Splunk Search

Community Activity

Search to get all domain user account modifications/additions/removals? Hello, new to using splunk across a domain and I am attempting to get a query that details any domain user account ch... by informatika Loves-to-Learn in Splunk Search 12-24-2022 0 3	0	3
how to get 90% of max execution time I have a requirement to pull 90% of max execution time. Ex: I have 10 requests for an hour and it's execution times a... by avadhutha Explorer in Splunk Search 12-24-2022 0 1	0	1
Ignoring alerts when user has been removed and added back into AD group within an hour? We currently have an report every morning that shows which users have been removed from a particular AD group from th... by st1 Path Finder in Splunk Search 12-24-2022 0 3	0	3
Can you have 3 fields within a chart Hi Splunk Community,I was wondering if it was possible to have a chart that was made up from 3 fields.... I have alre... by zoebanning Path Finder in Splunk Search 12-24-2022 0 2	0	2
multivalue field not ordered properly Hi,i'm trying to calculate the average events weekly by their severity and comparing the daily amount with the weekly... by Dantuzzo Loves-to-Learn Lots in Splunk Search 12-23-2022 0 1	0	1
How to achieve field extraction txt delimiting by space? Hello, I am trying to extract the below 201 text highlighted in red below as one separate field from two separate eve... by user33 Path Finder in Splunk Search 12-23-2022 0 4	0	4
Why doesn't "Wrap results" fit to the screen (or is there a way?) After I perform a search and click the "Format" Icon above the search results, there is an option for "Wrap Results".... by sasank Explorer in Splunk Search 12-23-2022 1 0	1	0
Search Search query for including non-business hours and weekends ie exclude Monday to Friday 9am to 5pm by Anu189 New Member in Splunk Search 12-23-2022 0 1	0	1
Set Scheduled Search I want to set a Schedule for my search to find the data sent by user in our system . This is my search to catch each ... by abazgwa21cz Explorer in Splunk Search 12-23-2022 0 3	0	3
Can we pass main search result value into subsearch as search command? mainsearch\| stats count(_raw) as Cou by hour\|join hour [ subsearch\| head -$Cou$ ] Above mentioned command is not w... by avadhutha Explorer in Splunk Search 12-23-2022 0 2	0	2
Field extraction regex issues Having some issue with extraction.source:SESSION: Session closedClient address: 123.CCCCCCCClient name: CC222C22[123.... by svarendorff Explorer in Splunk Search 12-22-2022 0 5	0	5
How to spath or rename commands not extracting field / values? I have a field called properties.requestbody. I would like to have this field broken out based on the field and valu... by bt149 Path Finder in Splunk Search 12-22-2022 0 9	0	9
Converting regular query to tstats? I want to convert this query to tstats for faster searching can you help me convert it index=win-security host=srv001... by leagawa New Member in Splunk Search 12-22-2022 0 1	0	1
How to find results present in index and not in lookup table? Hi All,I have enquired this problem earlier in older threads, however, could not get a working answer, thus, created ... by Taruchit Contributor in Splunk Search 12-22-2022 0 5	0	5
How can I format field with relative fieldname ? My task is format field "app" with relative fieldnameHow can I use format command to format as example: (app=app1 O... by Chaser Explorer in Splunk Search 12-22-2022 0 8	0	8
How to get top 20 with 2 conditions? I have some log, and i want get top 20 with 2 conditions: I user: index="fortinet" \|top srcip srcname but in chart d... by langtuphidao New Member in Splunk Search 12-22-2022 0 3	0	3
I have no queued tasks but my search is still queued? I found that I am the only user who has this situation. My role is admin. I thought it was a performance problem, but... by Cuicuo Engager in Splunk Search 12-22-2022 0 3	0	3
How to query for basic malware outbreak? I need a query for basic malware outbreak Deeksha_0-1671675972843.png Need query with server IP and server name fro... by Deeksha New Member in Splunk Search 12-22-2022 0 2	0	2
Why does search complain about eventtype errors when no eventtype is used? Hi, and sorry for the somewhat fuzzy question! I'll try to explain the scenario, so bare with me if the explanation g... by nsommars Explorer in Splunk Search 12-21-2022 0 5	0	5
How to calculate through elements in MV field? I have a table like thisproduct_nametest_resultresult_mvcalc_outputA11235A21232A31235B446713B64675B746710 You can see... by DS904458 Explorer in Splunk Search 12-21-2022 0 1	0	1
How to search by specific date and time range and compare with other date and time stats? I am trying to search with specific date and time. Is it possible to search and compare? for example, i want to get s... by mikeyty07 Communicator in Splunk Search 12-21-2022 0 1	0	1
Invalid value X for time term 'earliest', but only for specific dates Hello Splunk Community,I'm running a script using the splunk CLI to retrieve the required information. The script has... by LS2022 Explorer in Splunk Search 12-21-2022 0 4	0	4
How to change basic search to tstats with lookups and searchtime fields? Hello !Currently I'm trying to optimize splunk searches left by another colleague which are usually slow or very big.... by avoelk Communicator in Splunk Search 12-21-2022 0 6	0	6
How to delete search history? Hello community, Can anyone advise if it's possible to delete my search history? I'd like to delete old searches that... by pipg Observer in Splunk Search 12-20-2022 0 1	0	1
How to expand grouped table into single row? Hi Splunk Experts, Im looking for help in splitting a table grouped into single row into multiple rows. I would like ... by satish Explorer in Splunk Search 12-20-2022 0 5	0	5