Splunk Search

Community Activity

	How do I add the time zone after the time in the field? Hello,Good Day! I having the values in the field Data As shown below 2022-05-31 10:18:09 emea 2022-05-31 2022-0... by Veeru Path Finder in Splunk Search 06-01-2022 0 3	0	3
	How to Evaluate a field from the list of another search and create a table There are two queries `query 1` will give ID, TIME fields `query 2` will give list of SPECIAL_ID I want to create a t... by manorajk Engager in Splunk Search 05-31-2022 0 2	0	2
	How to extract a multi value field called "GroupName" from my JSON data via the Field extractor IFX? Hello, Can someone pls guide how to extract a multi value field called "GroupName" from my JSON data via the Field e... by neerajs_81 Builder in Splunk Search 05-31-2022 0 4	0	4
	How to build a query which would take input CSV file and search for logs? I am importing signin logs from azure and I want to built a query which should take input from a csv file (appid) and... by shahidkhan545 New Member in Splunk Search 05-31-2022 0 1	0	1
	How to only allow token authentication for REST API? Is it possible to only allow REST API access with token authentication and not username:password? Is there a config t... by klim Path Finder in Splunk Search 05-31-2022 0 0	0	0
	This delim in my query is not working, how could I possibly solve this problem? Hello everyone.I'm fairly new to Splunk, I've recently joined a job as a security analist in a SOC where I get to use... by Berfomet96 Explorer in Splunk Search 05-31-2022 0 1	0	1
	Find similar pattern in query- which one it used most? Hi I have table like below, each word is parameter of a search query, now want to know which of them mostly use? SPL... by indeed_2000 Motivator in Splunk Search 05-31-2022 0 5	0	5
	tstats - Why won't Job finalize/ takes a long time to finalize? Search job won't finish and causing resource drain on shared indexers and ES.I am suspecting I might not be using 'ts... by zacksoft_wf Contributor in Splunk Search 05-31-2022 0 1	0	1
	Is there a way to dynamically set latest in tstats? I've done this in the past and it works to get data for today up to the latest 5 minute span, but I'm hoping to speed... by fredclown Builder in Splunk Search 05-31-2022 0 3	0	3
	Why can I not read grouped data from SPLUNK Rest API via ADF? Hello, I am facing an issue while I try reading from Rest API Splunk Aggregated info. A query that uses the calculati... by kilimche Explorer in Splunk Search 05-31-2022 0 0	0	0
	Help with converting JOIN to STATS/EVENTSTATS I started with the following query, required to join a knowledge library with discovered hosts. The results are store... by tlmayes Contributor in Splunk Search 05-31-2022 0 6	0	6
	Help with JSON Regex extraction Similar to https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-all-fields-from-userdata/m-p/596078#M207501... by siksaw33 Path Finder in Splunk Search 05-31-2022 0 3	0	3
	Is there any way to search "search server=server1" more efficient like "user"? Hi I have SPL like below: index="myindex" user \| rex field=source "\/data\/(?<product>\w+)\/(?<date>\d+)\/(?<server>\... by indeed_2000 Motivator in Splunk Search 05-31-2022 0 3	0	3
	How to Table username if two action at the same time Hi, I'm looking for users that login into an application and reset the password at the same time . The logs involved ... by marco_massari11 Communicator in Splunk Search 05-31-2022 0 5	0	5
	How can I apply such restriction even in accelerated datamodels? Hello,I'm facing a problem with role restriciton in searchs. I applied the restriction in the role and everything was... by guilhermecervo New Member in Splunk Search 05-31-2022 0 0	0	0
	How to display null event result (fillnull) Hi,I have an event display problem when no events matching the conditions are found.I want to filter only those event... by antonio147 Communicator in Splunk Search 05-31-2022 0 4	0	4
	How can we use dynamic token to compare x hours vs last 1 week ago? Hello Splunkers!! Below is the search where we are comparing the last 3 hours vs 1 week ago data. How can we use dyna... by LogUx Motivator in Splunk Search 05-31-2022 0 14	0	14
	Why are the same queries getting different result? Hi I have exactly two SPL, same date range, one with "tracnsaction" command another wirhout it. as you see in picture... by indeed_2000 Motivator in Splunk Search 05-31-2022 0 2	0	2
	Why do different ip addresses have different search speeds? version : splunk enterprise 8.1.3I have a datasource with a field that is either an ip address.The following ip addr... by haruban36 Explorer in Splunk Search 05-31-2022 0 4	0	4
	How to extract user email from raw message and assign to a field? This looks easy but I couldn't figure it out. Any help is appreciated.How to extract user email from raw message and ... by vaishalireddy New Member in Splunk Search 05-31-2022 0 3	0	3
	Why when I use transaction command, search is not extracting some fields Hi try to use transaction command, but actionName is empty! Here is my SPL \| rex "actionName.*\.(?<actionName>\w+... by indeed_2000 Motivator in Splunk Search 05-30-2022 0 5	0	5
	Why is Transaction command not working as expected? I encounter with strange issue when i use transaction and at the end sort by duration it show highest duration is 150... by indeed_2000 Motivator in Splunk Search 05-30-2022 0 1	0	1
	How to extract text from Message field This should be something simple to figure out, but I can't get it to work. I want to extract username from Message f... by HMIPowell Explorer in Splunk Search 05-30-2022 0 4	0	4
	How to summarize table from multiple records? index="np-dockerlogs" source="gps-request-processor-dev" sourcetype= "eu-central-1" event="Request"\| fields ... by csahoo Explorer in Splunk Search 05-30-2022 0 3	0	3
	How to Display the time when logs are not ingested? Hi Experts, I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many log... by Karthikeyan Engager in Splunk Search 05-30-2022 0 1	0	1