Splunk Search

Community Activity

Lookup file: Why does scheduling the report diff in limitations from running it in free form search? I have a lookup file that I am generating with a query. The query results in ~59,000 rows currently. If I run the qu... by lmonahan Path Finder in Splunk Search 03-31-2022 0 2	0	2
Why are indexed real-time searches not returning results? I have a Splunk Enterprise cluster (version 8.1.3) that for some reason, is not returning any results for indexed rea... by wishkres Explorer in Splunk Search 03-31-2022 0 2	0	2
How to create a regex that gives the count, if the url string has two question mark symbols (not consecutive though)? Hi Experts, I have an issue with the search string, I have a url text like below and I need to filter that out usin... by sanvica New Member in Splunk Search 03-31-2022 0 2	0	2
How to get a stats count on multiple fields in a table sorted by count? Hi All, I am trying to get the count of different fields and put them in a single table with sorted count. stats co... by adicoza786 Explorer in Splunk Search 03-31-2022 0 6	0	6
How to search a splunk search result? I have a macro named X that uses the lookup in the search and produces the results as follows indexes index IN ("AB... by pavanae Builder in Splunk Search 03-31-2022 0 6	0	6
Streamstats command issue with splunk version 8.2.4 We are seeing strange behavior after updating Splunk from 8.0.4.1 to 8.2.4.The major issue is with all queries that u... by Amirahussein Path Finder in Splunk Search 03-31-2022 0 0	0	0
What are the types of sample logs dump similar to tutorialsdata.zip for exploring splunk search options? Hi, I am looking for various types of sample logs dump similar to tutorialsdata.zip for exploring splunk search opti... by amgsplunk Explorer in Splunk Search 03-31-2022 1 2	1	2
How to extract string from lookup field? Hi, I need to extract a string from a field in a lookup. need to extract between <query> and <query> and the field... by nathanluke86 Communicator in Splunk Search 03-31-2022 0 1	0	1
Why is Lookup definition in transforms.conf not returning results? I have created a lookup in the LOOKUP folder placed in local. Post that I defined the lookup in transforms.conf. This... by _av Loves-to-Learn in Splunk Search 03-31-2022 0 2	0	2
Why is the percentage of non high priority searches skipped (50%) is high? The percentage of non high priority searches skipped (50%) over the last 24 hours is very high and exceeded the red t... by dejiosemeke New Member in Splunk Search 03-31-2022 0 11	0	11
How to design a data catalogue that captures all source types that are being ingested? I'm looking at designing a Splunk data catalogue that captures all source types (and metadata) that are currently bei... by tirelana Engager in Splunk Search 03-30-2022 0 3	0	3
How to sum two rows from a table? I have the following table that I would like to summarize as total logins and total token creationsby creating a new ... by na206b Explorer in Splunk Search 03-30-2022 0 4	0	4
How to get top 20 results from each category based on data size? I've below search: \| tstats summariesonly=true count, sum(All_Traffic.bytes) as total_bytes, sum(All_Traffic.packet... by VatsalJagani SplunkTrust in Splunk Search 03-30-2022 0 2	0	2
How to get the last hour of events but also remove any data after last hour Deleted by michael_wong Path Finder in Splunk Search 03-30-2022 0 3	0	3
Scom: How to remove resolved events that are monitored using dedup? We are ingesting scom events When an alert is triggered it is assigned an id (the earliest event pictured) and we hav... by nathanluke86 Communicator in Splunk Search 03-30-2022 0 5	0	5
How to add background cover for Dashboard Panel Title Colors? Hello, I am trying to add a background cover for the panels within a dashboard. I have attached a photo of what w... by elijahputz Explorer in Splunk Search 03-30-2022 0 11	0	11
Why is it showing "splunk command not found"? SANMEHTP_0-1644162088725.png help by SANMEHTP Observer in Splunk Search 03-30-2022 0 4	0	4
Can I get data out Splunk Cloud Platform? Can I get data in Splunk Cloud Platform?and how can i get it (REST API, library in python,...)Any help is appreciated by tienduyf9 Engager in Splunk Search 03-30-2022 0 6	0	6
How to get the correct rex to extract fields from string? Hi, I have below string and I am trying to get StartTime, EndTime and Count to be displayed in the dashboard. "Non-Ma... by j2menanda Explorer in Splunk Search 03-30-2022 0 8	0	8
How to correlate the results of two searches? Hi all, We have two reverse proxies, one front, one back. They both log http requests and responses to the same index... by sebasti1aan New Member in Splunk Search 03-30-2022 0 2	0	2
How to use a lookup table field to discard events? We have a list of Ips in a lookup table and we want to search events that doesn't match with them. The lookup definit... by JoserraRodrigo New Member in Splunk Search 03-30-2022 0 1	0	1
How to create API to send jobs to splunk app? by ujwalacs20 Engager in Splunk Search 03-30-2022 0 1	0	1
How to get data from Splunk Cloud? Can I use Splunk REST API to get data from Splunk Cloud?Can someone give me some examples? I have read some documents... by tienduyf9 Engager in Splunk Search 03-30-2022 0 1	0	1
How to check for list of values and evaluate true/false? I am new to splunk and i cannot figure out how to check the Values and evaluate True/False.Below is the query that i ... by h3xa Explorer in Splunk Search 03-30-2022 0 5	0	5
How to get data from Monitoring Console into Search head dashboard? Hello, We have a monitoring console that works great. I am able to connect directly to the server containing the cons... by wainwrid Engager in Splunk Search 03-30-2022 0 0	0	0