Splunk Search

Community Activity

Can I save mvexpand when matching a multivalue lookup? I have a lookup that can return multivalue for two fields, one of them a timestamp, like thiskeytextdatekey1abc\|def20... by yuanliu SplunkTrust in Splunk Search 06-20-2021 0 10	0	10
forward not detect changes HiI install forwarder on a server.it work perfectly and forward anything on this path /data/app/log to splunk server,... by indeed_2000 Motivator in Splunk Search 06-20-2021 0 2	0	2
sum multiple fields based on the field only Hello Splunkers in my firewall logs, i have three numerical fields, (out_packet, in_packet, bytes) i want to sum thes... by moayadalghamdi Path Finder in Splunk Search 06-20-2021 0 6	0	6
Geostats and rangemap Hi Newbie here, Im exploring right now the map on splunk 6, Now my question is,is it possible to add a rangemap in g... by xisura Communicator in Splunk Search 06-19-2021 0 9	0	9
Result that does not match an item in list With a search I would like a result that does NOT match an element in a listFor instance: index=myindex source="my... by vschrodda Explorer in Splunk Search 06-18-2021 0 5	0	5
Single line of regex to extract multiple fields I've seen the TA Unified2 do this, one single line of regex pulling all relevant fields from snort logs. I'm wanting... by token1 Explorer in Splunk Search 06-18-2021 0 1	0	1
Search for all apps and dashboards on a server How do I search for all apps and dashboards on a server and yield a table with author, app name, description, actual ... by actionabledata Path Finder in Splunk Search 06-18-2021 0 2	0	2
Unable to Seam Together Tstats and "!=" Operator Hello Hello,Trying to make this search work:\| tstats allow_old_summaries=true dc(Malware_Attacks.signature) as "infec... by LionelHutz Engager in Splunk Search 06-18-2021 0 1	0	1
How to find duration of repeating events Hi all,I am trying to get the duration of the starting found error based on the affected users and the last fail/succ... by Traer001 Path Finder in Splunk Search 06-18-2021 0 2	0	2
How to combine events with counting? Hi folks,Just a quick question. For example, a have a dataset_timefield_xfield_y14:010014:020114:030214:041314:051014... by rendie Path Finder in Splunk Search 06-18-2021 0 4	0	4
last dataset from all events Hello im newbie with Splunk searchCan you please help meI have HF request which return:-AAA datetime_of_change-BBB d... by alexeysharkov Path Finder in Splunk Search 06-18-2021 0 9	0	9
[SmartStore] How to map report acceleration report with the corresponding buckets? After Smartstore was enabled for deployment the indexer's log's are flooded with messages like"INFO CacheManagerHandl... by rbal_splunk Splunk Employee in Splunk Search 06-18-2021 0 2	0	2
Is it possible to limit the transaction? After using transactions my "raw" field looks something like this. I want to limit the amount of rows captured by tr... by moinyuso96 Path Finder in Splunk Search 06-17-2021 0 1	0	1
SEDCMD to remove text I'm trying to use SEDCMD to remove some text from a logfile. example data below, data to be removed in bold. Tried so... by kashnburn Engager in Splunk Search 06-17-2021 0 1	0	1
cidrmatch between 2 csv files Hi,I have two csv files where I am trying to cidrmatch between ip and subnet - but it doesn't appear to be workingtes... by munisb Explorer in Splunk Search 06-17-2021 0 4	0	4
Search certain ratio of minimum data the Scenario like this: I want to pick up 5% minimum value from thousands of data, Example:1,2,3 ,4 5,6,7,8,9,10 I... by KongJian Engager in Splunk Search 06-17-2021 0 3	0	3
alert when json data changes is there a way to alert when json data changes? i want to track changes for a variety of apis results/output that sho... by gdavid Path Finder in Splunk Search 06-17-2021 0 1	0	1
how to sort() version values. Hello,I am having values of a particular application as below.Looking to get the maximum version value or sorting the... by karthik_y Engager in Splunk Search 06-17-2021 1 4	1	4
how to make a search for two or more source file with wildcard or regex? What search criteria should I include to only get these logs?D:\Applications\Windows.App.0001\app1\logs\log-06-17-202... by iamuser Engager in Splunk Search 06-17-2021 0 2	0	2
Average alarms per reader over time A bit ago I submitted a question regarding how to get the average alarms per reader. So for example we have 100 alarm... by msage Path Finder in Splunk Search 06-17-2021 0 2	0	2
How to keep results with a count of 0 Hello,I have a search that is joining two searches (one for cart details and one for items that have been brought to ... by Traer001 Path Finder in Splunk Search 06-17-2021 0 2	0	2
result of two searches in one variable Hi,I would like to have a dashboard panel with just a number, which should be the substraction of two values obtained... by Bettynet Engager in Splunk Search 06-17-2021 0 5	0	5
Logfile with multiple newlines splunk only grabs the first line I'm fairly new to splunk so please bare with me. I have a logfile that has multiple lines of data. However when I do ... by kashnburn Engager in Splunk Search 06-17-2021 0 2	0	2
Update Time Field for a User on Table Hi,I am making a report that needs to identify how long long since a user launch an application. Can I use splunk to ... by aquinojason Path Finder in Splunk Search 06-17-2021 0 2	0	2
Subtotal percentage with stats I'm working with Windows events, and want to make following report/search:process1 ... by dauren_akilbeko Communicator in Splunk Search 06-17-2021 0 3	0	3