Splunk Search

Community Activity

	How to use SPLUNK GROUPBY in my search? A002 : A][A004 : 2][A005 : 2000][A006 : 0110][A007 : 85][A008 : VISA Credit][A008.ID : 9][A010 : 1644757200000][A019 ... by jayeshrajvir Explorer in Splunk Search 03-08-2022 0 3	0	3
	How to correlate events from PaloAlto VPN logs and Windows authentication per user, comparing src_ip and machine_name? Hi All! How to correlate events from PaloAlto VPN logs and Windows authentication per user, comparing src_ip and mach... by jfeitosa_real Path Finder in Splunk Search 03-08-2022 0 4	0	4
	How to sum up all the events in all the indexers with a month total? I'm trying to see if there is a report or a query I can run to sum up all the events in all the indexers with a month... by juanv Engager in Splunk Search 03-08-2022 0 2	0	2
	Help creating multiple SUMs within a field based on the value of another field I am using 2 lookup tables to correlate and combine data to create a new .csv. In this process, I have a field that h... by raysonjoberts Path Finder in Splunk Search 03-08-2022 0 4	0	4
	How to correlate fields value from different indexer? Hi, we would to correlate data between 2 idx, but we cant seem to find the right query.ExamplesIndex= FirewallSourcet... by syazwani Path Finder in Splunk Search 03-08-2022 0 6	0	6
	How to cut data in field and display results as a count? Hello I have a field called hostName which contains hosts: host1\user1 host1\user2 host2\user2 host3\user3 And I want... by Yy4pb Explorer in Splunk Search 03-08-2022 0 3	0	3
	How to return field value in double quotes Hi All,In ES or in Splunk in general , How to return field value in double quotes ? We have the below setting for... by neerajs_81 Builder in Splunk Search 03-08-2022 0 1	0	1
	How to alert host stop on failover paired hosts I have host stop event logged in a summary indexIndex=summary search_name=feed_statusHost_nameHost_statusHost1aHost_s... by vl951f Path Finder in Splunk Search 03-08-2022 0 5	0	5
	How to extract some % values of specific parameters? hi, i am a bit lost, i am trying to extract some % values of specific parameters. but with no luck example i want to ... by thaghost99 Path Finder in Splunk Search 03-07-2022 0 2	0	2
	Is it possible to dedup a subset of events? I have a list of different events, including some events where name="exception". These exception events have stack tr... by MatMeredith Path Finder in Splunk Search 03-07-2022 0 3	0	3
	Query with multiple subsearch causing subsearch auto-finalized and truncating due to subsearch limits. Hi Splunk Community, I am pretty new to using Splunk for reporting purposes. Below are my use case : Every month, I a... by shenismyname Engager in Splunk Search 03-07-2022 0 1	0	1
	How search and list the same session ID's occurring in two or more hosts? Hi I have fields created for both sessionId and host. Now I wanna find out the same sessionId happening in two diff... by pavanae Builder in Splunk Search 03-07-2022 0 3	0	3
	How find events where "event.action"="START" AND no corresponding event where "event.action"="FINISH".? Given the example events below. ALL field values match with the exception of the "event.action" field. {"event": ... by hooligeek Observer in Splunk Search 03-07-2022 0 4	0	4
	How to link two events without loosing data? I am trying to link 2 events together due to information in the first event not showing in the second. the informatio... by keanderson Engager in Splunk Search 03-07-2022 0 2	0	2
	How to search for total number of src_ip connections to a dest_ip? trying to list the total number of allowed connections to a destination IP from any/all source IP's currently using t... by Gurv_Bahad Engager in Splunk Search 03-07-2022 0 5	0	5
	Help searching the keyword to select multiple users from my log file to get the report Hi guys, I am using Splunk enterprise for monitoring the application name called Nextcloud. Here I want to customize ... by gow19 New Member in Splunk Search 03-07-2022 0 2	0	2
	Why am I unable to export log entries from dashboard? Hi, I have a dashboard and I need to be able to have an option to export the actual log entries from a dashboard.The ... by POR160893 Builder in Splunk Search 03-07-2022 0 1	0	1
	How to extract time interval between each near two events? hi, I'm finding how to calculate each time difference from near 2 events for example, if my search output is f1 ... by JSIrony Loves-to-Learn Lots in Splunk Search 03-07-2022 0 4	0	4
	How to extract the time from the following two events (taken from the same log) and build a proper sourcetype? Hello, This is my very first post here and I need some advice because I've been trying for a couple of hours to extra... by John85 Explorer in Splunk Search 03-07-2022 0 6	0	6
	How to use subsearches on a different index? I want to search all the email logs for a mail transaction. However we have multiple indexes for our mail logs. Whe... by chicocinco Observer in Splunk Search 03-06-2022 0 3	0	3
	help on link target token helloI open a new drilldown window from my dashboard like this <drilldown> <link target="_blank">search?q=... by jip31 Motivator in Splunk Search 03-06-2022 0 2	0	2
	How to lookup against multiple columns in CSV file? Hello All,how can we search against 2 columns of a CSV lookup file and if the value of the field that i am searching ... by neerajs_81 Builder in Splunk Search 03-06-2022 0 3	0	3
	How to fill a specific value using chosen field? Hey partner In my system, every visit consist of one or more transactions and every has its global serial number, whi... by Jackiifilwhh Path Finder in Splunk Search 03-06-2022 0 4	0	4
	How to display multiple field averages overtime? Good Morning,I am attempting to use visualization that will display the averages of 2 specific fields (bytes_in and b... by SecDesh Path Finder in Splunk Search 03-05-2022 0 2	0	2
	How to dedup in lookup specifying the "_time" field? Well, my question is not that intuitive, but I will deep dive here:Let's suppose I have this lookup:NameProductSell_D... by denissotoacc Path Finder in Splunk Search 03-05-2022 0 3	0	3