Splunk Search

Community Activity

Help with regex needed in Splunk "resource_id": "/subscriptions/850686fe-9b2b-48ab-81a6-80600a0ca5z1/resourceGroups/vg-weu-ltaprod-rg/providers/Micros... by RSS_STT Explorer in Splunk Search 03-11-2026 0 5	0	5
Upload large file Hi, How does one upload files larger than 500mb? I get an error "File too large. The file selected is 996Mb. Maximum... by mwdbhyat Builder in Splunk Search 03-08-2026 0 17	0	17
rex help - extracting string between quotes I have a LogStash feed coming in, with events containing a string following this example;"message":"Transfer end logg... by rob_gibson Path Finder in Splunk Search 03-08-2026 0 8	0	8
Is datamodel command as fast as tstats command on accelerated data models? Hi,I've gone through Splunk documentation but still struggle to find an official answer to my question.Given an accel... by wp-uk-36 Explorer in Splunk Search 03-08-2026 0 2	0	2
Splunk ID I am trying to sign up for the Splunk Core User cert. Where do I find my Splunk ID by Jayhawker1610 New Member in Splunk Search 03-05-2026 0 1	0	1
sendemail command - naming convention - attachment Hello everyone, I would like to ask you for an assistance if possible. Is there a way how to rename an attachment whe... by Kopcisko Engager in Splunk Search 03-04-2026 0 1	0	1
How to find which indexes are used? I have a simple question how can I check that in which of the apps a particular index has been used. by Siddharthnegi Contributor in Splunk Search 03-03-2026 0 6	0	6
What could be the reason why I can't modify the alert search section? Hello Guys,When I click the edit button for the alerts, the "search" input box is grey as showed below, I cannot modi... by Iris_Pi Path Finder in Splunk Search 03-02-2026 0 2	0	2
Splunk rex command Hi Team,Can someone Kindly help with a rex pattern for the below splunk log.Attached a sample splunk log and rx patte... by JohnsonMarcus Engager in Splunk Search 02-24-2026 0 1	0	1
Search formatting in Splunk 6.5.0 for easier readability I saw a feature in Splunk 6.5.0 where you can press a single button in the search bar and it will autoformat the quer... by markdflip Path Finder in Splunk Search 02-24-2026 7 19	7	19
Earliest... Latest at 23:59:59 skipped! Hello.I found out that running a search to find events from 00:00:00 to 23:59:59, when i want H24 all events, using l... by verbal_666 Builder in Splunk Search 02-22-2026 0 6	0	6
Getting concurrent connections from transactions index=myindex "event=login" OR "event=logout" \| transaction username startswith="event=login" endswith="event=logout... by bekirk Explorer in Splunk Search 02-21-2026 0 5	0	5
Ingest processor problem Hello,How can I use the ingest processor to obtain the actual ingest without that information reaching the cloud?My d... by acs12 Engager in Splunk Search 02-20-2026 0 5	0	5
How does foreach + rename impact performance? I'm really confused about performance related to use of foreach + rename. I have a macro that renames potential name ... by yuanliu SplunkTrust in Splunk Search 02-19-2026 0 2	0	2
how to search a exact match inside a multivalue field Hi, I am trying to search exact matches inside a multivalue field using the mvfind command. Unfortunately, it uses re... by corti77 Contributor in Splunk Search 02-18-2026 0 4	0	4
How do I get a list of all my lookups with their file size? Hey Splunkers,I wanted to get a list of all the lookup files on my SH and their file sizes along with other data. I c... by BuzzLights10 Explorer in Splunk Search 02-18-2026 1 11	1	11
subsearch in a stats command? I'm using this command to search dhcp logs and find devices that are new in the last 30 days other than a list of exp... by ilhwan Path Finder in Splunk Search 02-17-2026 0 4	0	4
[Dashboard studio] Hiding sort indicators in table Hi, Is it possible to hide sort indicators in the headers of a table in Dashboard studio?Thank you by wp-uk-36 Explorer in Splunk Search 02-16-2026 0 2	0	2
Why is using loadjob command (using sid) slower than create a new search query? Hello, I created a dashboard with a table and multiple charts. After the table query is finished, I create a token ($... by karn Path Finder in Splunk Search 02-13-2026 0 1	0	1
How do I filter a large number of ip_client address? While tuning a Web Application Firewall (WAF), I'm attempting to filter out all the hostile IP addresses attacking th... by fkabell New Member in Splunk Search 02-11-2026 0 3	0	3
REST API I'm trying to work out how I execute a saved search / report using the REST API. I have created the token and have a... by balcv Contributor in Splunk Search 02-11-2026 0 2	0	2
how to query OCI Audit logs from Datasafe Hello Splunk community, I'm ata delimma, Our organiztion is transitioning to an OCI cloud environment so the way we u... by rmoon91 New Member in Splunk Search 02-11-2026 0 0	0	0
Search lookup for user in specific group and sub search if user is in other groups from same lookup and set value I have a system user lookup where all users are at least assigned to the GU group but can also be assigned to other g... by ramuzzini Path Finder in Splunk Search 02-10-2026 0 5	0	5
where IN ("*") from the token definition Hi, here is the description of the status quo. There is multiselect element defined by a token tkn1. Output variable ... by spisiakmi Builder in Splunk Search 02-08-2026 0 3	0	3
eval case statement Hi, Am using case statement to sort the fields according to user requirement and not alphabetically. eval sort_fie... by surekhasplunk Communicator in Splunk Search 02-07-2026 2 5	2	5