Splunk Search

Community Activity

How to convert seconds into hours, minutes and seconds? Hi all I'm not sure if somebody already asked a question like mine.How can I convert a field containing a duartion (n... by Simon Contributor in Splunk Search 05-10-2022 2 18	2	18
How to achieve average number of events per unit of time in different days of the week? Hi. How I can compare load during the same time every day for business days? I.e. time 11:oo AM - 7:00 PM on Monday, ... by bigll Path Finder in Splunk Search 05-10-2022 0 2	0	2
How do I check, how long it took for one of the event to appear in splunk? Hello All,How do I check, how long it took for one of the event to appear in splunk? By the way, Solved: How do i fin... by msg4sunil Path Finder in Splunk Search 05-10-2022 0 2	0	2
Help with timechart drilldown without by clause hello I timechart events without a by clause \| timechart count(crash) as "crash" count(hang) as "hang" When I... by jip31 Motivator in Splunk Search 05-10-2022 0 18	0	18
How to Add missing date by each id and fill 0 or null? Hi everyone, I have a list of id and event by day. But some days are missing for some id, now I want to fill 0 or nul... by Julia1231 Communicator in Splunk Search 05-10-2022 0 1	0	1
How to select only specific values into search? Hi all, I have a table and I need to highlight the values that are greater than lets say 5 in a line graph. how to se... by badrinath Path Finder in Splunk Search 05-09-2022 0 11	0	11
How to write a Search to detect AD DSRM persistence? Hi All,Has anybody implemented a search to detect the following use case ?https://adsecurity.org/?p=1785 Any suggesti... by neerajs_81 Builder in Splunk Search 05-09-2022 0 0	0	0
How to create a timechart with a time field? I'm trying to make a time chart where it uses the time value specified in my table. Rather than the default _time va... by Marco_Develops Path Finder in Splunk Search 05-09-2022 0 1	0	1
How to create regex to capture a whole string? I have a big event and I want to capture the string between "Message=" and "UpDocCaseRepository" in other words i wan... by MOHITJOSHI Engager in Splunk Search 05-09-2022 0 1	0	1
Can someone explain what a SearchResultWorkUnit is and why it would timeout? I am using the SDK to create my first custom search command. I'm using the Splunk Free version to test it out. It wor... by grittonc Contributor in Splunk Search 05-09-2022 0 1	0	1
How to create an alert for when the VPN goes down but only when the drop lasts more than 1 minute? Hi I need to create an alert for when the VPN goes down but only when the drop lasts more than 1 minute. I would appr... by splunkcol Builder in Splunk Search 05-09-2022 0 3	0	3
Fill null delta for multiple object Hello all,I have a set of data as below. In the column is value of each id according to the time_timeid = 12345id = 1... by Julia1231 Communicator in Splunk Search 05-09-2022 0 4	0	4
How to use fieldcolors Hi, In one of my graphs I try to fixate the areacolors to red and green. However, I can't figure out how.Tried this: ... by ericvdhout Path Finder in Splunk Search 05-09-2022 0 1	0	1
Extracting fields from slightly different tab delimited logs I have two slightly different forms of a tab delimited log. Both are in the same index and have the same source type... by MScottFoley Path Finder in Splunk Search 05-09-2022 0 3	0	3
How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? Hi, Am quite new to splunk so lease bear with me if I ask obvious questions. However things that were relatively si... by ericvdhout Path Finder in Splunk Search 05-09-2022 0 16	0	16
Windows Event Message Field - RegEx Issue - Certainly something wrong / bug Plenty of people struggle with this and with no definitive answer either... Unless someone cares to point something ... by jlvix1 Communicator in Splunk Search 05-09-2022 0 18	0	18
Merge Powershell: Why the errors outputs from Universal Forwarders in index="_internal"? Hello all, We receive the "splunkd.log" from every Universal Forwarder into our "_internal" index. There are some ev... by denissotoacc Path Finder in Splunk Search 05-09-2022 0 4	0	4
Using nested tstats to detect foreign ip and then search in traffic for connections between foreign ip and local hello , i want to detect foreign ip at first step, then search in traffic for connections between foreign ip and othe... by el666nino Loves-to-Learn Everything in Splunk Search 05-09-2022 0 0	0	0
Is there a way I can remove a time period from my timechart? Hi, I have a very basic timechart from the below search. Just counts the number of events=40 (event ID). The issue is... by Midge87 Explorer in Splunk Search 05-09-2022 0 6	0	6
How to create a Report that send emails row by row, with the contents in columns? Hi all,I'm not a English native speaker, but I will do my best to explain ther question.To be clear, I need done this... by DS904458 Explorer in Splunk Search 05-09-2022 0 4	0	4
Stats - Why isn't Splunk converting _time to Human readable format Hello,I have the below search <base search>.. \|stats values(Source) as Source count min(_time) as firstTime max(_ti... by neerajs_81 Builder in Splunk Search 05-08-2022 0 3	0	3
How to calculate age of event? Hi I have for each event the open_time and update_time, I want to calculate the age of the event, like: open_time ... by ednk Explorer in Splunk Search 05-08-2022 0 3	0	3
How does the cluster command work? hi how exactly cluster commad work?I have lots of unstructured data that has different key and value, how splunk dete... by indeed_2000 Motivator in Splunk Search 05-07-2022 0 0	0	0
How to trim information from search output? Hi, I am having the following query: index=* sourcetype=CustomAccessLog \| table "host", "source" The output is: h... by jugarugabi Path Finder in Splunk Search 05-06-2022 0 2	0	2
Why the error when trying to search? Hello, everyone! I get error "WARN: Search filters specified using splunk_server/splunk_server_group do not match any... by bosseres Contributor in Splunk Search 05-06-2022 0 1	0	1