Splunk Search

Community Activity

Find out index of hosts sending new since 24hrs HiI wanted to write a search that show all hosts that sends new since 24hrs into Splunk. The problem now is that I wa... by lslschr21 Loves-to-Learn Lots in Splunk Search 05-27-2021 0 0	0	0
Search using two indexes Hola Splunkers !! i want to search in two indexes with one common values in between, for exapmle: index=Exchange_serv... by moayadalghamdi Path Finder in Splunk Search 05-27-2021 0 1	0	1
Is there a way to deduplicate event in summary index I created a report for finding list intersection of two setA: inputlookup spam_ip (Indicator of compromise)B: index=m... by Daniel_Pham Explorer in Splunk Search 05-27-2021 0 2	0	2
How to print latest value and average value of a column Hi, I have a list of values as shown below SG_0-1622095994335.pngfrom the above picture data I wanted to pick the ave... by SG Path Finder in Splunk Search 05-26-2021 0 2	0	2
Calculate performance metrics for different categories in a single search Hi,Bit out of my depth here but I have done an eval so we divide the events in the index by the URLs and I have 4 cat... by ebs Communicator in Splunk Search 05-26-2021 0 0	0	0
How to filter a field by common words I have a field of titles that are filled with sentences about why a test was failed in a security audit, but they are... by parkz Explorer in Splunk Search 05-26-2021 0 1	0	1
regex vs where match() I've never used \|regex, but use \|where match() quite often. Is the former just syntax sugar or is there any differen... by yuanliu SplunkTrust in Splunk Search 05-26-2021 0 4	0	4
SPL to find all UF clients that picked up specific deployment app? Hi,I know there are other ways to get this through the deployment server, but I'm trying to find a SPL to get results... by dkr3500 Path Finder in Splunk Search 05-26-2021 0 1	0	1
Design a search for find list intersection of kvstore and inndex and put them to summary index I'm new to Splunk And I'm trying to build summary index i have KVStore and indexA: inputlookup spam_ip (which is Indi... by Daniel_Pham Explorer in Splunk Search 05-26-2021 0 7	0	7
Alltime-Realtime Able to See Data - Zero Data for Historical Searches Strangest thing. I have some Infoblox logs coming in from a Syslog-NG server where we have a UF installed. UF is succ... by bitofrumncoke New Member in Splunk Search 05-26-2021 0 2	0	2
Regex to extract whole line from raw data Hello,I am trying to extract the full line from the raw data log matching a pattern in the line. Sample data:blah bl... by nm8181 Engager in Splunk Search 05-26-2021 0 2	0	2
Splunk query - multiple values from a field Hi everyone. I'm trying to get this query going with one search but I can't seem to do that. I can only get it to wo... by verifi81 Path Finder in Splunk Search 05-26-2021 0 10	0	10
Combine some results together into a single field label HelloI have a query that examins events can outputs how many of each level of event there areindex=* eval level=lower... by sbrewerton Engager in Splunk Search 05-26-2021 0 1	0	1
How to compare last column with previously violated column under foreach? HiI have a query which results me data in the below format,Screenshot 2021-05-26 at 6.52.22 PM.pngI am trying to put ... by sangs8788 Communicator in Splunk Search 05-26-2021 0 0	0	0
How to See New Index Log Hi,In our organization, some teams would like to see the new index logs. To explain, they want to see who created a n... by onur Explorer in Splunk Search 05-26-2021 0 1	0	1
How to remove rows with Zero value? Hi guys, I am making a dashboard with Error Duration per RobotId. Since the duration is in seconds, I rounded it to ... by auaave Communicator in Splunk Search 05-26-2021 0 10	0	10
Calculate time delta Hi Guys, I'd like to calculate the time delta. Here is the sample:_time _raw 2021-... by JiachengWei Engager in Splunk Search 05-26-2021 0 5	0	5
Export csv data to specific folder Hi everyone, below is my sample query index=xyz source=ABC \| stats count If I schedule this search then result have t... by Learner Path Finder in Splunk Search 05-26-2021 0 1	0	1
How to get data by _time Hi everyone,index=xyz source="something" \|stats earliest(_time) as minTime latest(_time) as maxTime values(activityNa... by Learner Path Finder in Splunk Search 05-26-2021 0 4	0	4
How to compare larger data in same index with different field Scenarioexample Index:Index=os, Ingesteddata _time, type, id08:00,A,108:10,A,208:11,A,308:12,A,408:13,A,509:00,B,109:... by KongJian Engager in Splunk Search 05-26-2021 0 3	0	3
Limiting Results in Splunk REST API So I am trying to run a splunk search using Splunk REST API which finds a list of triggered alerts. \| rest /services... by sashaank Observer in Splunk Search 05-26-2021 0 0	0	0
How to change a span of 1 week time to start from Monday to friday How to change a span of 1 week time to start from Monday to friday usually span=1w it will show data from monday 00:0... by syedabuthahir Explorer in Splunk Search 05-25-2021 0 4	0	4
Restricted search question I am trying to set up a restricted search for a role so that they can only see data when a field1=customer01. The def... by klim Path Finder in Splunk Search 05-25-2021 0 3	0	3
Macro Argument not applying Hi.I've created the following macro: sessionCount(1)With this definition:datamodel Test summariesonly=true search \| s... by ebs Communicator in Splunk Search 05-25-2021 0 4	0	4
DistributedPeer Connect Timeout error message WARN DistributedPeer - Peer:https:/:8089 Unable to get server info from https://:8089/services/server/info due to: Co... by kedjjang Path Finder in Splunk Search 05-25-2021 1 2	1	2