Splunk Search

Community Activity

	How to multisearch using values from more than one lookup? I have two lookupsRLQuotas: Endpoint, Endpoint Name, filter, quota, WindowRLFilters: Attribute, filterI want to loop ... by amitrinx Explorer in Splunk Search 01-10-2023 0 1	0	1
	Count all events matching field value? My data looks something like this The status can be either SUCCESS or FAILED, I want to count the total number of ev... by sjs Path Finder in Splunk Search 01-10-2023 0 2	0	2
	How does anomalousvalue work in my search? I'm trying to implement a search query in splunk to get anomalous values around a particular field in the service eve... by sharsmail Engager in Splunk Search 01-10-2023 0 3	0	3
	What's wrong with query not getting data? could someone please let me know where I'm going wrong in my query ?\| spath service_roles{} output=service_role\| stat... by nikhil29 Loves-to-Learn Everything in Splunk Search 01-10-2023 0 2	0	2
	How to set up an Alert when the count exceeds 100 in a week? I am setting up an alert to notify when a message is received more than a 100 times in a week. I figured it out for t... by Rapidz Explorer in Splunk Search 01-10-2023 0 5	0	5
	Count occurrences of string and put them in table row wise? I am trying to find few strings in my search query and count occurrences of them and I want to put them in a two colu... by Vivekmishra01 Explorer in Splunk Search 01-10-2023 0 2	0	2
	Is it possible to match a string in a lookup against a keyword? Hi Splunk Community, I wondered if there was any way to match a keyword against a string in a lookup. For example:... by Ker_splunk Engager in Splunk Search 01-10-2023 0 2	0	2
	Configure alert to send email to a certain field value? Hello everyone, I have the following results when running my search: _time use... by evallja Path Finder in Splunk Search 01-10-2023 0 1	0	1
	Why won't If statement evaluate as true? When I place event.code into an if statement, it will not evaluate as true Currently I have this code: index = wind... by anjuliwyles Engager in Splunk Search 01-10-2023 0 2	0	2
	How to chart a delta instead cumulative values? My current project polls a device every 15 minutes to pull a counter which is then charted. Thanks to members here, I... by neilmac64 Path Finder in Splunk Search 01-10-2023 0 16	0	16
	Splunk search to remove duplicated ips? Hi All, Greetings! Need help on splunk query, I have 2 indexes assets and vulns, am trying to build report to analyze... by kpavan Path Finder in Splunk Search 01-10-2023 0 3	0	3
	Are there any use cases for AWS VPC FlowLogs? Currently we are ingesting a big amount of AWS VPC FlowLogs in to the Splunk and I am wondering if there is any usage... by robertisimos Observer in Splunk Search 01-10-2023 0 2	0	2
	Do I need to add create_empty=true and override_if_empty=false? Hello. I'm fairly new to Splunk and SPL so bear with me here. I have the following scenario: I have an existing looku... by finnpalm Explorer in Splunk Search 01-10-2023 0 4	0	4
	Is there any way to have a search only pick up user account logins? Hello everyone, I have a search for after hour logins between 6pm and 6am. Right now I have event codes 4625 and 4624... by Erilope Explorer in Splunk Search 01-10-2023 0 3	0	3
	How to remove ( \" ) characters from search? In few logs I can see escape character is also printed. My rex is working fine when i am testing it on regex101.com b... by MrIncredible Explorer in Splunk Search 01-10-2023 0 4	0	4
	What are the possibilities to achieve Thread Dump & Heap Dump Log Collection? Hi All, I need to collect "Thread Dump" and "Heap Dump" of the application into Splunk. What are all the possibiliti... by ramanan Engager in Splunk Search 01-10-2023 0 1	0	1
	Sending data to Splunk Cloud via intermediate forwarder? I have Splunk UF 7.0.3 that I want to send logs from to Splunk Cloud. However, the UF doesn't support httpout so I a... by jmr44 Explorer in Splunk Search 01-09-2023 0 1	0	1
	How can I get the last index of my target value for a multi-value field ? I want to get the last index of my target value for a multi-value field. For example, idchain1SendMessageCheckMessage... by Jackiifilwhh Path Finder in Splunk Search 01-09-2023 0 12	0	12
	Help with Regex extraction from request please help extract adsId,offerName, currentProductDescription, offerAccountToken, offerType, offerIdentifiermessage=... by siksaw33 Path Finder in Splunk Search 01-09-2023 0 7	0	7
	How to compare same field with values for equality? Hi Experts, I would like to compare values in same field (vlan_ids) for equality based on a machine serial (hyp_ser... by satish Explorer in Splunk Search 01-09-2023 0 4	0	4
	How to search all indexes with the specified HASH-es in a lookup file? Hello, I have created and imported a lookup file ex. "hashes.csv" and I have pasted there a list of 500+ hashes. I wa... by evallja Path Finder in Splunk Search 01-09-2023 0 2	0	2
	How to extract subword from a string? Hi all,I want to extract the following word with rex expression:ABC\qq1234 expected result: qq1234Please note that th... by aa0 Path Finder in Splunk Search 01-09-2023 0 2	0	2
	How to search for same field with different ip address? Happy New Year to all of you. So I have syslog in which we have details of the devices and switches. The requirement ... by niks987 Explorer in Splunk Search 01-09-2023 0 0	0	0
	How to extract fields in json format? i need to extract fields which are in json format i have been trying using spath command for extracting the following... by vineela Path Finder in Splunk Search 01-09-2023 0 8	0	8
	How to merge two regex in single query? I'd want to merge two regex strings into a single one; any suggestions would be greatly appreciated.Reference Search ... by Rakzskull Path Finder in Splunk Search 01-09-2023 0 2	0	2