Splunk Search

Community Activity

Convert stats to JSON I have a user who wants to send a table resulting from \| stats values() to a summary index via the collect command, b... by wpb162 Explorer in Splunk Search 04-06-2023 0 3	0	3
How to create a dashboard of XML file? Hi, I have the following event (XML) in Splunk, how can I create a dashboard of this XML? <JOBAPPLICATION="AFT-DTA"CR... by ns102 Explorer in Splunk Search 04-06-2023 0 5	0	5
How do you prevent the map command from encapsulating the variable in quotes? The quotes can only be seen in the search.log in one of the SearchParser component events. My ultimate goal is to b... by quasikaze Explorer in Splunk Search 04-06-2023 2 9	2	9
How to to sort the date so that my graph is coherent? Hello, thank you in advance for your feedback. I would like to sort the date so that my graph is coherent, can you pl... by numeroinconnu12 Path Finder in Splunk Search 04-06-2023 0 4	0	4
How do I compare lookup field to search and print another field in lookup file? Currently in my logs I am getting the hostname of the users but not their usernames. I created a lookup table that co... by cyrus_thesplunk Engager in Splunk Search 04-06-2023 0 4	0	4
Splunk Forwarder preferred path Hi Splunkers,does anyone have an idea how to configure a preferred path on a Splunk Forwarder?I have 2 datacenters wi... by djluke Path Finder in Splunk Search 04-06-2023 0 3	0	3
How can I multiple search and table data? Hello, I have a below splunk query which gives me response time value extracted from its response. index=my_index ope... by super_edition Path Finder in Splunk Search 04-06-2023 0 2	0	2
Detecting network and port scanning using SPL? Hi, Could anyone help me with this use case as I'm trying to figure out my alert logic scanner use case scanning many... by balu1211 Path Finder in Splunk Search 04-06-2023 0 3	0	3
How extract field using rex? How to extract fields in between \| servername \|Which i am using in rex ^[^\\|\n]*\\|(?P<Server>\w+\.\w+\.\w+\.\w+\s+)Bu... by karthi2809 Builder in Splunk Search 04-05-2023 0 2	0	2
Help with Regex for raw data to create pie chart? I need some help to create a pie chart of songs using this raw data. The command I'm using is this: \|rex (?<track>(... by gemtm Observer in Splunk Search 04-05-2023 0 8	0	8
What search can I use to know if a service had been restart after a certain period of time? hi all, i have this logs which i am interested in know if there is a agent restarted after certain period when the ag... by 7ryota Explorer in Splunk Search 04-05-2023 0 4	0	4
Having Logs at different times? Hi, I have log files coming at different times, but i need to compare logs of same time. 1-----Log1 - file received f... by VijayA Explorer in Splunk Search 04-05-2023 0 2	0	2
What is the best way to spoof run-anywhere fake data for a question? Many people ask questions here that are tricky enough that the only way to get an answer that works is to play around... by woodcock Esteemed Legend in Splunk Search 04-05-2023 3 12	3	12
Help me understand: "Error in 'EvalCommand': The expression is malformed. Expected )." So I've recently got into a new job, where I'm learning Splunk and learning how to support splunk searches and dashbo... by TorbinIT Path Finder in Splunk Search 04-05-2023 0 2	0	2
How to measure impact of searches with long time period? Hello All,I need your help to understand the impact of time ranges selected by users while running their search query... by Taruchit Contributor in Splunk Search 04-05-2023 0 2	0	2
How to use the map command to match events? Could someone have a look at the following query and see why it does not give me the results I expect based on the do... by Ciarán Explorer in Splunk Search 04-05-2023 0 14	0	14
Regex for getting only the bold? I have field log-sshd like this:log-sshd="Apr 5 xx:xx:xx serverhost sshd[xxxx]: Failed password for user xxx from xx.... by f_666dhn Explorer in Splunk Search 04-05-2023 0 2	0	2
Error in 'where' command: The 'not' function is unsupported or undefined. Splunk Search I have this report that i received an error from. Ive seen the error from different searches, but i just started to l... by Abass42 Communicator in Splunk Search 04-04-2023 0 3	0	3
What is a REX I can use to create field domain from website? REX command to create a field domain from websiteEX: input : https://www.youtube.com/sd/td/gs-intro output: ... by shreyasamin64 Explorer in Splunk Search 04-04-2023 0 4	0	4
How to extract, if log1 - severity =6 then what is the severity in log2, at given point of time? Hi All, I'm searching 2 different logs, which contain the "Severity" as common field. I want to extract, if log1 - ... by VijayA Explorer in Splunk Search 04-04-2023 0 7	0	7
How to create pie chart for two fields? Hi, I have service name verb, object and outcome. I need to show the statistics in pie chart. For example, index=a... by Dharani Path Finder in Splunk Search 04-04-2023 0 4	0	4
How can I see still results from both sourcetypes but only from hosts which have cvs score above 7? Hello, Syntax: index=security sourcetype=EDR:* \| eval dest=coalesce(ip,ipaddress) \| stats values(sourcetype) val... by suspense Explorer in Splunk Search 04-04-2023 0 7	0	7
How to use eval to find the usecase? Hi,Could any one able to write the query for the use case if user triggers both alerts (alert_name="pdm" AND alert_... by smith_ Builder in Splunk Search 04-04-2023 0 14	0	14
How do I write this search to find these 2 fields with the lookup hostname? Hi, I need your suggestion here. Please guide me I have a lookup file with list of hosts. I need to compare it with s... by RanjiRaje Explorer in Splunk Search 04-03-2023 0 5	0	5
How to add count and percent to pie chart? By default, only labels are displayed on pie chart when using top command.Is there any way to add count and percent t... by Minarai Explorer in Splunk Search 04-03-2023 0 1	0	1