Splunk Search

Community Activity

multiple files on the same host Hello, I'd like to create a search for a multiple alerts on the same host. The idea would be to get results for each ... by klaudiac Path Finder in Splunk Search 11-01-2021 0 0	0	0
Stats multiple sourcetypes showing unique field question I'm trying to use a key across three sourcetypes to show unique non-multivalue rows using a stats by clause that has ... by PPrice Explorer in Splunk Search 11-01-2021 0 4	0	4
Extract Splunk Query String in URL Is there a way to extract the Splunk search query from the URL and send it to another software? We want to send the s... by gutoja9 Observer in Splunk Search 11-01-2021 0 0	0	0
Python script to read Splunk data I need to collect Specific Splunk data for business analysis. My target URL is https://splunk.usce.l.az.fisv.cloud/e... by bergen288 Engager in Splunk Search 11-01-2021 0 11	0	11
Query when count is zero in Minute interval Hello, we receive somewhere between 3-5 messages in every Pod in every 1 minute. We have a situation where some of th... by noman377 Explorer in Splunk Search 11-01-2021 0 15	0	15
"if" condition index=IndexName \| table username ip_address_new id_new desti \| lookup file.csv user as username OUTPUT user id_o... by gitingua Communicator in Splunk Search 10-31-2021 0 1	0	1
return events that not match HiI have field that call "servername" that return this:...\| table servernameserver1server2server3need spl that when I... by indeed_2000 Motivator in Splunk Search 10-31-2021 0 6	0	6
metadata doesn't return correct events due to specific date HiI have several file in "myindex", when I set date "yesterday" I expect show just yesterday files , but it return ol... by indeed_2000 Motivator in Splunk Search 10-31-2021 0 0	0	0
Looking for date wise Incidents resolved count by each user i am trying to pull incidents resolved by each user in date wise . can any one help me how to form the below table wi... by Gousa New Member in Splunk Search 10-31-2021 0 1	0	1
Why would I want a replication factor of 2 and a searchable of 1? What would recovery look like? All, Setting up an index cluster of 3 nodes soon and sizing some disks. Feels like you would always want areplication... by dpwtheitguy Loves-to-Learn Lots in Splunk Search 10-30-2021 0 1	0	1
combine three charts into one Hi Dear Splunkers,I have three searches that display the output into a Dashboard in three different panel, but I want... by cbrs New Member in Splunk Search 10-29-2021 0 1	0	1
Automatic lookup query Hi,Just a query, I have some manual lookups in some of my dashboards, if I create an automatic lookup will this break... by joe06031990 Communicator in Splunk Search 10-29-2021 0 2	0	2
Getting a time series Ratio of data from two different sources I have two different data files which are related by a single named field. Lets call that field common_field. From... by echambervisa Observer in Splunk Search 10-29-2021 0 4	0	4
Filtering multi-value (or array) field with multi-value input Hi I tried searching all over but can't seem to find a good approach to do this. Basically, I have a multiselect inpu... by moomber Observer in Splunk Search 10-29-2021 0 0	0	0
export results to csv What's the easiest way to export Splunk search results to a CSV file that I can open in Excel? by Justin_Grant Contributor in Splunk Search 10-29-2021 6 13	6	13
Regex not working on splunk for the expression which works well on regex 101 i have data as below : Request-all-Headers = Accept - / Authorization - Bearer m6CsheaxrlMKIBH3vZ0EXk5G3rw6 Conten... by Shariq Explorer in Splunk Search 10-29-2021 0 7	0	7
How to include the previous and/or following event after the search string appears? Hi, I would like to include the event just before or just after the search string appears. Basically like grep -A 1 o... by echalex Builder in Splunk Search 10-29-2021 0 6	0	6
Is there a way to zoom at highest count in timechart automatically after it has been loaded? Hi! I have a panel in dashboard that uses timechart. I want to make it zoom at highest count or count>0 automatically... by GustavMahler Explorer in Splunk Search 10-29-2021 0 0	0	0
Windows Events - Why does SRC_IP for an Active Directory Server appears different in different events? Folks, Need some assistance to understand why Splunk is reporting different IP's for the same hostname ( Active Dir ... by neerajs_81 Builder in Splunk Search 10-29-2021 0 3	0	3
Field extraction from a Windows log Hi Splunkers, I have prepared a regex extraction using regex101 site, and now trying to extract "Failure Reason" as p... by vagnet Explorer in Splunk Search 10-29-2021 0 5	0	5
How do you use timewarp in specific? Let's say I have this query index = x \|stats count as Total, sum(AMMOUNT) as TAmmount BY MERCHANT, SUBMERCHANT I wan... by phamxuantung Communicator in Splunk Search 10-29-2021 0 2	0	2
Extract count of each value of a field and create a timechart from it using stats I have a field "skill" which takes multiple values:I want to extract the count of each of the values of skill and sto... by priyangshupal Engager in Splunk Search 10-29-2021 0 4	0	4
Insert Timerange picker value in query Hi, I want to insert Timerange picker value like $time$ in my query for a Dynamic input. Requesting help with the que... by noman377 Explorer in Splunk Search 10-29-2021 0 2	0	2
SPL: Use regex replacement string multiple times Hello *,I am looking for an SPL that reads the first part of a string via regex and replaces all occurrences of a cer... by _Tom Explorer in Splunk Search 10-29-2021 0 3	0	3
Match IP address with IP in Lookup table and alert Hello, We are using ES and we have a lookup file downloaded which has a mix of standalone ip's and CIDRs/Subnets/. ... by neerajs_81 Builder in Splunk Search 10-29-2021 0 5	0	5