Splunk Search

Community Activity

Is it possible to use stats inside a join command? I have a user table which shows which department each user belongs to. I want to join this with another table on User... by buttsurfer Path Finder in Splunk Search 02-12-2023 0 3	0	3
Searching for data around a time frame? Hello i am new I have combined data from cyclogs,adserver logs and firewall logs how can i search for data that happe... by Chris231289 Loves-to-Learn Lots in Splunk Search 02-12-2023 0 4	0	4
Why doesn't the stramstats work when I group by certain field? The search below doesn't work when i add department in the group by fields in the streamstats commands. It works with... by buttsurfer Path Finder in Splunk Search 02-12-2023 0 1	0	1
Rexgex Non-capturing group - still capturing? rex field=title "(?titleNEW(.*?)(?:-))" I have this rex command above but it still outputs the dash at the end which... by tb5821 Communicator in Splunk Search 02-11-2023 0 2	0	2
Why am I getting Invalid lookup table? I want to use a lookup table, but every time, I add the command to my search "\| lookup name_of_my_lookup", I'm gettin... by szabados Communicator in Splunk Search 02-10-2023 1 5	1	5
Help with search query for non-reporting IP addresses? Hi All,I have a field name ip_address which has 50 IP values in it. at every 5mins interval, I will receive the same... by vinothkumark Path Finder in Splunk Search 02-10-2023 0 1	0	1
How to take the result from a timechart 'sum by' and multiply it by another value? Hello, what I am trying to do in this search is sum the total CPU seconds, by report class, for a one day period. Onc... by jhewel2495 Engager in Splunk Search 02-10-2023 0 1	0	1
How to search a list of names and compare it to a different list of names? I have two lists: one has a list of hostnames and another has a list of prefixes to hostnames. I would like to create... by atebysandwich Path Finder in Splunk Search 02-10-2023 0 1	0	1
How to join two searches using one field AND a time constraint between the correlated events? Hi,I am trying to get a list of workstations trying to connect to malicious DNS using PaloAlto and SYSMON logs.From P... by corti77 Contributor in Splunk Search 02-10-2023 0 5	0	5
How to search earliest time in correlation search? Hi, I'm trying to create a correlation search in splunk unable to figure out options Time range earliest time/latest... by smith_ Builder in Splunk Search 02-10-2023 0 3	0	3
Why can't I generate data table of statistics? Hi, My overall goal is to create a resulting data table with headings including HourOfDay, BucketMinuteOfHour, DayOfW... by POR160893 Builder in Splunk Search 02-10-2023 0 6	0	6
Is there a way to get logs in JSON format for an API call from a Springboot Application? Is there a way to get logs in JSON format for an API call from a Springboot Application? by kanurag1795 Engager in Splunk Search 02-10-2023 0 1	0	1
How to create a search for delay of data in Splunk? Hello all As a splunk in an early station  I currently have the following challenge:We have many indexes and we want... by ursfischer Engager in Splunk Search 02-10-2023 0 3	0	3
Why can't I plot timechart to investigate seasonality in index data? Hi, I am running the following query to check seasonality in my index:index="ABC\| timechart count by _time \| timechar... by POR160893 Builder in Splunk Search 02-10-2023 0 1	0	1
How would I combine data in Splunk so I can view them on one page? Hi i am new, I have 2 excel documents, one containing firewall logs and the other containing Sys logs. how would i c... by Chris231289 Loves-to-Learn Lots in Splunk Search 02-10-2023 0 2	0	2
How to create dashboards which are useful for Juniper team to check if any down or outage? Hi All, Good day, I have juniper data in Splunk using sourcetype = juniper* but need some searches to create dashboar... by sekhar463 Path Finder in Splunk Search 02-10-2023 0 3	0	3
How to create alert when error_count is continuously increasing over _time for any group mentioned in column? I want to create a alert that will notify if error_count is continuously increasing over time for any of the group me... by StringBee Explorer in Splunk Search 02-10-2023 0 6	0	6
How to extract usernames from Windows event log 4648 in Splunk? hi Have a large index that contains event logs. Trying to extract usernames of EventID 4648. How can I get this displ... by Pundittech Loves-to-Learn Lots in Splunk Search 02-09-2023 0 4	0	4
How to exclude or select events based on value from key/value array? Hi All, Our JSON payload looks like as shown below. The msg.details array can have any number key/value pairs in any ... by btsr Explorer in Splunk Search 02-09-2023 0 1	0	1
Why is eval failing after join? index=na160 starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d"\|stats co... by rakeshkiit Engager in Splunk Search 02-09-2023 0 4	0	4
How to rename Splunk column names? Hi, I have a query that evaluates the value of a variable like this ...\|eval var1= var210\|....* where var1 and var... by nibinabr Communicator in Splunk Search 02-09-2023 0 8	0	8
Is there a delay in the Splunk API server 'seeing' events? Is there a delay in the Splunk API server 'seeing' events that are already indexed?I use the Splunk API to query logs... by sonamchauhan Engager in Splunk Search 02-09-2023 0 1	0	1
How to match fields from logs with CSV and create an alert? I get logs from a system which has a field that contains names. Lets say Abc.xyz is the name of the field. I have a l... by ap666 Explorer in Splunk Search 02-09-2023 0 5	0	5
How to monitor deviation to log volume? I am trying to monitor drop in events per index. What is the best way to get a baseline and detect deviation to the v... by Splunk77 Explorer in Splunk Search 02-09-2023 0 3	0	3
Lookup filtering performance on very large lookups This is not a question, rather I am sharing something that I discovered with a Splunk OnDemand support call. I though... by lindonmorris Explorer in Splunk Search 02-09-2023 1 1	1	1