in Splunk Search 02-21-2013 0 1	0	1
add device dynamiclly what is the best way to add these devices dynamically ? We are using autoscale servers, how should we introduce new d... by sara_shafaei New Member in Splunk Search 02-20-2013 0 3	0	3
multivalue fields and fields.conf With the following data: mac_addr=01-02-03-04-05-06, 01-02-03-04-05-07, 01-02-03-04-05-08 Using this search will... by Ron_Naken Splunk Employee in Splunk Search 02-20-2013 2 6	2	6

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars Sometimes, you just need to see the code. For those looking for a ...

Splunk Search

Whitelisting using lookups

Regex - match all ocurances of a character

Get counts of more than one field in same event

Using Splunk to Find Unused Firewall Policies

Evaluate a combination of sourcetypes

Regexes and the replace function

cannot eval a field obtained from rex and i am pretty sure the field is only digits

Cleaning raw data at index time or search time?

How to integrate separate graphs into one board

Lookup Can't Find File

Complex subsearch: Need to extract value of field and pipe into another search

Use of "NOT" vs "!="

To remove a specific field from the pull-down list, what should I do?

How to detect if logs stopped from regular source

subsearch returning an empty set causes unexpected results

Search for event X and Y, but only Y during business hours?

find broken events

Index an Event based on the results of a Splunk Query.

Using indexed DHCPD logs to find MAC address for IP

Splunk Regex Expression

Using a lookup to search values that are NOT in logs

Auto Group Result

Iterative fields with spaces in values

add device dynamiclly

multivalue fields and fields.conf

Splunk MCP & Agentic AI: Machine Data Without Limits

Finding Based Detections General Availability

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Answers Content Calendar May 2025!

MLTKC how should i check jupyter notebook func in ...

Splunk Search

Join the Conversation