Splunk Search

Community Activity

	How to fetch the list of errors and their details while running SPL which does not allow users to fetch data? Hi All,I need your help to determine the details of issues which affect users while running SPL.The details may inclu... by Taruchit Contributor in Splunk Search 12-05-2022 0 1	0	1
	How to extract same fields from different logs? Hi all, I need to extract some fields for authentication events from different log types, here below some example: LO... by marco_massari11 Communicator in Splunk Search 12-05-2022 0 3	0	3
	Why is search history retention inconsistent between search heads? I have two Splunk Enterprise environments, both at 9.0.2. For users in one environment, search history goes back only... by gregbo Communicator in Splunk Search 12-05-2022 0 2	0	2
	How to get max and average response time and their related fields in the same table? Hi all,I am working on calculating the response time (for max, PR99, and avg value) from Table 1.I would like to list... by Jouman Path Finder in Splunk Search 12-05-2022 0 5	0	5
	Can I assign a color to a column but not related to its value? Hi all,I would like to highlight each fields in the same column in blue.But I don't know how to configure it.Do any o... by Jouman Path Finder in Splunk Search 12-05-2022 0 0	0	0
	Need help writting a rex query Hello,For starter, I'm an amateur in regex query, so I use Field Extraction, but it's very clunky and cannot extract ... by phamxuantung Communicator in Splunk Search 12-05-2022 0 5	0	5
	Date getting null values on StrpTime? I've field name opened_at with the date value shown in the image. But, while taking value from it, it returns a null ... by iupreti Explorer in Splunk Search 12-04-2022 0 4	0	4
	How to extract bunch of UUIDs from a string using regex? Hi, I have a string in splunk logs something like below. msg.message="Matches Logs :: Logger{clientId='hFKfFkF-K7jlp5... by Splunk_321 Path Finder in Splunk Search 12-04-2022 0 4	0	4
	How to create a search where if results under "query" field matches anything under hostname, then alert or show results? Currently using splunkes' managed lookup table called hosts. There's a field too called hostname within the file.I'm ... by YangThomas New Member in Splunk Search 12-04-2022 0 1	0	1
	How to extract the field "alert" with the field name action? Hi, how to extract the field "alert" with the field name action. help with the regex.. Thanks. by balu1211 Path Finder in Splunk Search 12-03-2022 0 24	0	24
	Why does stats count(eval always returns zero when partial non-existant values exist? My query: index=primary eventType=ConnectionTest msg="network check results" \| spath output=connectError details.erro... by ChadW Explorer in Splunk Search 12-02-2022 0 3	0	3
	How do I fix DMC KVstore "Collection Metrics" error I recently added a new SH to our SHC. Show shcluster-status is good, show kvstore-status is good. I created some kv... by coreyCLI Communicator in Splunk Search 12-02-2022 0 1	0	1
	How can I break out streamstats into multiple groups? I'm wanting to group streamstats results by either one or two fields. Grouping by sourcetype would be sufficient. Gro... by bandit Motivator in Splunk Search 12-02-2022 0 2	0	2
	How to import event logs from another system to scan on my local instance of Splunk? Hello all! I am brand new to Splunk and have learned quite a bit so far from this forum, so thank you! With that bein... by BabySplunk Explorer in Splunk Search 12-02-2022 0 15	0	15
	Help with field extraction from table values HI Splunkers, We are getting below value inside one of field "data" in tabular format: Source success Total_Count0 ab... by dhirendra761 Contributor in Splunk Search 12-02-2022 0 8	0	8
	How to calculate count based on the condition? Hi ,i want to calculate count based on the condition , like in the below queryif the event is 'sync' then the 'failed... by csahoo Explorer in Splunk Search 12-02-2022 0 5	0	5
	How to streamstats with time_window and keep only the largest count? I'm trying to use the streamstats-command with time_window to track when certain user actions happen more than twice ... by dedupper Explorer in Splunk Search 12-01-2022 0 4	0	4
	How to group by src_ip and getting the same source and destination IPs repeated or duplicate entries? Hi, I am working on use case which has following requirements 1. high number of connections to external DNS IPs from ... by BhushanGurav Observer in Splunk Search 12-01-2022 0 3	0	3
	How to do stats count based on condition? index="dockerlogs" source="gps-request-processor-test" OR source="gps-external-processor-test" OR source="*gps-... by csahoo Explorer in Splunk Search 12-01-2022 0 2	0	2
	How can I apply mvdedup to field dst.port only if numbers of dst ports = field COUNT? Hello everyone! I have basic search index=main\| stats list(src.port), list(dst.port) count(src.ip) as COUNT by id How... by bosseres Contributor in Splunk Search 12-01-2022 0 3	0	3
	How can I turn a single value number into a percentage? So I'm trying to turn a single value number into a percentage but the code just returns a number still. Here's my cod... by jhilton90 Path Finder in Splunk Search 12-01-2022 0 9	0	9
	How to find Delta between 2 sets of events? Hello, I have use cases to find the Delta between 2 sets of events. We get events once a day, our objective is to fin... by SplunkDash Motivator in Splunk Search 12-01-2022 0 12	0	12
	How to splunk search to get time only from date time? hi All,can you help with splunk search to get time only from date time.example as 2022/11/28 17:00:00 want to get onl... by sekhar463 Path Finder in Splunk Search 12-01-2022 0 7	0	7
	How to get the latest status of the workflow? Hello Splunkers, Workflows are monitored through splunk. Workflows has different stages like running , paused, cancel... by Nithianandan Observer in Splunk Search 12-01-2022 0 2	0	2
	How to show distinct count? index=XX sourcetype=YY source=*/log/abc.log\| dedup _time, bppm_message, bppm_nodename sortby -_indextime\| rex field=b... by harsush Path Finder in Splunk Search 12-01-2022 0 3	0	3

Get Updates on the Splunk Community!

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Splunk Search

How to fetch the list of errors and their details while running SPL which does not allow users to fetch data?

How to extract same fields from different logs?

Why is search history retention inconsistent between search heads?

How to get max and average response time and their related fields in the same table?

Can I assign a color to a column but not related to its value?

Need help writting a rex query

Date getting null values on StrpTime?

How to extract bunch of UUIDs from a string using regex?

How to create a search where if results under "query" field matches anything under hostname, then alert or show results?

How to extract the field "alert" with the field name action?

Why does stats count(eval always returns zero when partial non-existant values exist?

How do I fix DMC KVstore "Collection Metrics" error

How can I break out streamstats into multiple groups?

How to import event logs from another system to scan on my local instance of Splunk?

Help with field extraction from table values

How to calculate count based on the condition?

How to streamstats with time_window and keep only the largest count?

How to group by src_ip and getting the same source and destination IPs repeated or duplicate entries?

How to do stats count based on condition?

How can I apply mvdedup to field dst.port only if numbers of dst ports = field COUNT?

How can I turn a single value number into a percentage?

How to find Delta between 2 sets of events?

How to splunk search to get time only from date time?

How to get the latest status of the workflow?

How to show distinct count?

Analytics Workspace deprecation

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation