Splunk Search

Community Activity

How do I round the time to up/down to the nearest hour? Hi I'm fairly new to Splunk and I need to round my time field up/down to the nearest hour. For example... If now retu... by darls15 Explorer in Splunk Search 03-11-2022 0 3	0	3
How to extract field name and field values from multi-value field? I am indexing email data that Splunk reads from an inbox folder (via TA-mailclient). Those emails contain a csv file ... by dm1 Builder in Splunk Search 03-10-2022 0 4	0	4
How to use xml cdata tag for not displaying characters? hi I use a "link to the search" drilldown from a table panel When I have a look to my xml, I have a lot of special ... by jip31 Motivator in Splunk Search 03-10-2022 0 4	0	4
How do I split a multi value single field into multi fields? JSON field=value pairing i have a log with single field name TestCategories and has multiple values in it like--x,y,z... by MOHITJOSHI Engager in Splunk Search 03-10-2022 0 1	0	1
Why am I receiving inconsistent inputlookup behavior? I am updating a CSV on disk via the search api using outputlookup. Each time I run my script using the same source C... by cvjbrooks New Member in Splunk Search 03-10-2022 0 2	0	2
How to display the results even if the result is 0 but just for hour corresponding to the current hour or to previous? hello as you can see i stats events following the bin time value But when the bin time value is equal to 0, I have no... by jip31 Motivator in Splunk Search 03-10-2022 0 14	0	14
How to export the results of a Splunk search that contains transforming commands? I am looking to export the results of a Splunk search that contains transforming commands. When I run the same searc... by CarbonCriterium Path Finder in Splunk Search 03-10-2022 0 4	0	4
Windows account enabled after been disabled Hi Splunkers,i'm trying to build a most common search, wich is: track when a WIndows/Active Directory account is chan... by SIEMStudent Path Finder in Splunk Search 03-10-2022 0 2	0	2
How to use eval to assign a field values of two different fields? Gentlemen,How can i use eval to assign a field values of 2 different fields ?In my events, i have 2 fields: empID ... by neerajs_81 Builder in Splunk Search 03-10-2022 0 6	0	6
Is it possible to speed up the search or improve the running performance by increasing the number of sourcetype I have a log like below: index=login sourcetype=login new_user=1 I also have logs without new_user label index=log... by Minghao Explorer in Splunk Search 03-10-2022 0 9	0	9
Why is extracted field formatted incorrectly? I have the following log that Splunk is not recognizing well : msg=id=123342521352 operation=write How can I write ... by yk010123 Path Finder in Splunk Search 03-09-2022 0 1	0	1
How to include percentage change to Last Week / Prior Week Chart (table) Hi,Long time reader, first time poster. I've cobbled together this query that generates a count by status for last w... by mreid2005 Observer in Splunk Search 03-09-2022 0 1	0	1
Why are there issues with delta query by multiple hostnames? index=testlab sourcetype=testcsv \| rex field="status detail" "(?<message_received_name>Messages Received)\\s*[0-9,... by thaghost99 Path Finder in Splunk Search 03-09-2022 0 1	0	1
How to display percentage of items passed over each week SOURCE CODE \| eventstats count(eval(errorCount=0)) AS passed, count(shortVIN) AS total \| timechart span=1w@w0 eval((p... by wjmaxwe2 New Member in Splunk Search 03-09-2022 0 1	0	1
How find the first event of type A after the last event of type B? I'm trying to extract a report for devices in my network. Home assistant sends a log record with a value of 1 when a ... by gtamaki Engager in Splunk Search 03-09-2022 0 2	0	2
How to compare the value of same fields derived from rex command? hi i am hoping for some help regarding this. basically i would like to compare (subtract current to previous) the val... by thaghost99 Path Finder in Splunk Search 03-09-2022 0 5	0	5
Why are getting this error after the search finishes: Large subsearches Failing - StatsFileWriterLz4 file open failed? We are having an issue with our new 8.2.2 splunk instance any time there's a subsearch with a lot of data being searc... by rwinkler Loves-to-Learn in Splunk Search 03-09-2022 0 0	0	0
Why does my Event show as 2 years delayed? I am looking for “failed login for ADMIN detected” but because the time in Time is two years late it doesn’t alert. M... by Fe-atSplunk Explorer in Splunk Search 03-09-2022 0 4	0	4
How to get the output of particular text from the log message? Hi Team i have a log message and i want to filter the all log messages which contains the below highlighted text. and... by Bala Explorer in Splunk Search 03-09-2022 0 3	0	3
Is it possible to call Splunk RestAPI with request in JSON? Hello all, is it possible to call Splunk RestAPI with request in JSON. I am trying in SOAP UI software, media Type = ... by jakubvojacek Loves-to-Learn in Splunk Search 03-09-2022 0 1	0	1
How to lookup on all values of a multivalue field? I have an external lookup script that works mostly fine. Given an IP address from an event, it can match the address ... by ave19 Explorer in Splunk Search 03-09-2022 0 7	0	7
How to check if field exists and bring another field if true Hi, I have this search: \| spath \| rename object.* as * \| spath path=events{} output=events \| stats by timestamp, ev... by fpedrosa Engager in Splunk Search 03-09-2022 0 7	0	7
How to display the volume of connections per day of the week to a single IP to show which days are busiest? index=Network dest_ip=xx.xx.xx.xx action=allowed Trying to list total allowed connections to destination IP by day, r... by Gurv_Bahad Engager in Splunk Search 03-09-2022 0 6	0	6
How to create a candlestick chart within Splunk 6? I am trying to create a candlestick chart within Splunk 6, but not having much luck finding any options for this with... by mbrown_splunk Splunk Employee in Splunk Search 03-09-2022 1 7	1	7
How to limit the number of characters in a field in a result? Hello community, I have a problem with my research. My searches are then sent to Splunk OnCall to manage alerts.Howev... by Rajaion Path Finder in Splunk Search 03-09-2022 0 8	0	8