Splunk Search

Ask a Question

Discussions

Thread Info

Pass field into a subsearch from stats command

Hi, i have data namebinarykeynumberSteve110012345Steve10013246Steve 12347Charles 23456 I am trying to c...

by Communicator in

Multiple Stats Multiple Indexes

I have 3 data sets that I need to combine with 1 data set not having a field to perform a compare. I initially start...

by Contributor in

Any idea why eval doesn't assign value

Query example: index=eks sourcetype="kube:container" message=log | fields data.user_agent | rex fie...

by Engager in

how to convert date field to days

i have a date field like this 2021-01-29 00:25:58.913024+00 i want to convert this just date as days field using now(...

by Explorer in

Is there a way to pass results of a subsearch to be used in the display and criteria of a parent search?

I've Googled it, but can't find a SOLUTION. I've got a search that pulls Validators remaining per Subject. I wan...

by Engager in

How to compare multivalue field with previous and next event value of _time field ?

Each multi-value field (FiledName: R_time ) which has time value in epoch format should be compared to it previous ev...

by Path Finder in

ldapsearch through map command is blanking out the rest of my table except for it's own output

1st search works (I get all fields in my table including GUID): earliest=-1y index=azuread sourcetype="ms:a...

by Path Finder in

Using Multiple Text Box Input For Searching

I have a dashboard built that views today's events for processes running on systems. To focus on a single event, I h...

by Path Finder in

When no events logged on the 1st of the month add log from the last day they were received

The following search gives me a table that contains the number of lines of code on the first of each month and calcul...

by Explorer in

How to see number of hits on a specific destination IP

Hi All, How can I see number of hits on a specific destination IP by using the search and reporting tab ? ...

by New Member in

I want to freeze (or to block) a row in a Splunk Table

Hi all, I am struggling with an issue about Splunk Developing. Our target is to freeze a row. Every time that anyon...

by New Member in

Require help to create query for table

Hi All, I have the below types of logs in in two different hosts in my index: HOST= abc log1: Tue Feb 2 19:07:2...

by Contributor in

Help with join - Periodically it fails to join a small percentage of records

I have a query to find missing forwarders. It is based on code I received here and it is so very close to working. ...

by Path Finder in

rest jobs runDuration inaccurate values

Hi All... As i am trying to find out the the long running search queries using this rest search, its working fine, bu...

by SplunkTrust in

Find Multiple Users With The Same Unknown Email Subject

Scenario: I have 10 machines infected with malware. The believed infection source is email, I am attempting to create...

by Engager in

excluding a search result

Hello Splunkers ! i have a problem here, that we're running an infra structure change and for that im getting d...

by Path Finder in

Need help to with query to create a table

Hi, I have the below types of logs in in two different hosts in my index: HOST= abc log1: Tue Feb 2 19:07:26 ES...

by Contributor in

Help with improving Regex

Here is the regex to extract message_type based on CIM. Could anyone make this faster than 1387 steps? https://reg...

by Contributor in

I need help on Splunk query

I need help on the query:

by Engager in

How to get time-based lookups working with KV Store?

Have time-based lookups working well with CSV file. When I try to get it working with KV Store, I CANNOT get it to wo...

by Contributor in

Trying to replace "join" with "stats" but issue with multivalue field to "join" on.

Hi, I have simplified my query as much as possible. Basically I am looking at two issues with this: 1: I cannot per...

by Explorer in

Why am I getting "500 Internal Server Error" when I go to Settings > Lookups > Lookup Definitions?

I was attempting to add a lookup definition in a custom app, but, after visiting the page successfully a few times, n...

by Communicator in

Extract value from first index and search in second index

Hi, I'm new to splunk so pardon if its a straightforward query I want to extract userIds from my first index and ch...

by Engager in

Calculating difference between two strftime fields

Hello Splunkers:I'm looking to determine how many days file is out of date.I have two strftime fields and values:x = ...

by Communicator in

Incomplete search results because of lookup definition's maximum match limit in Splunk

Re-initiation of an older question I had asked: Hi, I have a need for an alternative of | lookup abc field1 A...

by Builder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Pass field into a subsearch from stats command

Multiple Stats Multiple Indexes

Any idea why eval doesn't assign value

how to convert date field to days

Is there a way to pass results of a subsearch to be used in the display and criteria of a parent search?

How to compare multivalue field with previous and next event value of _time field ?

ldapsearch through map command is blanking out the rest of my table except for it's own output

Using Multiple Text Box Input For Searching

When no events logged on the 1st of the month add log from the last day they were received

How to see number of hits on a specific destination IP

I want to freeze (or to block) a row in a Splunk Table

Require help to create query for table

Help with join - Periodically it fails to join a small percentage of records

rest jobs runDuration inaccurate values

Find Multiple Users With The Same Unknown Email Subject

excluding a search result

Need help to with query to create a table

Help with improving Regex

I need help on Splunk query

How to get time-based lookups working with KV Store?

Trying to replace "join" with "stats" but issue with multivalue field to "join" on.

Why am I getting "500 Internal Server Error" when I go to Settings > Lookups > Lookup Definitions?

Extract value from first index and search in second index

Calculating difference between two strftime fields

Incomplete search results because of lookup definition's maximum match limit in Splunk

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

Improve Data Pipelines Using Splunk Data Management

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Issue with StateSpaceForecast from the MLTK app

Notepad++ SPL syntax highlighting

How to splunk api to get statistics in python

Some cloudwatch log collection errors

Is it possible to export entire dashboard panel co...