Splunk Search

Community Activity

What is the best way to remove dots from domain? Hello everyone! What is the best way to remove dots from domain in field? for example \| eval field = lower(mvindex(sp... by bosseres Contributor in Splunk Search 10-21-2022 0 4	0	4
Why does my Cron for Sunday fail? According to the docs for cron the Sunday code is 0. When I try to run this cron for the first Sunday of the month ... by dlcrooks Explorer in Splunk Search 10-21-2022 0 10	0	10
Add field to message using SPL request? Good afternoon!I have a request based on which I create an aller: index="main" sourcetype="testsystem-script707" \| ev... by metylkinandrey Communicator in Splunk Search 10-21-2022 0 6	0	6
Pass field to main search when nested search fails? We have alerts for high Windows Server CPU usage, and we have automated vulnerability scanners which can trip these a... by mv10 Path Finder in Splunk Search 10-21-2022 0 12	0	12
How to execute these condition based Joins? Hello, I need your help to find a way to achieve the following use case:in main search:I've to categories: Windows an... by mnj1809 Path Finder in Splunk Search 10-21-2022 0 8	0	8
Are there any other online collections of Splunk search examples? Beyond what's in the Search Reference and the Search Manual, are there other sites that have SPL examples available t... by ChrisG Splunk Employee in Splunk Search 10-21-2022 1 11	1	11
Devices In Splunk- How can I create syntax, an alert, and create a table? Hello, please can someone assist with creating syntax to 1. know the numbers of desktop, laptops, servers and networ... by codeJesus Engager in Splunk Search 10-21-2022 0 4	0	4
Help with SPL Splunk part 2 To provide further from yesterday's SPL query. I am facing huge events in multivalues. I want to break in a single ev... by LogUx Motivator in Splunk Search 10-20-2022 0 1	0	1
Is it possible to restrict a role to run a certain search or only be able to run saved searches? Is it possible to restrict a role to run a certain search or only be able to run saved searches?Ie a user can only ru... by klim Path Finder in Splunk Search 10-20-2022 0 0	0	0
How to use spath command in props.conf or transforms.conf? hello I have a question I have a data that access_log data and json data is mixed and my need is to extract field fr... by leeyounsoo Path Finder in Splunk Search 10-20-2022 0 10	0	10
How to add field "A" from another index if B and C are equal across both indexes? Add "A" field from another index if "B" and ""C" are equal across indexesI have search that returns events with field... by PawelKozy Loves-to-Learn Lots in Splunk Search 10-20-2022 0 5	0	5
How to extract values inside of the {}? Hello Splunk Ninjas! I will require your assistance with designing my regex expression. I need to filter for the valu... by napoleon182 Explorer in Splunk Search 10-20-2022 0 2	0	2
How to make timechart active connections between start end end times? Hi, Any thoughts appreciated. I have some connection data captured at connection termination, it has connection start... by mcaulsc Path Finder in Splunk Search 10-20-2022 0 6	0	6
Help with search with multiple NOT IN subqueries The goal is to take all eventIds with "operation failed" and exclude events with "Duplicate key" and "Event processed... by usarios Engager in Splunk Search 10-20-2022 0 2	0	2
How to write a search to compare two weeks errors, and highlight any new errors? Hello Splunkers !! Last weekCurrent weekNew Error "enableEnhancedCheckout" "enableEnhancedCheckout" "error_in_pytho... by LogUx Motivator in Splunk Search 10-20-2022 0 9	0	9
Alert scheduler question- How to run in seconds? Good afternoon! I figured out how to set up alerts. Understood with the parameter: Cron Expression. Currently I am us... by metylkinandrey Communicator in Splunk Search 10-20-2022 0 3	0	3
How to extract and display in a table form? I have splunk logs as given below. However, I wanted display fields in between square brackets "[ ]" in a table as gi... by Manth Explorer in Splunk Search 10-19-2022 0 3	0	3
How to pass a token in base search? i want to pass the input token to my base search. In the panel its shows no results found, but when try click on "ope... by restinlinux Explorer in Splunk Search 10-19-2022 0 1	0	1
Splunk integration with Cisco ISE using pxGrid- How do I integrate with Splunk Trial? Hi,I am struggling with the configuration pxGrid on Splunk for Rapid Threat Containment with ISE.I just installed a n... by mnowaczy New Member in Splunk Search 10-19-2022 0 1	0	1
Search results might be incomplete: the search process on the local peer:%s ended prematurely? Hi All, When running a search the following error will appear in the job inspector. Users get this message intermitte... by RichieH Explorer in Splunk Search 10-19-2022 0 4	0	4
Splunk search command- How to get table? Hello, Assuming i have numbers, let's say 1-2-3-4-5-6. And each of those represent Ip adressnumber of requestmethod1.... by dj56 Explorer in Splunk Search 10-19-2022 0 9	0	9
How to set an alert running every day hourly? how to set an alert running every day hourly? ex - if new transactions /events occur alert the user by wanda619 Path Finder in Splunk Search 10-19-2022 0 3	0	3
How can I whitelist based on this 3 conditions- where condition with 3 arguments? Hi, I have an inputlookup with wSender, wSubject and wRecipient. I want to whitelist some of the emails sent by an us... by danutmatei Explorer in Splunk Search 10-19-2022 0 2	0	2
How to calculate the duration? Hi, I`ve got the following search that I would like to amend as follows: 1. swipe_in and swipe_out times to show on t... by tomapatan Contributor in Splunk Search 10-19-2022 0 6	0	6
How to use output of a 1st query list as input in second query? I have an ```index=xyz data.id=1```which gives me list of unique id's [1,2,3,4,5]Not sure how to store the above resu... by agupta13 Engager in Splunk Search 10-18-2022 0 2	0	2