Splunk Search

Community Activity

	Getting error while accessing Splunk dataset- How do I fix? Getting error : "The lookup table 'Horizon_Feb_2022.csv' requires a .csv or KV store lookup definition."while running... by jinishshah Explorer in Splunk Search 06-01-2022 0 0	0	0
	Need to add the lookup for existing query and show the status I have the stores and I want to check the status of store whether it is up or down i want to show the status with hel... by Veeru Path Finder in Splunk Search 06-01-2022 0 5	0	5
	Help with search that creates Table with host, sourcetype, sample event or log Hi Splunkers, I need to make a statistical table to show me the hosts and each sourcetype that it generates and the c... by muradgh Path Finder in Splunk Search 06-01-2022 0 6	0	6
	Is there a way to send full dashboard results with CSV file not PDF file? Dears, Is there a way to send the dashboard results by use CSV file rather than PDF? Regards by Abdullah Explorer in Splunk Search 06-01-2022 0 1	0	1
	How do I Display fields in a table after stats command? Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of time... by adamfrisbee Explorer in Splunk Search 06-01-2022 0 2	0	2
	What's the lifespan of the new created fields? Will be available after re-login and available to all users? Hello Splunk Community! Regarding extract new fields in splunk search, what's the lifespan of the new created fields... by sophiacyh Explorer in Splunk Search 06-01-2022 0 4	0	4
	REGEX - Replace numbers with an asterisk, multiple apperances Hi, I am trying to find a way to replace numbers in strings with an asterisk, if they are concatenated with one, and ... by KMoryson Explorer in Splunk Search 06-01-2022 0 1	0	1
	How do I add the time zone after the time in the field? Hello,Good Day! I having the values in the field Data As shown below 2022-05-31 10:18:09 emea 2022-05-31 2022-0... by Veeru Path Finder in Splunk Search 06-01-2022 0 3	0	3
	How to Evaluate a field from the list of another search and create a table There are two queries `query 1` will give ID, TIME fields `query 2` will give list of SPECIAL_ID I want to create a t... by manorajk Engager in Splunk Search 05-31-2022 0 2	0	2
	How to extract a multi value field called "GroupName" from my JSON data via the Field extractor IFX? Hello, Can someone pls guide how to extract a multi value field called "GroupName" from my JSON data via the Field e... by neerajs_81 Builder in Splunk Search 05-31-2022 0 4	0	4
	How to build a query which would take input CSV file and search for logs? I am importing signin logs from azure and I want to built a query which should take input from a csv file (appid) and... by shahidkhan545 New Member in Splunk Search 05-31-2022 0 1	0	1
	How to only allow token authentication for REST API? Is it possible to only allow REST API access with token authentication and not username:password? Is there a config t... by klim Path Finder in Splunk Search 05-31-2022 0 0	0	0
	This delim in my query is not working, how could I possibly solve this problem? Hello everyone.I'm fairly new to Splunk, I've recently joined a job as a security analist in a SOC where I get to use... by Berfomet96 Explorer in Splunk Search 05-31-2022 0 1	0	1
	Find similar pattern in query- which one it used most? Hi I have table like below, each word is parameter of a search query, now want to know which of them mostly use? SPL... by indeed_2000 Motivator in Splunk Search 05-31-2022 0 5	0	5
	tstats - Why won't Job finalize/ takes a long time to finalize? Search job won't finish and causing resource drain on shared indexers and ES.I am suspecting I might not be using 'ts... by zacksoft_wf Contributor in Splunk Search 05-31-2022 0 1	0	1
	Is there a way to dynamically set latest in tstats? I've done this in the past and it works to get data for today up to the latest 5 minute span, but I'm hoping to speed... by fredclown Builder in Splunk Search 05-31-2022 0 3	0	3
	Why can I not read grouped data from SPLUNK Rest API via ADF? Hello, I am facing an issue while I try reading from Rest API Splunk Aggregated info. A query that uses the calculati... by kilimche Explorer in Splunk Search 05-31-2022 0 0	0	0
	Help with converting JOIN to STATS/EVENTSTATS I started with the following query, required to join a knowledge library with discovered hosts. The results are store... by tlmayes Contributor in Splunk Search 05-31-2022 0 6	0	6
	Help with JSON Regex extraction Similar to https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-all-fields-from-userdata/m-p/596078#M207501... by siksaw33 Path Finder in Splunk Search 05-31-2022 0 3	0	3
	Is there any way to search "search server=server1" more efficient like "user"? Hi I have SPL like below: index="myindex" user \| rex field=source "\/data\/(?<product>\w+)\/(?<date>\d+)\/(?<server>\... by indeed_2000 Motivator in Splunk Search 05-31-2022 0 3	0	3
	How to Table username if two action at the same time Hi, I'm looking for users that login into an application and reset the password at the same time . The logs involved ... by marco_massari11 Communicator in Splunk Search 05-31-2022 0 5	0	5
	How can I apply such restriction even in accelerated datamodels? Hello,I'm facing a problem with role restriciton in searchs. I applied the restriction in the role and everything was... by guilhermecervo New Member in Splunk Search 05-31-2022 0 0	0	0
	How to display null event result (fillnull) Hi,I have an event display problem when no events matching the conditions are found.I want to filter only those event... by antonio147 Communicator in Splunk Search 05-31-2022 0 4	0	4
	How can we use dynamic token to compare x hours vs last 1 week ago? Hello Splunkers!! Below is the search where we are comparing the last 3 hours vs 1 week ago data. How can we use dyna... by uagraw01 Motivator in Splunk Search 05-31-2022 0 14	0	14
	Why are the same queries getting different result? Hi I have exactly two SPL, same date range, one with "tracnsaction" command another wirhout it. as you see in picture... by indeed_2000 Motivator in Splunk Search 05-31-2022 0 2	0	2