Splunk Search

Community Activity

Trying to split the message text in a Windows event log We are collecting Windows 2008R2 Printer server logs and have identified event_id = 307 as the log that contains info... by ssemone New Member in Splunk Search 03-02-2023 0 6	0	6
Will increasing Elasticsplunk application timeout resolve this error? HelloI am currently managing a hybrid between Splunk and ELK (Elastisearch Logstash Kibana). Logs supporting syslog... by splunkcol Builder in Splunk Search 03-02-2023 0 1	0	1
How do I find this string? my string is "abcdxyz\|11.2.0000\|56\|12120\|32\|1005\|15\|32\|7742\|5\|54\|336\|446\|203473<" above string is string in huge... by ajit4242 Engager in Splunk Search 03-02-2023 0 7	0	7
Calculate total and percentage of Incidents? Hi friends, I am trying to get total resolved incidents, open incident and total incidents each day. I am getting t... by priya1926 Path Finder in Splunk Search 03-02-2023 0 1	0	1
Why does Stats command ocassionally produces job search components in results? I have the following stats search: index=servers1 OR index=servers2 DBNAME=DATABASENAME source="/my/log/source/*"... by splunkkitty Path Finder in Splunk Search 03-02-2023 0 8	0	8
Help with search lookup for logs that stopped sending in the past 24 hours? Hi All, I started working in splunk just few months ago and new to splunk. Can anyone help me with some idea please..... by RanjiRaje Explorer in Splunk Search 03-02-2023 0 5	0	5
Moving data from stash back to an index? Hello all, following use case: We wanted to create a backup of some json data. For this we created a new index called... by claudiaG Engager in Splunk Search 03-02-2023 0 1	0	1
Extract data from one field ot another using Regex Hello,(I will use fictional data to give examples)I'm trying to use regex to extract data from one field to another, ... by PTC_ Explorer in Splunk Search 03-02-2023 0 1	0	1
Calculating average by week? how do Icalculate the average number of events for each week for this search index=dcl EventCode=4740 \| eval date=str... by vonsolo29 Explorer in Splunk Search 03-02-2023 0 3	0	3
Removing unwanted records for a single output? Hi There, These results are for a particular serial number, we do have many results like this for several serial ... by smanojkumar Contributor in Splunk Search 03-02-2023 0 10	0	10
What Search can monitor Password Changed not by Automation? Hi Splunk Community, I need a Splunk Query that monitors a password change in the DC log source that was not performe... by Eyal Path Finder in Splunk Search 03-02-2023 0 4	0	4
How to create an alert with two condition to meet by sequence before the alert can trigger? Hi, I want to create an alert with two condition to meet by sequence before the alert can trigger. We are using event... by syazwani Path Finder in Splunk Search 03-02-2023 1 5	1	5
How to extract the user and move it to a field in Splunk? How to extract the following user and move it to a field in Splunk?message: xad="/home/andy"message: xad="/home/georg... by LearningGuy Motivator in Splunk Search 03-02-2023 0 2	0	2
Splunk DB connect: How to avoid output duplicate data into database? I am using Splunk DB connect to push my data from Splunk to oracle database. However, I can't not figure out how to a... by amoswuchi Loves-to-Learn Lots in Splunk Search 03-02-2023 0 5	0	5
Adding delimiter to a field values Hi all,I need some help in creating a new field,I have a field like followingField 1AABBCCDDEEFFAAAABBBBCCCC Id like ... by Laxman24 Explorer in Splunk Search 03-02-2023 1 4	1	4
Why does my search empty during run? Hi all.I have a search that searches a large amount of events.Its run on fast mode, on the statistics page.When i sta... by michaelnorup Communicator in Splunk Search 03-02-2023 0 3	0	3
DateParserverbose warning logs despite having proper Time format and prefix in props.conf Hey community,Need your help!!!!We have lot of internal warn logs for DateParserverbose issue in our splunk prod envi... by likithgowda New Member in Splunk Search 03-02-2023 0 4	0	4
SPL search to find the license purchase and expiration date in Splunk Cloud? As rest command has some limitation on splunk cloud. How to find the license purchase date and expiration date on spl... by restinlinux Explorer in Splunk Search 03-01-2023 0 0	0	0
Stats for multiple fields in the same table? I have logs like below: { [-] TransactionName: "my TransactionName" type1Error: NA eventTime: 2023-02-28... by Nidd Path Finder in Splunk Search 03-01-2023 0 4	0	4
Dedup not removing results that are duplicates Hi All!Had a look around but couldn't find an answer to this. I'm trying to do a search where I track a users log in ... by Southy567 Explorer in Splunk Search 03-01-2023 0 1	0	1
How to extract rex specific data from Splunk log? We have a rule engine that assigns category codes to items. The category codes are assigned per location. We want to ... by AnirbanG Loves-to-Learn Lots in Splunk Search 03-01-2023 0 5	0	5
How to perform splunk subsearch through Splunk java SDK? how to perform splunk subsearch through splunk java SDK by kanurag1795 Engager in Splunk Search 03-01-2023 0 1	0	1
What is the Default bucketing time and retention policy? Hello to all I would like to know the default time set for hot, warm, cold and frozen buckets. I also want to know wh... by splunkcol Builder in Splunk Search 03-01-2023 0 0	0	0
Help searching IIS/W3C log for parent URL? We're indexing a set of standard IIS W3C logs into our indexer and have a need to obtain a list of the parent sites f... by marshallsuk Engager in Splunk Search 03-01-2023 0 1	0	1
What is the difference between $user$ and user=$user$ ? Hello, I can see in many Use Cases examples that tokens are using alternately in drill down searches:$user$ and user=... by suspense Explorer in Splunk Search 03-01-2023 0 2	0	2