Splunk Search

Community Activity

How to link dynamically the range time picker with a relative time? hi as you can see I use a relative time in my search in order to filter events on today between 7h and 19h earliest... by jip31 Motivator in Splunk Search 11-17-2022 0 3	0	3
Why is Splunk ignoring timestamp in message? Good afternoon, I have already raised a similar topic. The last time I was cleared up the situation, but the problem ... by metylkinandrey Communicator in Splunk Search 11-17-2022 0 9	0	9
How to consolidate two columns into a single column without losing data? We have a data source which contains two columns, both of which contain valuable information. In any event, either on... by msarro Builder in Splunk Search 11-17-2022 1 8	1	8
How to move all of the different searches to a single/couple of base searches and then post processing? hiI am trying to get my dashboard better and move all of the different searches to a single/couple of base searches a... by noammeir Explorer in Splunk Search 11-17-2022 0 3	0	3
How to extract dynamic key from nested json? sample json: Hosts: { [-] Nodepool1: { [-] Cluster: xyz1 Accountid: idxyz Nodepool3: { [-] Clust... by directtv999 Loves-to-Learn Lots in Splunk Search 11-17-2022 0 7	0	7
How to create custom field on Splunk cloud? i am trying to create a custom field like host and source by making changes in atteched photos of entrypoint.sh and ... by sc_admin11 Explorer in Splunk Search 11-16-2022 0 0	0	0
How to use "where" and "not in" and "like" in one query? I have the following query :sourcetype="docker" AppDomain=Eos Level=INFO Message="Eos request calculated" \| eval Val_... by JyotiP Path Finder in Splunk Search 11-16-2022 0 3	0	3
Why doesn't replace work on a nested field? Sample event { durationMs: 83 properties: { url: https://mywebsite/v1/organization/41547/bui... by YatMan Explorer in Splunk Search 11-16-2022 0 3	0	3
How to create regex that will pick up on a value contained in [ ] brackets? Hi all, I'm attempting to develop a regex that will pick up on a value contained in [ ] brackets (see below): Log val... by Splunky21 Explorer in Splunk Search 11-16-2022 0 2	0	2
Trouble extracting GUIDS and how to make a new field with rex? Trying to get these UUID/GUIDs to extract from the message field. Hoping to create a rex to extract everything after ... by judges88 Explorer in Splunk Search 11-16-2022 0 5	0	5
Merge all values in two fields in a new one? I have read all the posts about "merging fields" and none of the options work for me. I have events where the same va... by JohnnyMnemonic Explorer in Splunk Search 11-16-2022 0 3	0	3
How to apply alert based on search in Splunk? Hi All, these are the logger info counts which are generated in splunk Total numner where inds-a 20Total numner wher... by Splunkstart Explorer in Splunk Search 11-16-2022 0 4	0	4
How to not display the weekend in a chart? hi I want to not display the week end in my chart for example, if i use a time picler range of 7 days, I just want to... by jip31 Motivator in Splunk Search 11-16-2022 0 11	0	11
Issue in combined field values? I am having issue with "Status" values as below and screenshot, please find below json and search query. Please advis... by anu41 Explorer in Splunk Search 11-16-2022 0 2	0	2
Sometimes if we are doing base search, if not handled properly, you will see page loading, how do you handle it? Hi,Sometimes if we are doing base search, if not handled properly, you will see page loading, how do you handle it?Re... by SumanPalisetty Path Finder in Splunk Search 11-16-2022 0 1	0	1
Convert normal search to tstats? Dears, We need your support to convert below search to tstats search. (index=os_windows OR index=workstation*) tag=... by Abdullah Explorer in Splunk Search 11-16-2022 0 3	0	3
Why is search for hosts not sending logs and no longer showing results? Hello, We have been using this query to list out hosts that are not sending logs since past 24h. It has been workin... by neerajs_81 Builder in Splunk Search 11-16-2022 0 8	0	8
Group events based on content of field? I have the following table of activities: InternalExternalDirection1.1.1.12.2.2.2Outbound3.3.3.34.4.4.4Inbound5.5.5.5... by KMoryson Explorer in Splunk Search 11-16-2022 0 2	0	2
How to remove double quotes from events ? sample event "USR_LOGIN","USR_EMP_NO","USR_LAST_NAME","USR_FIRST_NAME","USR_DISPLAY_NAME","USR_STATUS","USR_EMAIL","... by sivakumargik New Member in Splunk Search 11-16-2022 0 6	0	6
How to annotate when a transition happens? I want to add an annotation to a dashboard every time we switch from blue servers to green servers or green to blue. ... by MScottFoley Path Finder in Splunk Search 11-15-2022 0 1	0	1
What are the limitations on subsearch? Hi, What are the limitations on subsearch? Please give one or two, please? This is an interview question. Regards Sum... by SumanPalisetty Path Finder in Splunk Search 11-15-2022 0 3	0	3
ISO 8601 TimeStamp Extraction / Formatting and Source Type Config Hi all,I have a timestamp in a format I havn't dealt with before and I am struggling to get it converted to my timezo... by DGilbert91 Explorer in Splunk Search 11-15-2022 0 4	0	4
How will search head know which index has data? Hi,How will search head know which index has data? It's an interview question. Kindly help me.RegardsSuman P. by SumanPalisetty Path Finder in Splunk Search 11-15-2022 0 2	0	2
How to search for Phantom (SOAR) playbook runs and results? I have some Phantom playbooks performing tasks that I want to monitor on a Splunk dashboard - runs/day, distinct task... by ben_r Engager in Splunk Search 11-15-2022 0 0	0	0
How to return events with or without a value in a specific field? Hi all!I'm trying to create a table with case_number and session as the two columns. Any event without a case_number ... by KyleMcDougall Path Finder in Splunk Search 11-15-2022 0 5	0	5