Splunk Search

Community Activity

	Date Conversion Hi SMEs;I'd like to convert the following date format into epoch: yyyymmdd. E.g 20220508.Any assistance would be app... by mrdeterville Explorer in Splunk Search 03-19-2025 0 1	0	1
	Replace in SPL2 not working like SPL Hi,I am having trouble getting replace to work correctly in Ingest Processor and have this example.In SPL I can run t... by KeithH Communicator in Splunk Search 03-19-2025 0 6	0	6
	Run lookup before streaming command (anomaly) Hello Team,I need to run anomaly command on the top of results returned by the lookup.My lookup is geo: enriching my ... by MichalG1 Path Finder in Splunk Search 03-19-2025 0 4	0	4
	Search auto-cancelled Hi All,I have following Query index=wineventlog\|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S") \|eval device_name = ... by hema_5757 Observer in Splunk Search 03-19-2025 0 4	0	4
	Display all results if text field is * , or partials results based on any part of phone number entered I'm trying to have the dashboard return all results if the text field is * or return all phone numbers with a partial... by JohnD-Splunker Engager in Splunk Search 03-19-2025 0 4	0	4
	Data Exfiltration via E-Mail Hey everyone,I am currently trying to write a search that monitors outgoing E-Mail traffic. The goal is to see if bus... by Skinny Engager in Splunk Search 03-19-2025 0 3	0	3
	Get values Time range I have a survey that has a date field deletion_date. How can I filter this field by theTime range? sourcetype=access... by Jailson Explorer in Splunk Search 03-19-2025 0 6	0	6
	How to display 2 fields from different sources into a table? Hi all,I have the following query:index=wineventlog source=wineventlog:security EventCode=4688 [search index=winevent... by charlottelimcl Explorer in Splunk Search 03-19-2025 0 9	0	9
	How to replicate a kvstore from a Splunk HF to the SHC? I am reviewing a previously created lookup that is based on a KV-store collection.There is a custom script (contained... by Glasses2 Communicator in Splunk Search 03-18-2025 0 4	0	4
	How can I hide '_time' field from report table? by wanda619 Path Finder in Splunk Search 03-18-2025 0 7	0	7
	How to create bins of values surround a single event Good day, I'm trying to think of how I can write a search to find a specific event and then take all the events surro... by dtaylor Path Finder in Splunk Search 03-18-2025 0 4	0	4
	max values from two weeks using timechart Hello Everyone,i have a dataset where I'm generating a column of number of servers per day. using a timechart comman... by secure Path Finder in Splunk Search 03-18-2025 0 2	0	2
	Mvexpand Hello I have this search\| inputlookup defender_onboard.csv\| fillnull value=NA\| search Region="**" 4LetCode=""\| sear... by SN1 Path Finder in Splunk Search 03-18-2025 0 2	0	2
	Savedsearch next scheduled time is different from cron schedule set Hi All,I have scheduled a splunk report to run at 11 AM IST everyday (cron schedule : 0 11 * * *). Search Head time z... by Poojitha Communicator in Splunk Search 03-18-2025 0 2	0	2
	drilldown and panel depend not working when clicking chart Hi,I am doing an initial search based off of initial field inputs within a dashboard. The issue I am having is after... by dickersons Explorer in Splunk Search 03-17-2025 0 1	0	1
	Question regarding search using IN Hello:I have a query that extracts a set of 5 request_ids based on certain criteria. I then need to include these re... by rnayak New Member in Splunk Search 03-17-2025 0 7	0	7
	Can not configure any external lookup - can not find executable Hello TeamSplunk 9.4.0. Running as root. All in one.Seems super simple problem. I am not able to have maxmind lookup ... by MichalG1 Path Finder in Splunk Search 03-17-2025 0 8	0	8
	Large JSON payloads don't always perform field extractions I have some rather large json data payloads being sent over to Splunk. I've seen payloads around 1MB in size. It took... by tchamp Explorer in Splunk Search 03-17-2025 0 2	0	2
	Need help in query Need help for the below Query index=na sourcetype=na:co state=down host_state_type="HARD" [\| tstats prestats=f values... by Praz_123 Communicator in Splunk Search 03-17-2025 0 2	0	2
	Determine which site's search is taking time I have a multisite setup. Each site has 3-4 indexers, with a Replication Factor = 2.Search Factor is = 1.When queryin... by Na_Kang_Lim Path Finder in Splunk Search 03-16-2025 0 4	0	4
	spl qquery HiNeed help in finding DistinctAdminUserCount and DistinctAdminUserNames of each associated Name inside test or prod ... by nithys Communicator in Splunk Search 03-15-2025 0 5	0	5
	matching hostnames issue Hii have a list of servers coming from two different sources list A has server without domain names and list B has se... by secure Path Finder in Splunk Search 03-14-2025 0 6	0	6
	Wildcard in the middle of hostname Below is my search \| inputlookup uf_ssl_kv_lookup\| search hostname=AB100TILL hostname!=AB100*TILL100 hostname!=AB10... by Chakri Engager in Splunk Search 03-14-2025 0 5	0	5
	Search numbers of messages received by application based on json message Hello All, This is my first post . I have just started learning writing splunk query . Ok so we have one application... by Punnu Path Finder in Splunk Search 03-14-2025 0 4	0	4
	How to Improve a search with Join or suggest alternate way Hello,I'm trying to join based on a common field using a similar query like below, however, the in the result i only ... by RamMur Explorer in Splunk Search 03-14-2025 0 4	0	4