Splunk Search

Community Activity

	How to filter Search 1 result from Search 2 returned value? We have many completely diff events. Sometimes, we got a result based on Search 1. But we want to exclude some record... by QQAL2021 Engager in Splunk Search 03-14-2022 0 4	0	4
	How do I create a field extraction that match/pick only the event which contains "ccexpire"? I would like to match/pick only the event which contains "ccexpire". sample event :- 09/Dec/2021 23:52:39,Query,"SELE... by Borntowin Loves-to-Learn Everything in Splunk Search 03-13-2022 0 3	0	3
	Why is outer join working with inputlookup but not with index? Hi All,I have transaction data from a database and want to compare it with an index in splunk, filtering the transact... by rahmatn Path Finder in Splunk Search 03-13-2022 0 6	0	6
	Why can't tstats search sourcetype field specifically? Hi All, I'm running the query \| tstats count where index=<index name> by sourcetype No results OR \| tstats values(... by hketer Path Finder in Splunk Search 03-13-2022 0 1	0	1
	How to search that shows the current uptime of the server? and the date / time / user who last reboot the server? How to search that shows the current uptime of the server? and the date / time / user who last reboot the server? by afraanajam Loves-to-Learn Everything in Splunk Search 03-13-2022 0 5	0	5
	How to avoid a join in a lookup search? I have 3 searches executing against same lookup, and since each lookup needs to be grouped by different set of fields... by kalibaba2021 Path Finder in Splunk Search 03-13-2022 0 5	0	5
	How to get a count with dedup? i have the following in a statistical table on a dashboard index=* <do search> \| dedup B C \| table _time B C D E F J ... by tazzvon Engager in Splunk Search 03-13-2022 0 3	0	3
	How to get incremental count of data? Hi Team, I am looking to get incremental count of some data in dashboard. For example : If the count for a certain ta... by aaa2324 Explorer in Splunk Search 03-13-2022 0 3	0	3
	Why do I get this error in my search? <title> Clam Scan Results </title> <event> <search> ref="anti-virus scan results"> </search> <option name="list.drill... by cj04 Explorer in Splunk Search 03-12-2022 0 3	0	3
	Why is apache logs relevant field name not showing in details log? Hello , I have installed forwarder on Linux system and able to see logs in searches but the when i open a detailed lo... by Jaycybersec Explorer in Splunk Search 03-12-2022 0 5	0	5
	How to produce a table that can display 5xx status code counts per host over a timeframe? I am trying to produce a table that can display 5xx status code counts per host over a timeframe (this will eventuall... by ccntech Explorer in Splunk Search 03-12-2022 0 3	0	3
	How calculate the % based on two different tables where I am using addcoltotals to calculate grand total? Hi Team, I want to calculate the % based on two different tables where I am using addcoltotals to calculate grand t... by ND Path Finder in Splunk Search 03-11-2022 0 1	0	1
	How to get fields extracted by two fields? i need the fields extracted by two fields 1) Detail message = before the comma ( I need the full description) 2... by kc_prane Communicator in Splunk Search 03-11-2022 0 6	0	6
	Why am I unable to add field values over timechart? Hi, I have 2 timecharts where I need to show a TOTAL count across specified field values. The first timechart must sh... by P_Orourke Loves-to-Learn Lots in Splunk Search 03-11-2022 0 1	0	1
	How do I extract this field with regex for Nmap result? Hi i want to extract the mac_algorithms field with regex from a nmap scan result. Does anyone have an idea how it wor... by bnybln030 Engager in Splunk Search 03-11-2022 0 13	0	13
	How do I add the values in a single row and three columns? stats count(eval(searchmatch(Bala))) as A count(eval(searchmatch(kasa))) as B count(eval(searchmatch(reddy))) as C A... by Bala Explorer in Splunk Search 03-11-2022 0 8	0	8
	How do I use xyseries get the count and the values for each field? Hi Team, I have the following result in place with 30min bucket using stats values() and then xyseries time ... by bijodev1 Communicator in Splunk Search 03-11-2022 0 4	0	4
	How to use files got as results from one query as source in another query? Hi all, I have 2 queries, from one i get a list of files and the other query should use these files as their source t... by anooshac Communicator in Splunk Search 03-11-2022 0 7	0	7
	How to create event if no results are returned? Hello Community, I have quite a strange issue to face...For a project I'm working on, I would need to create a new ca... by Gian89 Explorer in Splunk Search 03-11-2022 0 4	0	4
	How to merge 2 search in one search? Hello I use 2 separate search almost identical Now I want to merge these 2 search in one search Here is the search ... by jip31 Motivator in Splunk Search 03-11-2022 0 14	0	14
	How do I round the time to up/down to the nearest hour? Hi I'm fairly new to Splunk and I need to round my time field up/down to the nearest hour. For example... If now retu... by darls15 Explorer in Splunk Search 03-11-2022 0 3	0	3
	How to extract field name and field values from multi-value field? I am indexing email data that Splunk reads from an inbox folder (via TA-mailclient). Those emails contain a csv file ... by dm1 Contributor in Splunk Search 03-10-2022 0 4	0	4
	How to use xml cdata tag for not displaying characters? hi I use a "link to the search" drilldown from a table panel When I have a look to my xml, I have a lot of special ... by jip31 Motivator in Splunk Search 03-10-2022 0 4	0	4
	How do I split a multi value single field into multi fields? JSON field=value pairing i have a log with single field name TestCategories and has multiple values in it like--x,y,z... by MOHITJOSHI Engager in Splunk Search 03-10-2022 0 1	0	1
	Why am I receiving inconsistent inputlookup behavior? I am updating a CSV on disk via the search api using outputlookup. Each time I run my script using the same source C... by cvjbrooks New Member in Splunk Search 03-10-2022 0 2	0	2