Splunk Search

Community Activity

Rex field extraction I have a field called 'description'. I want to be able to extract MD5, SHA1, SHA256 values present in this field.Need... by zacksoft_wf Contributor in Splunk Search 04-19-2023 0 3	0	3
How to search for values greater than 90 days? index=test sourcetype=csv source=prtg.csv host=prtg device=all "Down for"=*\| rename "Down for" AS Downtime\| eval "Dow... by willsy Communicator in Splunk Search 04-19-2023 0 7	0	7
How to replace blank values with "0"? Trying to replace the blank values on my dashboard with 0s. If table is empty, should display 0. On the logs data, it... by harshparikhxlrd Path Finder in Splunk Search 04-18-2023 0 2	0	2
How to handle eval searchmatch with question-mark? Hello Using the below query, I am trying to build a response index=my_index openshift_cluster="cluster009" sourc... by super_edition Path Finder in Splunk Search 04-18-2023 0 2	0	2
How to combine CMDB tables? We have two CMDB tables logs in to Splunk 1. CMDB Business application - Business related info 2. CMDB Rel - Relatio... by navb Loves-to-Learn in Splunk Search 04-18-2023 0 3	0	3
How are strings from an UI-"input" interpreted in another string search? I have the following search string in my chart panel. "Arguments.category{}"= "$TestSuite$" TestSuite is defined by ... by GaryZ Path Finder in Splunk Search 04-18-2023 0 7	0	7
How to extract data from quotation marks? Hello, I am trying to extract the data from the following message:the header data is in quotes and for each header da... by Lazous Engager in Splunk Search 04-18-2023 0 5	0	5
Why is ISNULL functionality not working? I am trying to get the data only when my lastlogon(field name) is Null. but the above query is still giving me data f... by Keerthi Path Finder in Splunk Search 04-18-2023 0 2	0	2
How to count for all hosts from lookup? I have a query that I am using to get the count of events index=system source=/var/log/syslog/* \| rex field=source "... by Skysurfer Explorer in Splunk Search 04-18-2023 0 2	0	2
How to format as percent with 2 decimal places and no rounding? How do you convert .34999832 to 34.99% or .399345 to 39.99% I need to see the .99 and not have it round up by mbtsoltis Explorer in Splunk Search 04-18-2023 0 3	0	3
How to speed up Splunk query that uses appendcols? Hi, I have the following Splunk query:index=ABC sourcetype=DEF dv_assignment_group="SECURITY-NETWORK-L3" \| table _tim... by POR160893 Builder in Splunk Search 04-18-2023 0 3	0	3
Receiving "DISABLED_DUE_TO_GRACE_PERIOD" I have seen many questions about disabled due to licensing violation, but I applied a reset key and now I have this m... by mathewchase Engager in Splunk Search 04-18-2023 1 4	1	4
Is it currently possible to somehow create a conditional macro expansion? Hi all,Is it currently possible to somehow create a conditional macro expansion?For example, I have different list of... by shubs Engager in Splunk Search 04-18-2023 0 2	0	2
How to extract matched data from different index and different source based on the fields? Below two events Start event Index= x source= xtype \| spath application \| search application= x app " saved note" R... by Sekhar Explorer in Splunk Search 04-17-2023 0 3	0	3
How to extract this string? There are two types of raw data. What is the regular expression to get the value between the /* special symbol and th... by chanhee1 Loves-to-Learn Lots in Splunk Search 04-17-2023 0 3	0	3
How to calculate the SLA percentage from start event query and end event query? I have two events one is calculate the SLA percentage from below querys Start event query Index=x source type= xx... by Sekhar Explorer in Splunk Search 04-17-2023 0 12	0	12
How to create a custom alert based on past data? can we setup an alert based on data from current time stamp & based on information on past 15mins ?say at T1, got a l... by kdineshreddy009 New Member in Splunk Search 04-17-2023 0 3	0	3
How to change the cron schedule of around 500 saved searches at once in Splunk Cloud so spread across the clock? Hi, I have many concurrent saved searches running due to which search delayed health indicator is always red. How to ... by bhagyashriyan Explorer in Splunk Search 04-17-2023 0 1	0	1
How to extract file name from path's for both windows and nix format? Hi, We have a data source containing File Path's from both Windows and Linux formats. Applying regex separately work... by att35 Builder in Splunk Search 04-17-2023 0 4	0	4
How to search sourcetype not reporting by host? Hi Splunkers, I need your assistance to create a search that provides the following:SPL query I will use it to look f... by muradgh Path Finder in Splunk Search 04-17-2023 0 2	0	2
How to common fields from two different events and calculate the diff between the start and end event group my main? We have two events Start event Index= x source= xtype \| spath application \| search application= x app " saved note" ... by Sekhar Explorer in Splunk Search 04-17-2023 0 3	0	3
Why am I unable to output lookup field when the field is not a Splunk field? Hi All, I have an issue which i am unable to resolve. I have a lookup with two columns: Process_Command_Line, score U... by becksyboy Contributor in Splunk Search 04-17-2023 0 6	0	6
How to find event timestamp duration with respect to current time in minute and seconds? We have splunk event having field "eventdateTime" in format mentioned below. for example eventdateTime 2023-04-17 06... by Abhineet Loves-to-Learn Everything in Splunk Search 04-17-2023 0 2	0	2
How to extract two fields from a group? I am new to Regex expressions and trying to figure them out. I am trying to extract two sections of the following log... by kmhanson Explorer in Splunk Search 04-17-2023 0 14	0	14
How to avoid "search is waiting for input...", even if a user does not include a value in a text input field? Hi, Sorry if my question is repeated or too naive. I have a text input field accepting "Module name". It works perf... by shrirangphadke Path Finder in Splunk Search 04-17-2023 3 8	3	8