Splunk Search

Community Activity

How to achieve Crowdsec json logs fields extraction? Hello Splunk's community, I got some difficulty for the fields extraction in crowdsec's logs which are format with JS... by NEHS Loves-to-Learn in Splunk Search 02-01-2023 0 1	0	1
Why time zone conversion does not always work (Zscaler ZPA)? I've been working on a Dashboard/Query that takes two date/time values (UTC) from Zscaler ZPA logs and converts to lo... by MSY Explorer in Splunk Search 02-01-2023 0 4	0	4
How to get count of each source by IP ? Query:\|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer)i want to get the count of each... by Vani_26 Path Finder in Splunk Search 02-01-2023 0 4	0	4
Is there a row limit to lookup tables? My boss asked me to generate a report of people connecting to our network from public VPN providers. I'm using this ... by ilhwan Path Finder in Splunk Search 02-01-2023 0 7	0	7
How to achieve regex for ingest actions to match a list of EventCodes? Hello, I am trying to get regex to work in ingest actions to match a list of event codes from Window Security Logs. ... by garrywilmeth Explorer in Splunk Search 02-01-2023 0 4	0	4
How to run two searches based on timestamp? I have a dashboard showing website user journey data by reading various elements from a log message. Now the struct... by majeedk_nbg Engager in Splunk Search 02-01-2023 0 3	0	3
What is an alternative to timechart when needing aggregation on 2 by clauses? I am struggling to figure out how to get the Visualization that I want, if even possible.... Timechart works great fo... by dmoberg Path Finder in Splunk Search 02-01-2023 0 2	0	2
How do I concatenate two fields into a string? I have two fields, application and servletName. I'd like to have them as column names in a chart. I'm currently try... by brettgladys Explorer in Splunk Search 02-01-2023 9 8	9	8
How to use stats dc and get last time of occurrence? Hi! im trying to detect multiple user access from the same source (same mobile device). Im feeding splunk with logs f... by dieguiariel Path Finder in Splunk Search 02-01-2023 0 4	0	4
Need help on Dashboard related issue? Above is the title of my dashboard, need to add the present date along with the title For the above one we need to... by Renunaren Loves-to-Learn Everything in Splunk Search 02-01-2023 0 0	0	0
How to form query for nested field (Json array) searching? Hi I have a field(event_details) that contains a JSON array.Record 1:{<!-- -->"event_details":[{"product_id":"P002","price":1... by Austin_James Engager in Splunk Search 02-01-2023 0 6	0	6
Has anyone ran into Eventtype "xxxxxxxxx" does not exist or is disabled. Search results only for a certain period? Hi, My client has encountered the following issue below and I was just wondering if anyone has encountered something ... by mohdmikhael Explorer in Splunk Search 01-31-2023 0 7	0	7
Okta Data - Appending to lookup table question I have 5 separate endpoints for our Okta environment that I'm pulling into Splunk. The data is all event driven so if... by jpsheridan Engager in Splunk Search 01-31-2023 0 1	0	1
How do I refine this search to use 'my_report_date' instead of _time? Hi all - I'm attempting to write a query using earliest/latest based off a date field in the event, not _time. I've t... by mistydennis Communicator in Splunk Search 01-31-2023 0 1	0	1
How to combine field values into singular value? I feel like there's a simple solution to this that I just can't remember. I have a field named Domain that has 13 val... by michaeler Communicator in Splunk Search 01-31-2023 0 2	0	2
How can I combine multiple fields with a common name results in to single column? How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so... by satyaallaparthi Communicator in Splunk Search 01-31-2023 0 1	0	1
How do I force a timestamp to be recognized as UTC in a query for strptime? I have a datasource that passes the time as a string like the following: "2018-08-07T17:38:16.352" This string is ... by briancronrath Contributor in Splunk Search 01-31-2023 0 9	0	9
Network Toolkit: How to ping hosts from a search I have a search that gives me a column with hostnames host A B C I am trying to use the network toolkit application... by rohitmaheshwari Explorer in Splunk Search 01-31-2023 0 3	0	3
How to reverse a real-time query to it's original alert/report/dashboard? Hi guys. I'm currently working to fix all "real-time" jobs running on my company and I came across one job that I can... by NizanCohen Explorer in Splunk Search 01-31-2023 0 2	0	2
Is it possible to get user details from the _configtracker index? Hello I've been looking at the new _configtracker index and I would like to know how I could get the User details ass... by ewanbrown967 Engager in Splunk Search 01-31-2023 0 3	0	3
How to create raw field? Hello everyone, I have next one task: I want to collect (with collect command) information which I got after stats. P... by bosseres Contributor in Splunk Search 01-31-2023 0 1	0	1
How to change status of the above message to success status? I have a message in my events like below "Main function executed successfully." I need to change status of the above ... by Renunaren Loves-to-Learn Everything in Splunk Search 01-31-2023 0 2	0	2
Why is data summary not displaying? When I am click on my data summary, it is not displaying anything just showing Any suggestions?Thanks. by akankshayadav Path Finder in Splunk Search 01-30-2023 0 4	0	4
How to group by multiple fields? Hi everyone, I'm kinda new to splunk. I have two indizes: Stores events (relevant fields: hostname, destPort) ... by erikschubert Engager in Splunk Search 01-30-2023 0 3	0	3
How to inner join with field subtraction on two fields part of different searches? Hi, I am using inner join to form a table between 2 search, search is working fine but i want to subtract 2 fields in... by batham Explorer in Splunk Search 01-30-2023 0 2	0	2