Splunk Search

Community Activity

Where can I find documentation for splunkd clean-dispatch command? ./splunk cmd splunkd clean-dispatch Where can I find the full documentation for this command which is used to "clea... by the_wolverine Champion in Splunk Search 02-03-2023 7 7	7	7
How to find out licence consumption by sourcetype? I find myself using Splunk Cloud and I see that the licensing is being exceeded on daily. In the Cloud Monitoring Con... by splunkcol Builder in Splunk Search 02-03-2023 0 1	0	1
When we talk about correlation, is it necessarily because a query is being made in 2 or more sources? A question, When we talk about correlation, is it necessarily because a query is being made in 2 or more sources? Or ... by splunkcol Builder in Splunk Search 02-03-2023 0 3	0	3
Need assistance creating a file that can be updated with hosts to exclude from a search I have a query where I'm looking for users who are performing large file transfers (>50MB). This query runs every da... by FPERVIL Explorer in Splunk Search 02-03-2023 0 1	0	1
Why does tstats not work with macros in child dataset? I try use macros to get external indexes in child dataset VPN, but search with tstats on this dataset doesn't work... by kyokkygo Engager in Splunk Search 02-03-2023 0 1	0	1
Why are application logs not getting indexed in Splunk? The internal logs flow to splunk UI but the applications logs are not flowing to splunk UI.We have a cluster with sev... by amand New Member in Splunk Search 02-03-2023 0 5	0	5
Help with advanced search for matching entry? Hello Community! I'm searching for a solution to highlight the "HostC", which has an AppC failure and no further log ... by RobertRi Communicator in Splunk Search 02-03-2023 0 2	0	2
Create 2 drop down based on start_date and end_date Hi,I need to create the 2 drop down for date where user can manually select start_date and end_date. And based on tha... by Neel88 Explorer in Splunk Search 02-03-2023 0 2	0	2
Why don't timestamp and _time match in search? Hi, i'm currently working on a props.conf and have different values from _time and the timestamp in my logs. What did... by brennson90 Path Finder in Splunk Search 02-02-2023 0 3	0	3
How to join with rex not working? I have 2 index, abc and bcz index abc data is in raw format like below. <random ip address>\|-NA\CAPITA\|5xxhxh545\|jljd... by harryhcg Explorer in Splunk Search 02-02-2023 0 5	0	5
Multi Select ALL value shows no data Hello,I am using 2 multi select dropdown. When its on the default value 'ALL' then it doesn't show any value in the... by Neel88 Explorer in Splunk Search 02-02-2023 0 1	0	1
Searching for matches in Output across entire range? (index="external" Feedback "Text") \| transaction channel startswith=POST endswith=received maxspan=1m maxevents=2 ... by interrobang Explorer in Splunk Search 02-02-2023 0 3	0	3
Construct multivariable histogram chart? I have a search along these lines "duration: " \| rex field=host "(?P<host_type>[my_magic_regex])" \| rex "duration... by cool_pbenjamin New Member in Splunk Search 02-02-2023 0 1	0	1
How to find inputlookup value in result? \| inputlookup suspicious_win_comm.csv lookup table contents has only keyword keyword <- field name tasklist ver i... by jamesjung01 Explorer in Splunk Search 02-02-2023 0 2	0	2
Why is Index bucket rolling faster than what is set in indexes.conf? Hello SplunkersI am pretty new to splunk admin .I have the following config set up in indexes.conf where I set up one... by power12 Communicator in Splunk Search 02-02-2023 0 8	0	8
How to achieve providing timestamp field when event does not contain time in it? Hello, I wanted a EVAL statement which manually adds a specified time may be "00:00:00" for the event containing only... by poojithavasanth Explorer in Splunk Search 02-02-2023 0 2	0	2
How to convert a large number to string with expressions of long and short scales, or neither. Numeral system macros for SplunkExamples of Single Value panel and Table.Hello,Just an announcement.I have created ma... by tfujita_splunk Splunk Employee in Splunk Search 02-02-2023 3 0	3	0
How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search? I am working on the saved search not index/lookup.I tried this code - \| eval date=strftime(strptime(<fieldname>,"%Y-%... by Neel88 Explorer in Splunk Search 02-02-2023 0 5	0	5
How to calculate the total count of occurances of a timestamp ? Basically I have a set of raw data with different time stamp in CCYYMMDDHHMMSS format. I want to list out the stats w... by naveenalagu Explorer in Splunk Search 02-02-2023 0 6	0	6
How to rename fields only from a certain search (Search1) OR (Search 2)? Hello everyone,I have a search in the following format:(index="index1" group=a) OR (index="index2" group=a)....Later ... by erikschubert Engager in Splunk Search 02-02-2023 0 1	0	1
Why are there missing fields for sample queries? Hi I'm implementing some searches provided by Splunk Threat Research Team to detect threats from AD logs. But I canno... by syamaguchi3 Explorer in Splunk Search 02-02-2023 0 2	0	2
How to exclude results using checkbox? I have the following search which returns a table of all hostnames and operating systems. \| inputlookup hosts.csv\| se... by tomapatan Contributor in Splunk Search 02-02-2023 0 4	0	4
Why do less events display while searching as * then search hostname while its showing if I search at the beginning? Hi Guys, Less Event displayed while searching as * then search hostname while its showing if I search at the beginnin... by AKBBB Explorer in Splunk Search 02-02-2023 0 11	0	11
How to join two table with aggrouped date value? A have two tables anda i want to relation this two tables by nember of events in a hour, i manage to make a SQL quer... by arriel96 Explorer in Splunk Search 02-02-2023 0 4	0	4
How to plot two sets of data in line chart when BOTH is selected? Hello Everyone, I have dashboard with token value as datacenter, which has 3 options from dropdown: Dublin ="*dbl_dc_... by super_edition Path Finder in Splunk Search 02-02-2023 0 4	0	4