Splunk Search

Community Activity

Why is `trigger_time` different for every _audit search query? I am running following search query to obtain history of triggered alerts (time, name, severity), manually: index=_au... by LegalPrime Path Finder in Splunk Search 06-28-2021 0 0	0	0
How do I split a SQL statement's query fields and relate each field with the app name? I have a search result like below:{ [-] dt: 2021-06-24T22:46:40.7013297Z flds: [ [-] { [-] fn: username... by rilee Explorer in Splunk Search 06-28-2021 0 4	0	4
How to display two timecharts on one chart trying to display two timecharts together, to make it easy to spot the time when no response received for the request... by jerrysplunk88 Explorer in Splunk Search 06-27-2021 0 3	0	3
How to show timechart and timewrap of business hours I am trying to compare count of events with previous days within business hours, here is my query index=abc \| search... by dyapasrikanth Path Finder in Splunk Search 06-27-2021 0 5	0	5
how to extract the required data from the _raw field in splunk.. This is my _raw data consists06/24/2021 17:26:17 +0530, info_search_time=1624535777.471, Dns Rule=Passed, HOSTNAME=Pa... by vinod743374 Communicator in Splunk Search 06-27-2021 0 8	0	8
Plot error % as timeseries How to plot http error % as timeseries? (when I add _time or timeseries count Iam getting DAG: Execution exception (s... by sudhakar_mnsr New Member in Splunk Search 06-27-2021 0 4	0	4
Timechart by field in tabular format There are 100s of APIs in my application. I'm logging exception for an API. I can get stats to get total no of excep... by pankajad Explorer in Splunk Search 06-27-2021 0 3	0	3
finding field b partial matches in field a (inputlookup csv) I am trying to find matches for field b, when there is a partial match in field a. I have field a which is an importe... by tchankapi Engager in Splunk Search 06-26-2021 0 1	0	1
replace function for eval token problem Hi Splunkers, I was stuck with cutting the part of string for drilldown value from a chart using the <eval token>. S... by evelenke Contributor in Splunk Search 06-26-2021 0 3	0	3
inserting newline, tab into eval-ed field Running\| makeresults \| eval s="foo\nbar" displaysfoo\nbarand it is unclear if the variable has a newline or just cont... by gliptak Explorer in Splunk Search 06-26-2021 0 4	0	4
SNMP bandwidth using foreach Hello everyone,I am new to Splunk and learning the ropes. I am stuck on a query I am trying setup. I have SNMP data c... by IcyPenguin Loves-to-Learn Lots in Splunk Search 06-25-2021 0 0	0	0
How to join multiple events based on one common value with different filters? Hi,I've written a query query below which joins 2 different event types from same source with different filters.sourc... by Sentira Explorer in Splunk Search 06-25-2021 0 8	0	8
Can I Show Data Values on a Specific Field? Hi,I have a column chart with multiple overlaying fields (see blue orange and yellow lines below). Right now i am dis... by yvassilyeva Path Finder in Splunk Search 06-25-2021 0 0	0	0
splunk props timestamp issue I have a CSV file with the below data, trying to push to Splunk.Example - Thu JUN 24 15:27:52 +08 2021,name1,address... by kirrusk Communicator in Splunk Search 06-25-2021 0 1	0	1
How to check for the same values in a field and replace another field with specific text So currently i have:\|Name \| Branch \| Age-------------------------------------... by FyazIkram834 Engager in Splunk Search 06-25-2021 0 6	0	6
Monitoring Searching of Sensitive Data Is there a way to monitor the searches for some specific fields?Let's say I wish to monitor if anyone is running any ... by pagnihot Path Finder in Splunk Search 06-25-2021 0 2	0	2
How to join 2 searches from 2 different sourcetypes I am encountering problems joining 2 querries that are getting values from 2 different sourcetypes.I would like to ge... by ookamidono Explorer in Splunk Search 06-25-2021 0 3	0	3
How to Grab Variance Hello,I am ingesting files containing host and ports for each host.For each Source (FILE) The Nodes(host) and ports ... by a_n Path Finder in Splunk Search 06-25-2021 0 2	0	2
I want to get error logs counts from windows event logs from multiple servers. I want to get error logs counts from windows event logs from multiple servers.Want to create a separate dashboard whe... by bhavinsatwani65 New Member in Splunk Search 06-25-2021 0 5	0	5
How can I split an event into a varible number of events? Hello,I have a directory structure which i want split up in separate events.For example\MAIN\SUB1\SUB2\SUB3\file.xlsx... by hvdtol Path Finder in Splunk Search 06-25-2021 0 4	0	4
Query to find top 10 indexers w.r.t index max allocated storage. Kindly help me out with Query to find top 10 indexers w.r.t index max allocated storage. by Tejesh Observer in Splunk Search 06-25-2021 0 0	0	0
It is truncated subsearch. tstats command. Hi.I have one problem. It is truncated subsearch result. index="test-index01" sourcetype="test_sourcetype" user="*"... by nasha430 Explorer in Splunk Search 06-25-2021 0 1	0	1
How to extract and aggregate by extracted fields Hi I have the data that looks like thisuser, ip, (metrics kv pairs)---- sample results for search -- user=user1,ip=10... by ashriram Engager in Splunk Search 06-25-2021 0 4	0	4
How to get searches to run in Smart or Verbose mode when selecting "Open In Search" from a dashboard panel? All my dashboards panels, written in Simple XML, default to Search Mode "Fast" when the "Open In Search" icon is sele... by franks59 Explorer in Splunk Search 06-24-2021 1 4	1	4
props file not recognizing time field Hi All,I have a CSV file with the below data, trying to push to splunk. Example - Thu JUN 24 15:27:52 +08 2021,name1... by kirrusk Communicator in Splunk Search 06-24-2021 0 2	0	2