Splunk Search

Community Activity

Converting units in my classification breaks my alert? Hi, I had a good base search for a calculation and alerting when an upload/download happens, but now I tried to tidy... by klaudiac Path Finder in Splunk Search 02-04-2023 0 4	0	4
How to write a search to convert bytes to KB, MB, and GB, and display them based on IP of top users? Hi Splunkers I am unable to convert no. of bytes to KB, MB, and GB based on the bytes. I have used the search: s... by SanthoshSreshta Contributor in Splunk Search 02-04-2023 0 13	0	13
Does Splunk have an easier way to get FileSize to human readable format? I'm surprised splunk doesn't have an easier way to get a human readable format by passing it the field you want it to... by tb5821 Communicator in Splunk Search 02-04-2023 0 11	0	11
Having trouble with routing problem with _TCP_ROUTING? Hi, I am having trouble for routing the logs(first.txt) to separate index1/2 and second.txt to index3/4. below are ... by okumar1 Engager in Splunk Search 02-03-2023 0 2	0	2
How do I correlate across two log sources? I am writing a query to correlate across two different indexes. One index has userID field. I want the query to match... by Splunk77 Explorer in Splunk Search 02-03-2023 0 1	0	1
How to display all the values of the multi-value column(array-like) in different rows? I have the raw data in format :{"col1":"1",{col2":"2"},{.........(continue)which if I have to visualize using https:/... by kasis152 Explorer in Splunk Search 02-03-2023 0 6	0	6
Interesting fields generated from the AWS Add-On not showing up in Search&Reporting App? Hi,I have a CloudTrail data source feeding into the AWS Add-On app on a single-instance Splunk deployment.If I go to ... by mcirrici Explorer in Splunk Search 02-03-2023 0 1	0	1
Why am I unable to output from subsearch? I am having 2 index - abc - FieldA, E, F bcz - Field B, C, D. Where I want to return D, C and F where value from fiel... by harryhcg Explorer in Splunk Search 02-03-2023 0 4	0	4
Recommended architecture for my specifications? Hello, I currently have an intake that is exceeding 100GB per day and I would like to know what are the best practice... by splunkcol Builder in Splunk Search 02-03-2023 0 1	0	1
Replicated scheduled search not removed- Can I know the Period of the scheduler search and where it is replicated from? Hi, I keep receiving the warning message related "Search peer xxxxxx03 has the following message: Dispatch Command: T... by louismai Path Finder in Splunk Search 02-03-2023 0 1	0	1
Dispatch directory is full. How do we clear it up? We get an error message in the UI, saying that the dispatch directory is full. How can we clean it? We have two SHs..... by ddrillic Ultra Champion in Splunk Search 02-03-2023 1 15	1	15
Where can I find documentation for splunkd clean-dispatch command? ./splunk cmd splunkd clean-dispatch Where can I find the full documentation for this command which is used to "clea... by the_wolverine Champion in Splunk Search 02-03-2023 7 7	7	7
How to find out licence consumption by sourcetype? I find myself using Splunk Cloud and I see that the licensing is being exceeded on daily. In the Cloud Monitoring Con... by splunkcol Builder in Splunk Search 02-03-2023 0 1	0	1
When we talk about correlation, is it necessarily because a query is being made in 2 or more sources? A question, When we talk about correlation, is it necessarily because a query is being made in 2 or more sources? Or ... by splunkcol Builder in Splunk Search 02-03-2023 0 3	0	3
Need assistance creating a file that can be updated with hosts to exclude from a search I have a query where I'm looking for users who are performing large file transfers (>50MB). This query runs every da... by FPERVIL Explorer in Splunk Search 02-03-2023 0 1	0	1
Why does tstats not work with macros in child dataset? I try use macros to get external indexes in child dataset VPN, but search with tstats on this dataset doesn't work... by kyokkygo Engager in Splunk Search 02-03-2023 0 1	0	1
Why are application logs not getting indexed in Splunk? The internal logs flow to splunk UI but the applications logs are not flowing to splunk UI.We have a cluster with sev... by amand New Member in Splunk Search 02-03-2023 0 5	0	5
Help with advanced search for matching entry? Hello Community! I'm searching for a solution to highlight the "HostC", which has an AppC failure and no further log ... by RobertRi Communicator in Splunk Search 02-03-2023 0 2	0	2
Create 2 drop down based on start_date and end_date Hi,I need to create the 2 drop down for date where user can manually select start_date and end_date. And based on tha... by Neel88 Explorer in Splunk Search 02-03-2023 0 2	0	2
Why don't timestamp and _time match in search? Hi, i'm currently working on a props.conf and have different values from _time and the timestamp in my logs. What did... by brennson90 Path Finder in Splunk Search 02-02-2023 0 3	0	3
How to join with rex not working? I have 2 index, abc and bcz index abc data is in raw format like below. <random ip address>\|-NA\CAPITA\|5xxhxh545\|jljd... by harryhcg Explorer in Splunk Search 02-02-2023 0 5	0	5
Multi Select ALL value shows no data Hello,I am using 2 multi select dropdown. When its on the default value 'ALL' then it doesn't show any value in the... by Neel88 Explorer in Splunk Search 02-02-2023 0 1	0	1
Searching for matches in Output across entire range? (index="external" Feedback "Text") \| transaction channel startswith=POST endswith=received maxspan=1m maxevents=2 ... by interrobang Explorer in Splunk Search 02-02-2023 0 3	0	3
Construct multivariable histogram chart? I have a search along these lines "duration: " \| rex field=host "(?P<host_type>[my_magic_regex])" \| rex "duration... by cool_pbenjamin New Member in Splunk Search 02-02-2023 0 1	0	1
How to find inputlookup value in result? \| inputlookup suspicious_win_comm.csv lookup table contents has only keyword keyword <- field name tasklist ver i... by jamesjung01 Explorer in Splunk Search 02-02-2023 0 2	0	2