Splunk Search

Community Activity

Why am I getting "Error in 'summarize' command: This search does not support summarization" trying to use KV store lookup with Datamodel Acceleration? Hi. I'd like to use KV Store lookup in an accelerated Data Model. When I set data model this messages occurs: 01-10... by pedromvieira Communicator in Splunk Search 05-11-2021 2 5	2	5
How to get duration for the product A (only for start and end status)? So what I have now from my search so farProduct Status TimeA Start 8.00 AMA ... by moinyuso96 Path Finder in Splunk Search 05-11-2021 0 2	0	2
regex help Hi,I need some help with the regex,Currently we have below two paths, note the naming format is different for the log... by SS1 Path Finder in Splunk Search 05-10-2021 0 4	0	4
Eval Expression in Data Model Hi,I'm trying to create an eval expression in my data model which is based on _time. Can you please advise on what I'... by ebs Communicator in Splunk Search 05-10-2021 0 3	0	3
How to check a table for multiple mac addresses with the same IP Currently my splunk search to get a list of macs of the security cameras with their respective IP is index = dhcp 00:... by jhick Observer in Splunk Search 05-10-2021 0 1	0	1
How to count how many time a key word appear in one event log and list it's detail Hello I have some event logs that show batch purchase like this: Event 1: <BankID>Bank A</BankID> <value>5</value> <s... by phamxuantung Communicator in Splunk Search 05-10-2021 0 1	0	1
Regex: Error using where/match and backslash character The following example \| makeresults \| eval FilePath="\\Temp.exe" \| where match(FilePath, "(?i)\\Temp\.exe$") Creates ... by abowesman Explorer in Splunk Search 05-10-2021 0 0	0	0
Field extraction regex breaks due to date change and space The date field sometimes has 2 spaces and sometimes 1 space, depending on whether the date is a single digit or doubl... by ershad_c Engager in Splunk Search 05-10-2021 0 2	0	2
How to split/extract substring before the first - from the right side of the string SpoilerHow to split/extract substring before the first - from the right side of the field on splunk searchHow to spli... by keshavgupta Engager in Splunk Search 05-10-2021 0 1	0	1
how to use horseshoe meter with stats how to use horseshoe meter for below queryindex = * \| table podname cluster status \| dedup podname cluster status \|... by kirrusk Communicator in Splunk Search 05-10-2021 0 1	0	1
Subsearch Hi,I've been trying for hours and nothing works, so I figure you might help me out.I have the following very long que... by yifatcy Path Finder in Splunk Search 05-10-2021 0 2	0	2
How to use metadata/header for all the following events Dear all,I'm trying to retrieve some log metadata and associate them to all my events.Exemple: When my application st... by Flobzh Explorer in Splunk Search 05-10-2021 0 1	0	1
account was created and deleted Hi,My query:index=ph_windows_sec sourcetype=XmlWinEventLog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR Event... by or1515 Loves-to-Learn Everything in Splunk Search 05-10-2021 0 2	0	2
Split trellis over two variables Hi,Can I separate Trellis visualization by two variables as keys? In other words, I would like a timechart for each c... by yifatcy Path Finder in Splunk Search 05-10-2021 0 0	0	0
Splunk searching Syntax Resolved by keyu921 Explorer in Splunk Search 05-10-2021 0 1	0	1
How to concatenate strings with unicode character? I want to concatenate strings with special characters like "\t" and Unicode char "\u0006"I tried \| makeresults \| ev... by junlozhang Explorer in Splunk Search 05-09-2021 0 2	0	2
How to split up a string into multiple fields? I have a field that consists of data separated from a json data field using this search.index="test-99" sourcetype="... by robayers Explorer in Splunk Search 05-09-2021 0 8	0	8
Group events into a single event I am relatively new to this wonderful tool called SPLUNK. Please excuse me if this question has already been answered... by schou87 Path Finder in Splunk Search 05-09-2021 0 4	0	4
I want to insert a value into a subsearch using the search result as a variable. Dear ALL,I want to insert a value into a subsearch using the search result as a variable.Do the following search to g... by Msugiyama Path Finder in Splunk Search 05-09-2021 0 2	0	2
superimposed timeline chart comparing the latest and last week data For the below query, searching for the values of 2nd occurence of earliest and latest events so that the timechart wo... by prajwal_94 Explorer in Splunk Search 05-09-2021 0 2	0	2
Build filter from inputlookup I would kindly need some help for a query i am not able to create.I have inputlookups as source.And i want to filter... by hvdtol Path Finder in Splunk Search 05-09-2021 0 4	0	4
Getting Amount of X Events After Last Y Event Right now I have something like this: index=my_index sourcetype=my_sourcetype \| rex field=message "- (?<User>\S+) -:"... by PaintItParker Explorer in Splunk Search 05-08-2021 0 3	0	3
Makeresult with hosts and date range I am aiming to provide headers to my generated report. I have 3 hosts, host1 host2 and host3. My report is configured... by cboonyan New Member in Splunk Search 05-08-2021 0 1	0	1
How to get the difference (In whole days) between two fields within the same event Hi Guys, Wondering if you can help me out with the following. Within a single event I have to fields: 1) expiry_date2... by Matthew Engager in Splunk Search 05-08-2021 0 2	0	2
2 host with the same names Hi,I have 2 servers with the same names and I have installed universal forwarder on both servers. In forwarder manage... by sh_tavousi Explorer in Splunk Search 05-08-2021 0 3	0	3

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

Why am I getting "Error in 'summarize' command: This search does not support summarization" trying to use KV store lookup with Datamodel Acceleration?

How to get duration for the product A (only for start and end status)?

regex help

Eval Expression in Data Model

How to check a table for multiple mac addresses with the same IP

How to count how many time a key word appear in one event log and list it's detail

Regex: Error using where/match and backslash character

Field extraction regex breaks due to date change and space

How to split/extract substring before the first - from the right side of the string

how to use horseshoe meter with stats

Subsearch

How to use metadata/header for all the following events

account was created and deleted

Split trellis over two variables

Splunk searching Syntax

How to concatenate strings with unicode character?

How to split up a string into multiple fields?

Group events into a single event

I want to insert a value into a subsearch using the search result as a variable.

superimposed timeline chart comparing the latest and last week data

Build filter from inputlookup

Getting Amount of X Events After Last Y Event

Makeresult with hosts and date range

How to get the difference (In whole days) between two fields within the same event

2 host with the same names

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation