Splunk Search

Community Activity

Why am I not receiving the confirmation SMS or alerts SMS? Hey guys, I hope you're doing well, I didn't receive the SMS verification code or SMS alters on the Splunk on-call... by MatBav New Member in Splunk Search 06-02-2022 0 0	0	0
Return only the first matching event Is there any way to make Splunk stop a search once it has found the first event matching your search? limit=1 in the... by blurblebot Communicator in Splunk Search 06-02-2022 1 3	1	3
How can I get counts for yesterday and last week? Hi Splunkers, I am stuck at how can I get counts for Yesterday and Last week. so ask is when select relative time fro... by dpatel01 Loves-to-Learn in Splunk Search 06-02-2022 0 2	0	2
How to find the difference in field values between two lookups Hello all, I had a question that I have been trying to figure out how to address within a concise SPL query. I have ... by Jasper Loves-to-Learn Lots in Splunk Search 06-02-2022 0 2	0	2
Is there a way to change the order of the "stack_trace" attribute? Is there a way to change the order of the "stack_trace" attribute, so it shows up last within the log message ? by aroc725 Loves-to-Learn in Splunk Search 06-02-2022 0 6	0	6
What am I doing wrong with my stats table? Hi I have table like this: name color status jack red fail jack blue ... by indeed_2000 Motivator in Splunk Search 06-02-2022 0 18	0	18
How to calculate count and percentage of fields? hi need to calculate count and percentage of fields. orginal post here, the main issue is fields contain space or bal... by indeed_2000 Motivator in Splunk Search 06-02-2022 0 1	0	1
Extracting data from Json key value(containing no array), using transpose and outer join I have json in following format. { "timestamp": "1625577829075", "debug": "true", "A_real": { "Sig1": { ... by ruhibansal Explorer in Splunk Search 06-02-2022 0 4	0	4
How to correct the time in the "elapsed_Time" field? index="SOMETHING" earliest=-30d@d\| stats earliest(_time) as action_StartTime latest(_time) as action_EndTime\| eval e... by saurabhbdwj Engager in Splunk Search 06-02-2022 0 2	0	2
How to optimize this search ? Hi,I have an SPL, which should exclude the ip values from 4 lookups. So i tried it with a subsearch approach. But thi... by Woodpecker Path Finder in Splunk Search 06-01-2022 0 1	0	1
How does Splunk calculate Time to Triage? How does Splunk calculate Time to Triage, what data does it use? e.g. time an event occurred and time the event was p... by -Chris- Observer in Splunk Search 06-01-2022 0 3	0	3
Why do I need a \| when using a macro with a generating command? I have a macro that starts with a search command. When I ran it, I noticed I was getting a different number of resul... by cvg1wby Explorer in Splunk Search 06-01-2022 0 2	0	2
Help with a simple search I am trying to do a search where by: index=firewall (src_ip=172.16.0.0/12) dest_ip!(172.16.0.0/12) \| table src_ip ... by agallegos Engager in Splunk Search 06-01-2022 0 3	0	3
Why is search for multiple Windows events failing? I am running Splunk Enterprise and am trying to create a dashboard panel "Events" search string that pulls multiple W... by Robert11 Path Finder in Splunk Search 06-01-2022 0 6	0	6
How to calculate the percentage increase (or decrease) in each error/success code based on previous hour? Team, I have below timechart which is counting http error/success codes for a span of 1hr. Now I need to calculate t... by onthakur Explorer in Splunk Search 06-01-2022 0 2	0	2
How to create a table to show all the values from the below log lines? Log Lines are as given belowReports obtained. MyId=NameOne, sId=s0, Reports=true, LogString= url=status.com, Type=bas... by olilloyd Engager in Splunk Search 06-01-2022 0 1	0	1
How to represent two fields values in row wise and one field value column wise in Splunk table? HI, I am trying to recreate the same structure in Splunk which was created in excel. I have five fields week, total t... by spkriyaz Path Finder in Splunk Search 06-01-2022 0 1	0	1
How to Work Around Distinct 10K Limit Hi, trying to get stats of user search stats. I'm struggling trying to workaround the 10K limit with distinct , stats... by chrisboy68 Contributor in Splunk Search 06-01-2022 0 0	0	0
Getting error while accessing Splunk dataset- How do I fix? Getting error : "The lookup table 'Horizon_Feb_2022.csv' requires a .csv or KV store lookup definition."while running... by jinishshah Explorer in Splunk Search 06-01-2022 0 0	0	0
Need to add the lookup for existing query and show the status I have the stores and I want to check the status of store whether it is up or down i want to show the status with hel... by Veeru Path Finder in Splunk Search 06-01-2022 0 5	0	5
Help with search that creates Table with host, sourcetype, sample event or log Hi Splunkers, I need to make a statistical table to show me the hosts and each sourcetype that it generates and the c... by muradgh Path Finder in Splunk Search 06-01-2022 0 6	0	6
Is there a way to send full dashboard results with CSV file not PDF file? Dears, Is there a way to send the dashboard results by use CSV file rather than PDF? Regards by Abdullah Explorer in Splunk Search 06-01-2022 0 1	0	1
How do I Display fields in a table after stats command? Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of time... by adamfrisbee Explorer in Splunk Search 06-01-2022 0 2	0	2
What's the lifespan of the new created fields? Will be available after re-login and available to all users? Hello Splunk Community! Regarding extract new fields in splunk search, what's the lifespan of the new created fields... by sophiacyh Explorer in Splunk Search 06-01-2022 0 4	0	4
REGEX - Replace numbers with an asterisk, multiple apperances Hi, I am trying to find a way to replace numbers in strings with an asterisk, if they are concatenated with one, and ... by KMoryson Explorer in Splunk Search 06-01-2022 0 1	0	1