Splunk Search

Community Activity

How to event break with by request ID? On my attached picture these many events should become one event by ID instead of so many, how can I break those even... by baljkastr Engager in Splunk Search 09-20-2022 0 1	0	1
How to create a subsearch based on parent search? I want to create subsearch based on parent fields search. I want to show only rows from cor_inbox_entry that in... by eitangabay New Member in Splunk Search 09-20-2022 0 2	0	2
How to write search to get the numbers in order for field? Hello Team, I am running below query to get the stats but I am looking to get the Store numbers in serial order, can... by pkumar9610 Explorer in Splunk Search 09-20-2022 0 2	0	2
How to search using a set of values? Hello All,I am relatively new to splunk and I am trying to search using sets. Sets here refers to a group of values t... by olawalePS Path Finder in Splunk Search 09-20-2022 0 3	0	3
How to pull data from Nested JSON Fields based on Field Value? Hello, I'm working on creating automated alerts from an email security vendor and would like for them to only includ... by cfloquet Path Finder in Splunk Search 09-20-2022 0 2	0	2
How can I sort results for previous week and current week in two seperate columns? Hi Folks,How can i display the results for 2022-09-02 in Result_Prev column and 2022-09-09 in Result column and keepi... by wanda619 Path Finder in Splunk Search 09-20-2022 0 6	0	6
Using search to find user using RDP and switch identities usage What's a good way to find user who logon to RDP with one user account then user another like privilege user account. ... by youngso SplunkTrust in Splunk Search 09-20-2022 1 1	1	1
What are the differences between Splunk Cloud and Splunk Enterprise lispy? Hi, We are using both Splunk Cloud and Splunk Enterprise. We recently came across some issues/differences in search w... by aprice_q Observer in Splunk Search 09-20-2022 0 2	0	2
I tried accessing an API with the help of Splunk API Modular Input add on, but there is no option for bearer auth? I want to access an API and I can only use Bearer authentication to access that particular API. I searched a lot abou... by kgiri253 Explorer in Splunk Search 09-20-2022 0 1	0	1
Translate splunk data to json using cli search? I have a splunk container running on docker, and was hoping to translate the splunk index data into json using a cli ... by zsbbb Engager in Splunk Search 09-20-2022 0 1	0	1
Forescout nested json- How do I categorize the nested json objects into fields within the array? Hello, I am currently working on a use case which has complex ingested data with nested json. The data I am trying to... by Foss Engager in Splunk Search 09-20-2022 0 1	0	1
How to assign previous month's fetched result to current month's field? Considering 2022-06 as starting month, If month is 2022-07, i should assign 2022-06's corresponding field values " gr... by spoo Explorer in Splunk Search 09-19-2022 0 6	0	6
Help with join in searches HiNeed help with Left joinThere are two queries as belowQuery1index=abc sourcetype=123 \| table a.b.requestGUID E... by mailravi Loves-to-Learn in Splunk Search 09-19-2022 0 6	0	6
How to filter search by value from a json list? Hi Consider this event structure : {"result" : {"dogs" : [{"name" : "dog-a", "food":["pizza", "burger"] }, {"nam... by mottig Path Finder in Splunk Search 09-19-2022 0 4	0	4
Why is line chart color is not getting change? Hi Im trying to change the color of a line chart with: <option name="charting.seriesColors">[000000FF]</option> but ... by mottig Path Finder in Splunk Search 09-19-2022 0 2	0	2
How to extract values from existing field and reassign them to field? Hello, I currently have a field that contains a long string over 100+ events and in that field there are varying file... by wts408 Explorer in Splunk Search 09-19-2022 0 5	0	5
How to write regex to read all the value in all the lines? Hi Everyone, I am desperately seeking help for my new query in SPLUNK. The search result will look like the below: ... by fajri1203 Loves-to-Learn in Splunk Search 09-19-2022 0 3	0	3
How to search for different events on the same day, with different time frames? Hi all! I have been absolutely stumped by this and hoping you can help me out. I am trying to find users that have 2 ... by Southy567 Explorer in Splunk Search 09-19-2022 0 3	0	3
How to exclude matching results from Lookup? Hi all - I am trying to exclude matching results from a lookup and can't get it to work. I've tried multiple searches... by mistydennis Communicator in Splunk Search 09-19-2022 0 1	0	1
How to add URL Link to Alert Email? I have a search that is run as a cron and creates an email. It is very simple; index=my_index host=* logon Event... by OldManEd Builder in Splunk Search 09-19-2022 0 5	0	5
How to count number of applications associated with a given user and report if less than 10? I'm working on a search that evaluates events for a specific index/sourcetype combination; the events reflect SSO inf... by beetlegeuse Path Finder in Splunk Search 09-19-2022 0 3	0	3
How would I configure CyberArk TA, Search Head, and Syslog Server? Hello, Data in CyberArk comes through the Syslog Server and CyberArk TA needs to be installed into Search head (or se... by SplunkDash Motivator in Splunk Search 09-19-2022 0 13	0	13
Nested Search and Map Search- Is there a way to make this search more efficient? Dear all, I want to combine 2 search job into 1 job.My first search job is to search all the alert_id occur in the pa... by chteh Explorer in Splunk Search 09-19-2022 0 5	0	5
How to filter on multiple events? Hello, I have a search that outputs table data that looks like this: hst code type hosta 01 master hosta 02 mas... by harryvdtol Path Finder in Splunk Search 09-19-2022 0 3	0	3
How to make a new row in a table based on one of the tables column value? Hello!!!I am doing calculations for the time it takes when a machine is undergoing maintenance. Right now, I calculat... by ichesla1111 Path Finder in Splunk Search 09-18-2022 0 3	0	3