Splunk Search

Community Activity

	Why do I need a \| when using a macro with a generating command? I have a macro that starts with a search command. When I ran it, I noticed I was getting a different number of resul... by cvg1wby Explorer in Splunk Search 06-01-2022 0 2	0	2
	Help with a simple search I am trying to do a search where by: index=firewall (src_ip=172.16.0.0/12) dest_ip!(172.16.0.0/12) \| table src_ip ... by agallegos Engager in Splunk Search 06-01-2022 0 3	0	3
	Why is search for multiple Windows events failing? I am running Splunk Enterprise and am trying to create a dashboard panel "Events" search string that pulls multiple W... by Robert11 Path Finder in Splunk Search 06-01-2022 0 6	0	6
	How to calculate the percentage increase (or decrease) in each error/success code based on previous hour? Team, I have below timechart which is counting http error/success codes for a span of 1hr. Now I need to calculate t... by onthakur Explorer in Splunk Search 06-01-2022 0 2	0	2
	How to create a table to show all the values from the below log lines? Log Lines are as given belowReports obtained. MyId=NameOne, sId=s0, Reports=true, LogString= url=status.com, Type=bas... by olilloyd Engager in Splunk Search 06-01-2022 0 1	0	1
	How to represent two fields values in row wise and one field value column wise in Splunk table? HI, I am trying to recreate the same structure in Splunk which was created in excel. I have five fields week, total t... by spkriyaz Path Finder in Splunk Search 06-01-2022 0 1	0	1
	How to Work Around Distinct 10K Limit Hi, trying to get stats of user search stats. I'm struggling trying to workaround the 10K limit with distinct , stats... by chrisboy68 Contributor in Splunk Search 06-01-2022 0 0	0	0
	Getting error while accessing Splunk dataset- How do I fix? Getting error : "The lookup table 'Horizon_Feb_2022.csv' requires a .csv or KV store lookup definition."while running... by jinishshah Explorer in Splunk Search 06-01-2022 0 0	0	0
	Need to add the lookup for existing query and show the status I have the stores and I want to check the status of store whether it is up or down i want to show the status with hel... by Veeru Path Finder in Splunk Search 06-01-2022 0 5	0	5
	Help with search that creates Table with host, sourcetype, sample event or log Hi Splunkers, I need to make a statistical table to show me the hosts and each sourcetype that it generates and the c... by muradgh Path Finder in Splunk Search 06-01-2022 0 6	0	6
	Is there a way to send full dashboard results with CSV file not PDF file? Dears, Is there a way to send the dashboard results by use CSV file rather than PDF? Regards by Abdullah Explorer in Splunk Search 06-01-2022 0 1	0	1
	How do I Display fields in a table after stats command? Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of time... by adamfrisbee Explorer in Splunk Search 06-01-2022 0 2	0	2
	What's the lifespan of the new created fields? Will be available after re-login and available to all users? Hello Splunk Community! Regarding extract new fields in splunk search, sophiacyh_0-1653300660415.png what's the lifes... by sophiacyh Explorer in Splunk Search 06-01-2022 0 4	0	4
	REGEX - Replace numbers with an asterisk, multiple apperances Hi, I am trying to find a way to replace numbers in strings with an asterisk, if they are concatenated with one, and ... by KMoryson Explorer in Splunk Search 06-01-2022 0 1	0	1
	How do I add the time zone after the time in the field? Hello,Good Day! I having the values in the field Data As shown below 2022-05-31 10:18:09 emea 2022-05-31 2022-0... by Veeru Path Finder in Splunk Search 06-01-2022 0 3	0	3
	How to Evaluate a field from the list of another search and create a table There are two queries `query 1` will give ID, TIME fields `query 2` will give list of SPECIAL_ID I want to create a t... by manorajk Engager in Splunk Search 05-31-2022 0 2	0	2
	How to extract a multi value field called "GroupName" from my JSON data via the Field extractor IFX? Hello, Can someone pls guide how to extract a multi value field called "GroupName" from my JSON data via the Field e... by neerajs_81 Builder in Splunk Search 05-31-2022 0 4	0	4
	How to build a query which would take input CSV file and search for logs? I am importing signin logs from azure and I want to built a query which should take input from a csv file (appid) and... by shahidkhan545 New Member in Splunk Search 05-31-2022 0 1	0	1
	How to only allow token authentication for REST API? Is it possible to only allow REST API access with token authentication and not username:password? Is there a config t... by klim Path Finder in Splunk Search 05-31-2022 0 0	0	0
	This delim in my query is not working, how could I possibly solve this problem? Hello everyone.I'm fairly new to Splunk, I've recently joined a job as a security analist in a SOC where I get to use... by Berfomet96 Explorer in Splunk Search 05-31-2022 0 1	0	1
	Find similar pattern in query- which one it used most? Hi I have table like below, each word is parameter of a search query, now want to know which of them mostly use? SPL... by indeed_2000 Motivator in Splunk Search 05-31-2022 0 5	0	5
	tstats - Why won't Job finalize/ takes a long time to finalize? Search job won't finish and causing resource drain on shared indexers and ES.I am suspecting I might not be using 'ts... by zacksoft_wf Contributor in Splunk Search 05-31-2022 0 1	0	1
	Is there a way to dynamically set latest in tstats? I've done this in the past and it works to get data for today up to the latest 5 minute span, but I'm hoping to speed... by fredclown Builder in Splunk Search 05-31-2022 0 3	0	3
	Why can I not read grouped data from SPLUNK Rest API via ADF? Hello, I am facing an issue while I try reading from Rest API Splunk Aggregated info. A query that uses the calculati... by kilimche Explorer in Splunk Search 05-31-2022 0 0	0	0
	Help with converting JOIN to STATS/EVENTSTATS I started with the following query, required to join a knowledge library with discovered hosts. The results are store... by tlmayes Contributor in Splunk Search 05-31-2022 0 6	0	6