Splunk Search

Community Activity

How to combine two searches into one? 1st query index=mail NOT [ \| inputlookup suspicoussubject_keywords.csv \| rename keyword AS query \| fields query... by sulaimancds Engager in Splunk Search 03-13-2023 0 21	0	21
What command can I use to speed up my search besides join command? I am trying to extract only the top values from fields such as argument, uri, and method for the WAF log.Currently,... by same Engager in Splunk Search 03-13-2023 0 3	0	3
Search with Time Using a Lookup? I have a lookup of hosts with a field Last_Scan_Datetime and the field values were formated using strftime(_time, "%Y... by atebysandwich Path Finder in Splunk Search 03-13-2023 0 2	0	2
How to pass values to a eval if subsearch? Hi guys!I have a sourcetype "A" with some info about infrastructure. Host IP is one of this info. I have another sour... by pierre_weg Path Finder in Splunk Search 03-13-2023 0 3	0	3
How to adjust radial gauge numeric range within a dashboard? Hello, I want to alter the radial gauge (default is 100). We expect about 5,000 log entries/lines per hour and I am c... by agoktas Communicator in Splunk Search 03-13-2023 0 3	0	3
Matching Hostname to IP Between Two Lookups? I have two lookups. One lookup has Hostnames and IPs and the other has hostnames. I would like to run a search so I c... by atebysandwich Path Finder in Splunk Search 03-13-2023 0 1	0	1
How to use the REST API to run a multisearch and stream the results back? Hi,I am able to run normal search using rest API using below syntax: https://SearchHead_host:8089/servicesNS/admin/se... by arunslal Loves-to-Learn Lots in Splunk Search 03-13-2023 0 2	0	2
Calculate total time for a specific event over a range of time period? I have 2 queries:One is an OFF event, and one is an ON event for a cluster of machines for customers. I want to calcu... by akidua Explorer in Splunk Search 03-13-2023 0 5	0	5
How to detect T1036.002: Masquerading (Right-to-Left Override)? Hi all, Recently I have been working on getting a query that can help me identify the execution of malicious document... by jrock Observer in Splunk Search 03-13-2023 0 5	0	5
Easiest way to exclude ingestion of events for a specific IP address from a SourceType? I am looking to not ingest events from a specific IP address. I have an IP address that once a week generates a LOT o... by neiowe Path Finder in Splunk Search 03-13-2023 0 25	0	25
Comparing index with inputlookup? Hi, I have a policy.csv file with 2 columns: user tags Andre IT Kleo ... by danutmatei Explorer in Splunk Search 03-13-2023 0 11	0	11
How to list out only the latest entries from events in search? Hi All, I'm looking to find all the latest entry of user, There should be no double entry for any userProfile -----> ... by smith_ Builder in Splunk Search 03-13-2023 0 1	0	1
How to use map to calculate fields data separately for each entity? Hi, I have a combination of consumer limits e.g, A=1000 b=500 c=500 d=200 rest=100So basically i want a list of all c... by amitrinx Explorer in Splunk Search 03-13-2023 0 1	0	1
How to ignore delayed events in splunk alert and alert only if log is actually missing? I have splunk query which runs every 5 minutes and alert if certain keyword is not logged in index in last 5 minutes.... by rohit_d Engager in Splunk Search 03-13-2023 0 1	0	1
How to trim zeros from event contents? Hello Splunkers!! I have below value S000081(=00003102+LCC000060-0000550S00003)I want to replace above value withS81(... by LogUx Motivator in Splunk Search 03-13-2023 0 8	0	8
Why is there forceful termination of the search process when using stats dc()? *Forcefully terminated search process with sid=1517416303.2383_ABC123 since its physical memory usage (36521.336000 M... by the_wolverine Champion in Splunk Search 03-13-2023 0 5	0	5
Search rest command for a list of dashboards using saves searches and macros? Hello Splunkers!! I want a list of dashboards and those dashboards are using saved searches & macros. How I can ach... by LogUx Motivator in Splunk Search 03-12-2023 0 1	0	1
Calculating next row based on the first value generated in the new column called 12days? I got to calculate the rest of the row based on the first value generated in the new column called 12days. Attempted ... by w344423 Explorer in Splunk Search 03-12-2023 1 2	1	2
Trigger alert after checking results for 3 minutes? Hello How can I trigger an alert after checking the results for 3 minuets So for example, if I want that the alert wi... by sarit_s Communicator in Splunk Search 03-12-2023 0 1	0	1
How to concatenate fields? Hello Splunkers!! I have two fields AND I want to concatenate both the fields.Location : 3102.01.03element : S82(=310... by LogUx Motivator in Splunk Search 03-12-2023 0 4	0	4
Recommended way to join large dataset from multiple data sources? Hi, I am new to Splunk and have very little knowledge. I am seeking help for following use case: Query1 gives process... by pmittal Engager in Splunk Search 03-11-2023 0 1	0	1
How does the cofilter command work? by chaitanya1 Observer in Splunk Search 03-11-2023 0 1	0	1
Multiple sourcetypes combine datasets similar to concept Index-to-Match Hello All,I have been scouring the community and other boards but for the life of me cannot create a SPL query to get... by TangSauce Engager in Splunk Search 03-11-2023 0 8	0	8
How to calculate time difference between two different searches for a common field? I have 2 different search queries and I want to calculate sum of differences between time of event 1 and event 2 (in ... by akidua Explorer in Splunk Search 03-10-2023 0 3	0	3
Duration between two events by day based on three or more fields? Hello - I need to calculate the average duration between two status types for a user type in a location in a region. ... by nu_learner Explorer in Splunk Search 03-10-2023 0 2	0	2