Splunk Search

Community Activity

Search for certain adjacent events in IIS log Greetings, I've been asked to provide log data for a specific form that has been accessed over a certain time period.... by seekay Engager in Splunk Search 09-01-2022 0 2	0	2
How to write rex to extract string? Hi, REX command rex mode=sed to remove quotation marks and numbers inside of them OUTPUT file "19214132.IKU" copied... by Edwin1471 Path Finder in Splunk Search 09-01-2022 0 2	0	2
How to calculate the difference between two dates? I have 2 dates first_found: 2022-08-23T21:08:54.808Z last_fixed:2022-08-30T12:56:58.860Z I am trying to calculate the... by marceldera Explorer in Splunk Search 09-01-2022 0 3	0	3
How to create a count down? Hello, I need to create a single value panel that displays a countdown from today's date until a target date, how ... by Anesthet1ze Explorer in Splunk Search 09-01-2022 0 4	0	4
Why am I getting the last Value column? Dear Splunk community: So i have the following SPL that has been running fine for the last week or so however, all of... by djoobbani Path Finder in Splunk Search 09-01-2022 0 2	0	2
Why is my auto lookup not working as intended? I have some searches that do not appear to be enhancing properly using the asset_lookup_by_str lookup table. In this ... by XOJ Path Finder in Splunk Search 09-01-2022 0 0	0	0
Will Limits.conf on an app level overwrite the default for all apps for just the one? Hi All If I apply a limits.conf for subsearch - maxout and searchresults - maxresultsrow for an app im deploying, wil... by ZubairBMW Engager in Splunk Search 09-01-2022 0 2	0	2
Help with Heartbeat check Good afternoon!I have six Heartbeat messages coming from the system. All messages from the chain are connected by one... by metylkinandrey Communicator in Splunk Search 09-01-2022 0 1	0	1
Which Condition Function for \| seach based on Token should I use? Case Scenario: Dashboard A is clicked, thus sending a token whose value is hostname ($hostnameToken$) to Dashboard B.... by time2200 Explorer in Splunk Search 09-01-2022 0 6	0	6
How to append a row and a column of averages? Hi, I have a search that uses the chart command to split by 2 fields, such that the results are shown below. The data... by dzyfer Path Finder in Splunk Search 09-01-2022 0 6	0	6
Using multiple time range on the same index to return different row values Hello all, I have a report that searches for differents time range like Year to now, Month to now, Last 5 days and l... by egonstep Path Finder in Splunk Search 08-31-2022 1 5	1	5
How to compare average between two non-adjacent time periods? Hello,what' the best way to compare averages between two non-adjacent time periods. I have bunch of api call events w... by BenTreeser Explorer in Splunk Search 08-31-2022 0 2	0	2
Thinkst Canary Alerts Picking up my first project for SOAR detections. Asking if anyone knows groups or sites that helped them when they we... by user2023rd Engager in Splunk Search 08-31-2022 1 1	1	1
How do I table multiple data into one cell? Hello I have a little problem with Splunk! I have a table that basically contains data in the following way number ... by fperalde Engager in Splunk Search 08-31-2022 0 2	0	2
Why does our Index firewall ingest more logs every Tuesday? Hello One of my company's firewall ingest more logs every tuesday to splunk which makes us go over the 10G limit per ... by Akdollar New Member in Splunk Search 08-31-2022 0 1	0	1
Help with regex - How to exclude multiple parentheses and slashes from a field? Is there a more elegant way to do this? New to using rex & I can’t seem to strip out the multiple parentheses and sla... by jalo23 Explorer in Splunk Search 08-31-2022 0 2	0	2
How to search multiple items from multiselect input in Dashboard studio? Hi everyone, When I search for multiple items from multiselect, it is not working. I can search for "ALL" or one ite... by amanda_dg Engager in Splunk Search 08-31-2022 0 0	0	0
How to make two searches in the same index but different event types? Hi! I have a log like this eventtype=000111 msg=malicious srcip=11.11.22.22 eventtype=123 msg=traffic srcip=11.11.22.... by olbapito New Member in Splunk Search 08-30-2022 0 3	0	3
Help with REX command Hi,I want to create a table from the sample log file entry by computing the field names based on the entries defined ... by mdyunusraza Observer in Splunk Search 08-30-2022 0 5	0	5
How to find values between two string I have this event:(pool-4-thread-1 18a68b34-f4af-4940-9339-6201b5004bb8) (********): do_SMSGW (Request) : &from=TULBU... by baljkastr Engager in Splunk Search 08-30-2022 0 1	0	1
When using appendcols, one column doesn't have events? My Query: index=test sourcetype=true AND private AND beta \|rex field=_raw "\[private]\s(?<category>\S+\s+\S+\s+\S+)"... by SS1 Path Finder in Splunk Search 08-30-2022 0 3	0	3
How to combine searches from multiple source files? I have the following 2 logs DRT.log: This consists of the following log lines: {"date_time":"20220823-13:11:11.622... by toernerg Observer in Splunk Search 08-30-2022 0 1	0	1
How to use the map command to add the total event times between created beginning and end times? I want to use the map command to add the total event times for each day during the time interval from 6am-6pm.For eac... by ichesla1111 Path Finder in Splunk Search 08-30-2022 0 2	0	2
How to not Display Data that is less than 10 days old? Hello all, I know this has been asked many different ways but, I cant seem to get the search correct. I am attempting... by IndyJones1345 Loves-to-Learn in Splunk Search 08-30-2022 0 1	0	1
How to get Splunk triggered alerts results url? Hi Splunkers , Im trying to build a dashboard to capture all the triggered alerts with some custom actions to be ap... by spl_unker Explorer in Splunk Search 08-30-2022 0 1	0	1