Splunk Search

Community Activity

	How to write regex to extract value in between two phrases? Hi, I need help to extract a value from field named "message". Field "message" value is as below: The process C:\Wind... by syazwani Path Finder in Splunk Search 02-19-2023 0 2	0	2
	How to use lookup dnslookup to get list of hostnames from a CSV file? Hello, I am trying to obtain IPs from Hostnames. I am using inputlookup to get the list of hostnames from a CSV file.... by Kitag345 Explorer in Splunk Search 02-19-2023 0 2	0	2
	How to detect a flapping load balancer - up to down to back 5x times? Hi all,First time posting here so please be patient and I am relatively new to the Splunk environment, but I am strug... by amoshos Loves-to-Learn in Splunk Search 02-19-2023 0 3	0	3
	How can I integrate Splunk and Freshdesk? How can I integrate Splunk and Freshdesk? I have not seen anything meaningful online so far. by rhugo Observer in Splunk Search 02-19-2023 0 5	0	5
	Dedup is removing the duplicate fields which is having the Unique value in other column Hello Splunkers,I have used a query in the search for mitre fields extraction and after the extraction i have got the... by LRathinakumar Explorer in Splunk Search 02-19-2023 0 1	0	1
	Is it possible to find the storage (logs) used by application/services in a particular index for particular time range? Is it possible to find the storage (logs) used by application/services in a particular index for particular time rang... by kcliff Engager in Splunk Search 02-19-2023 0 1	0	1
	How to have multiple conditions for each searchmatch case? Hello, I am currently trying to figure out how to combine the below three searches with different conditions into one... by herachini Observer in Splunk Search 02-19-2023 0 1	0	1
	Looking for matching events with "where" and calculating them I'm creating a query where I want to get an id from a log in one side (first search) andin the second search I just w... by MrFaria25 Observer in Splunk Search 02-18-2023 0 7	0	7
	How to get count of successful events after failure? Hi, I have a use case where in i want to find out how many download api failed for a given document and how many out ... by Pjyoti Engager in Splunk Search 02-18-2023 0 6	0	6
	How to manually save a saved search which contains backslashes \ in the query to savedsearches.conf? I have a splunk query as below which contains a lot of backslashes index="ABC" os="Win" FileName="*\\Programs\\Startu... by pavanae Builder in Splunk Search 02-18-2023 0 1	0	1
	What time should be when searching old logs? dujas_1-1676472668808.pngI am using Splunk searching old log files and the _time is different from log time, would th... by dujas Explorer in Splunk Search 02-18-2023 0 3	0	3
	Is there a way in Splunk to determine how a user arrived at a destination IP? Is there a way in Splunk to determine how a user arrived at a destination IP? Did they click a link from a certain we... by redhonda03_2 Engager in Splunk Search 02-17-2023 0 3	0	3
	How to extract 2 fields in same "rex"? Hi, I have a search where I am attempting to extracting 2 different fields from one string response using "rex": ... by dickersons Explorer in Splunk Search 02-17-2023 0 5	0	5
	How to find duplicate field name within event? My splunk entry is firstName="Tom" lastName="Jerry" middleName="TJ" dob="1/1/2023" dept="mice" status="202" dept="hou... by dummy1281 Engager in Splunk Search 02-17-2023 0 1	0	1
	How to see the forwarder management list of clients search? On Splunk 9.0.0 on windows on one of our dedicated Deployment servers when we go to Settings \ Forwarder Management i... by Gregski11 Contributor in Splunk Search 02-17-2023 0 2	0	2
	Splunk bug: string replace function fails if the string to be replaced starts with "+" character replace() function produce an empty string if the string to be replaced starts with a "+" character.this search with ... by Dev999 Communicator in Splunk Search 02-17-2023 0 3	0	3
	How to create a correlation search based on data provided by SANS Threat Intelligence? Hello, I would like to request guidance on how to create a correlation search based on data provided by SANS Threat... by Kitag345 Explorer in Splunk Search 02-17-2023 0 1	0	1
	How do I compare for todays and yesterdays stats/ report? How do i compare for todays let say 9a-10a with yesterdays 9a-10a stats side by side? Is it possible on 1 qeury?index... by mikeyty07 Communicator in Splunk Search 02-17-2023 0 1	0	1
	Is there a way to use a span that is equal to the time range picker? source=PR1 sourcetype="sap:abap" EVENT_TYPE=STAD EVENT_SUBTYPE=MAIN TCODE="ZORF_BOX_CLOSING" SYUCOMM="SICH_T" ACCOUNT... by Stijn Loves-to-Learn in Splunk Search 02-17-2023 0 1	0	1
	How to monitor three users? Hi My system is Linux. Am trying to monitor 3 users in an index. The last time they login, IP address etc. There a... by woodlandrelic Path Finder in Splunk Search 02-17-2023 0 4	0	4
	How to extract badly formatted JSON? Hi I'm trying to extract some json values into tables for a dashboard. The log line that i'm using is something like ... by markangeltruema Engager in Splunk Search 02-17-2023 0 1	0	1
	How to write rex to remove? Hi, I have the bellow event: {"log":"2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359 1 ... by joe06031990 Communicator in Splunk Search 02-17-2023 0 4	0	4
	How to achieve field with a value containing commas? Unfortunately I have no control over the log data formatting... it is in format: Field1=Value1\|Field2=Value2\| ... \|C... by Yossarian622 Engager in Splunk Search 02-16-2023 0 6	0	6
	How to timechart the time differences between (ITNM) events / phases? I have the following data that I'm trying to timechart the differences between: 2023-02-16T16:14:04: Data Processing ... by meleschi Explorer in Splunk Search 02-16-2023 0 1	0	1
	How to merge two counts into one search Hello Splunkers, I have the following raw data2023-02-15T12:43:06.774603-08:00 abc OpenSM[727419]: osm_spst_rcv_proce... by power12 Communicator in Splunk Search 02-16-2023 0 2	0	2