Splunk Search

Community Activity

How to do the opposite of match()? I'm trying to do a DOES NOT match() instead of a match(). http://docs.splunk.com/Documentation/Splunk/6.1/SearchRefer... by thisissplunk Builder in Splunk Search 02-21-2023 1 4	1	4
How to add and divide field results for percentage? I'm trying to figure out the percent of successful authentications from out vulnerability scans. There is a field nam... by atebysandwich Path Finder in Splunk Search 02-21-2023 0 3	0	3
Field Alias Applied to Hostname - Events Matched But No Results? Hi,I am new to Splunk so please forgive me.I had created a field field, where if the hostname contains "-us" then r... by kbarton New Member in Splunk Search 02-21-2023 0 3	0	3
Why are results showing when there are none? Hi,I have an index= random_index which contains JSON data of a URL HTTP status code like {'availability':200,applicat... by lostcauz3 Path Finder in Splunk Search 02-21-2023 0 1	0	1
Do you have to use the props.conf method or GUI for a field extraction in a clustered environment? Hi, For field extractions in a clustered environment do you have to use the props.conf method or can you use the fiel... by joe06031990 Communicator in Splunk Search 02-21-2023 0 1	0	1
How to extract fields from json attributes? I am sending some traces from my service to Splunk using the OpenTelemetry Collector and the Splunk HEC exporter. My ... by sergimola Explorer in Splunk Search 02-21-2023 0 5	0	5
Parse a value and then use that as new query to search? Hi, I have an unusual scenario for the data I am working with and would like to see if it's even possible to extract ... by zakirhere New Member in Splunk Search 02-21-2023 0 2	0	2
Why is there alerting slowness issues after upgrade? Hi All, After splunk upgrade from 8.0 to 9.0.2 , i am facing the slowness in alerting to create ticket . Can anyone h... by AKBBB Explorer in Splunk Search 02-21-2023 0 0	0	0
How to parse these events? Hi Experts,I have below eventsEvent 1 : TRANEND TRANS ABENDS TRN1 ABN1 blah blahEvent 2 : TRANEND CICS_TRAN_Abends CI... by ravikumar_sri20 Engager in Splunk Search 02-21-2023 0 3	0	3
How to combine two search results? Hello  I need your help for a subject. I want to combine two search results and I need you help beacause I have a p... by anissabnk Path Finder in Splunk Search 02-21-2023 0 7	0	7
How to prevent DNS resolution? Hey all, Our raw syslogs are showing IP addresses of sourced events, but the results in Splunk is changing the IP add... by willspk Engager in Splunk Search 02-21-2023 0 3	0	3
How to enable search for specific index? I decided to make a search with following situation. However, I would like to enhance the performance that when user... by Raymond2T Path Finder in Splunk Search 02-21-2023 0 7	0	7
How to append multiple columns to get result I am looking to get the data in year, month, day, hour, minute and second basissearch criteria is index="abc" rex fie... by aaa2324 Explorer in Splunk Search 02-21-2023 0 2	0	2
Hybrid Splunk and ELK correlation? Hi, I hope that asking this question will not cause controversy. I currently manage a hybrid between Splunk and ELK, ... by splunkcol Builder in Splunk Search 02-21-2023 0 1	0	1
How can I move spath and mvexpand into props.conf? Hi, This work when I use it at search time: \| spath path=messageParts{} output=message \| mvexpand message \| rex field... by jnhth Explorer in Splunk Search 02-21-2023 0 0	0	0
Logging events on alerting? Hi Team,working on how to log individual rows in my search result table as individual events in Splunk. Below is a pi... by 11v New Member in Splunk Search 02-20-2023 0 1	0	1
How to join searches to search for inactive Splunk users? So i am trying to get a list of inactive splunk users. I have first tried just grabbing a list of all the users with ... by michaelnorup Communicator in Splunk Search 02-20-2023 0 2	0	2
Multiple values are showing in the single field after joining the lookup. Hello Splunkers,I have two lookups which are need to join. In lookup1.csv its containing the Rule name and the techni... by LRathinakumar Explorer in Splunk Search 02-20-2023 0 3	0	3
I cannot find data in field named version in my request? I cannot find data in field named version in my request. Please help me.See request belong \|mstats min(cpu_metric.p... by chimell1 Explorer in Splunk Search 02-20-2023 0 3	0	3
Help with search for specific dates? Hi, Could you help me in editing the below search index=test sourcetype="centino" \| stats count, values(change_asset... by smith_ Builder in Splunk Search 02-20-2023 0 7	0	7
How can I filter partial duplicates? Hello, I'm new to splunk (Internship) and couldn't find and answer. I'd need a way to filter my search. I'm curently ... by Yukie Observer in Splunk Search 02-20-2023 0 3	0	3
How to create a report from reading all data from csv file? Hello Splunkers, Help me please. I need a search to generate daily report looking for user's traffic in internal logs... by szrobag Explorer in Splunk Search 02-20-2023 0 4	0	4
How to extract fields values including keywords I have three fields like "field1=SGSIFASFFWR035Afield2=AXAZCBDM02fields3=ESESDFAADFSABBM00002in above examples I want... by Mr_Adate Explorer in Splunk Search 02-20-2023 0 6	0	6
Unable to run query '\| dbxquery query ? Hi, I'm quite fresh in splunk and need your help. Trying to combine spl with sql. tag 25 is event id same as sql ele... by mateusztumi84 Observer in Splunk Search 02-20-2023 0 3	0	3
Fix Error while deleting an alert? Hi , I'm trying to disable an alert but while doing so I'm getting an error. can you please help in this. Please ... by rahul2gupta Path Finder in Splunk Search 02-19-2023 0 7	0	7