Splunk Search

Community Activity

Is it possible to extract nested data make 2 keys? Hi Splunkers, I have data like this, Primary Key_1: subkey_1 : subvalue_1 subkey_2 : subvalue_2 Primary Ke... by batabay Path Finder in Splunk Search 10-05-2022 0 3	0	3
How to feed results of a query into another query of a different time and index? Hi all, I am trying to feed results of a query into another of a different time and index and I'm facing issues with ... by charlottelimcl Explorer in Splunk Search 10-05-2022 0 5	0	5
[Solution] Dashboard global_time token value not set For the search record: I edited an already functional dashboard in the studio, tweaking the layout. Part of that was ... by preview Engager in Splunk Search 10-04-2022 2 0	2	0
How can I extract data with delimiter? I have a log entry with the current format: field=A_B (delimited by underscore)How can I extract this data into two ... by yk010123 Path Finder in Splunk Search 10-04-2022 0 1	0	1
How to possibly use spath within a tstats query? Hello, I have an API call that is bringing in json data to my Splunk environment. When I do a basic query of the inde... by DBattisto Communicator in Splunk Search 10-04-2022 0 1	0	1
How can I parse a log containing multiple JSON records? I have the following log: Requests over Threshold found: {"kv":{"top_requests":[{"operation_name":"get","last_dispa... by yk010123 Path Finder in Splunk Search 10-04-2022 0 8	0	8
Dashboard for host,sourcetype, latest event received,Total Eventcount and sparkline for count of 1month? Hi, \| tstats earliest(_time) as Earliest latest(_time) as Latest where index=_internal by _time, index, sourcetype,... by Atchyuth_P Path Finder in Splunk Search 10-04-2022 0 1	0	1
How to regex the field = "URI path" values by "/" character where the values are varying length? Hi, I am b/t a rock and a wall, looking for any suggestion to solved this. I am using the URL ToolBox to dissect URI ... by Glasses2 Communicator in Splunk Search 10-04-2022 0 5	0	5
Default Table sort order not working as expected? host="*" index=main sourcetype=WwanSignal uid="3F77F61645E8323E205F832212" \| table _time deviceName user quality prev... by simpkins1958 Contributor in Splunk Search 10-04-2022 0 15	0	15
How to compare the values from same fields? I want to create the new_field when other values of field_1 is less than of first value.Here in below example as 23 g... by saurabh_ha Explorer in Splunk Search 10-04-2022 0 2	0	2
Help with Regex to extract values inside of the [] Good afternoon Splunk ninjas, i will require your assistance in designing regex that will help me take the values ins... by napoleon182 Explorer in Splunk Search 10-03-2022 0 2	0	2
How to create pie charts with column values? Hi guys, I am quite new to the Splunk world, pls forgive me for asking a very basic question. So I have a table as ... by ktanwar Explorer in Splunk Search 10-03-2022 0 4	0	4
How to hide some values in field? When i have query data result from search in field worker id it show >> domain\worker_id search result Example ABC\... by chakuttha Explorer in Splunk Search 10-03-2022 0 5	0	5
How would I extract number from text message? Hello, I would like to extract the 10 milliseconds in the below snippet of text as a separate value in a field. Is th... by user33 Path Finder in Splunk Search 10-03-2022 0 2	0	2
What is the most accurate metric to track Windows login times? Greetings fellow Splunkers, I was wondering if anyone has figured out what seems the most accurate metric to track wh... by JustAnotherITG Explorer in Splunk Search 10-03-2022 0 2	0	2
How to pass multiple values from inner search to outer search? Hi Folks, I could use some help with this query. index=address_index earliest=-30m address [ search index=registra... by Allene139 Explorer in Splunk Search 10-03-2022 0 14	0	14
How to create a list of first X values based on another field's value? I have a set of results for the search with id="base_metrics_search" which provide 3 panels with data. The events ea... by rberman Path Finder in Splunk Search 10-03-2022 0 1	0	1
Why am I getting this concact msg from multiple event for after apply a regex? Hello All , thanks for the help, my exemple: logStreamName: _timemessage09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/... by Hugues Path Finder in Splunk Search 10-03-2022 0 3	0	3
How can I change the owner of the alert in alert manager action ? Hello How can I change the owner of the alert in alert manager action ? I have only unassigned by SplunkySplunk Explorer in Splunk Search 10-03-2022 0 2	0	2
How to achieve grouping the results using field present inside a json array? I have below format log messages. At the end I want to group the messages by BID. I tried using the below query but I... by ghostrider Path Finder in Splunk Search 10-03-2022 0 3	0	3
How do I dedup duplicate values including that value itself? Hi everyone, I am new to splunk. I am looking at windows event logs for the EventCode=4725 for all usernames within a... by charlottelimcl Explorer in Splunk Search 10-03-2022 0 3	0	3
Could someone help me with parsing JSON to a table? I have the following JSON object which contains certificates expreation date: {<!-- --> "certificate-one.crt": 2022-11... by Roei_Rom Engager in Splunk Search 10-02-2022 0 2	0	2
Is there any function works like group by grouping sets in Mysql? is there any function works like group by grouping sets in Mysql?So that I can get a value from each group and a tota... by krim Explorer in Splunk Search 10-02-2022 0 3	0	3
How to run an "if" argument in a search? Hi. I'm trying to get only failed login attempts but while I could find the correct field, it's not as accurate as th... by NizanCohen Explorer in Splunk Search 10-02-2022 0 3	0	3
How to specify time with rest command? Hello,I have a rest query with a field that contain date and time Is it possible to limit the search by this field so... by sarit_s Communicator in Splunk Search 10-02-2022 0 40	0	40