Splunk Search

Community Activity

how can i use like and not like in the same query? \| where like(RouteCode, "50%") AND !like(RouteCode, "503%")I am trying to show Routecode 501,2, -- anyother not 503. by ashidhingra Path Finder in Splunk Search 06-20-2022 0 1	0	1
How to compare predefined fields against Splunk search query? And then for each mismatch in result? Hello All, I am new to Splunk. My Splunk index is already getting data from a Kafka source index=k_index sourcetype... by chandysir Explorer in Splunk Search 06-20-2022 0 5	0	5
How to use the second index to search missing fields Please see this search - i'm trying to add missing field values from another index to this search. index=1 earliest=-... by NewGhost Engager in Splunk Search 06-20-2022 0 4	0	4
Why is sourcetype pan:threat extracting incorrect fields? Hi all, so, on my es-security search head, this sourcetype is incorrectly parsing the user field. It is capturing all... by IngmarHicoz Engager in Splunk Search 06-20-2022 0 2	0	2
Help with query to notify when data ingestion is stopped Query to find when host is stopped, Here as mentioned in picture, the field _time stopped at the time , when the host... by smanojkumar Contributor in Splunk Search 06-20-2022 0 4	0	4
How to crete an alert to notify when host back to normal? I'm having a list of serve down and need to notify once its back to normal (up), This is the requirement, once the s... by smanojkumar Contributor in Splunk Search 06-20-2022 0 0	0	0
How to get All legend names to be displayed in Piechart View? ( \| stats count by app ) I have 30 apps to be displayed in a Piechart format. But in visualization i can view only 14... by vn_g Path Finder in Splunk Search 06-20-2022 0 11	0	11
How to replace a string with RegEx in search result I have my Sonicwall logfiles coming into Splunk. By searching this index I want to replace "dst" (Destination IP addr... by Dolfing Explorer in Splunk Search 06-20-2022 0 4	0	4
Is there a way calculate the duration between the status=holding and status=end also? Hi All, I am using transaction to group my DDOS appliance events based on a field called status which has values lik... by neerajs_81 Builder in Splunk Search 06-20-2022 0 1	0	1
How to group over multiple fields for stats? Hi, I'm able to get the response in a tabular format using the command: table clientName, apiMethod, sourceSystem, ht... by nmarun Explorer in Splunk Search 06-19-2022 0 6	0	6
How do you use value or capture groups as regex's curly bracket number parameter? In the code below, i want the explicit {5} to be replaced with a variable like {$session_length$}. Is this possible? ... by mschaaf Path Finder in Splunk Search 06-19-2022 1 18	1	18
How to combine the rows of a table? Hi All, I have logs like below in splunk. log1: "count":1, log2: gcg.gom.esb_159515.rg.APIMediation.Disp1.3.Rs.APIM3 ... by Mrig342 Contributor in Splunk Search 06-19-2022 0 4	0	4
How to Merge two query resultsets? I have two Searches and following are its result individually - index="myindex" <my search 1> \| table App Size Count ... by runiyal Path Finder in Splunk Search 06-19-2022 0 4	0	4
How do I select 2 lines in logs using regex? Hi, I am working on logs so the logs can be of just one line or multiple lines and if it is of one line I wanted to t... by badrinath Path Finder in Splunk Search 06-19-2022 0 1	0	1
Help with union not working Hello I'm running this query: \| union [ search host="puppet-01" OR host="jenkins-01" OR host="ANSIBLE-01" sour... by sarit_s Communicator in Splunk Search 06-19-2022 0 4	0	4
Implementation of logic in search to send an alert My requirements consists of lookup file, it consists of list of hosts, as it is the saved results of an alert, so the... by smanojkumar Contributor in Splunk Search 06-18-2022 0 3	0	3
How to create an Alert on disabled AD accounts being re-enabled? Does anyone have experience writing a query that can be used to alert on disabled AD accounts being re-enabled? I've ... by eblackburn Path Finder in Splunk Search 06-17-2022 0 2	0	2
Rex Field ... by jwursteisen Engager in Splunk Search 06-17-2022 0 4	0	4
How to combine data based on a common field? Hi all, i have some data task name, execution date, link uploaded earlier. Now i want to add some more data related t... by anooshac Communicator in Splunk Search 06-17-2022 0 6	0	6
configure splunk with wildfly23 on windows10 jdk8 After following the jboss setup tutorial https://docs.splunk.com/Documentation/AddOns/released/JBoss/SetupI am able t... by aron Engager in Splunk Search 06-17-2022 0 3	0	3
Splunk timechart with average line Hello everyone!I want to combine two searches or find another solution. Here my problem:I need a timechart where i c... by klischatb Path Finder in Splunk Search 06-17-2022 0 6	0	6
How to Include field name in table? Hello! I have learned so much from this community over the years but there is one query I am trying to write that I c... by bbeebe Explorer in Splunk Search 06-16-2022 0 7	0	7
How to check the indexer status details for last one month from the Search head by using SPL query Hi Team How to check the indexer status details for last one month from the Search head by using SPL query by thahir Contributor in Splunk Search 06-16-2022 0 2	0	2
Splunk Query to form a table with multiple JSON fields Below is my splunk raw event data{<!-- -->"additional": {<!-- -->"method": "POST","url": "/api/resource/getContentEditorData","header... by shashaikhhh Explorer in Splunk Search 06-16-2022 0 3	0	3
Lookup file question I am wanting to use a lookup file to drive search for an alert. This seems a bit unique as I am not wanting to use e... by yooitsgreg New Member in Splunk Search 06-16-2022 0 3	0	3