Splunk Search

Community Activity

Help Improve my search? All, I have this search here and it's pretty slow. Any recommendations to speed it up? Currently 250.249 seconds and ... by dpwtheitguy Loves-to-Learn Lots in Splunk Search 01-28-2021 0 2	0	2
Splunk Join Optimisation Hi,I have the below query which does the search on two different sources in the same index and join the results based... by deepuhassan Explorer in Splunk Search 01-28-2021 0 6	0	6
Event Field Data Lost When Using Collect to Populate Summary Index I'm having a bit of trouble trying to backfill a couple days in my summary index from a query using the collect comma... by EStallcup Path Finder in Splunk Search 01-28-2021 2 14	2	14
How to populate results from regex into an ldap search? How would I take the results from this search:\| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"And p... by fdevera Path Finder in Splunk Search 01-28-2021 0 3	0	3
Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. I'm trying to look for senders where they don't contain values from the lookup mimics.csv. Examples of values in the ... by TheBravoSierra Path Finder in Splunk Search 01-28-2021 0 3	0	3
ISE unique MAC reporting Been testing to get a ISE-Splunk successful authentication report and trying this but the "Calling-Station-ID" is not... by redrobish1 Engager in Splunk Search 01-28-2021 0 2	0	2
brake out individual row by host repeated for each line Here is what I've done. How to break out the results into individual software correctly in Splunk. Any tips could b... by youngsuh Contributor in Splunk Search 01-28-2021 0 3	0	3
Splunk Query to find removed hosts Hi All,Please help me with splunk query to find removed (Off-boarded) hosts & index in splunk by alexspunkshell Contributor in Splunk Search 01-28-2021 0 3	0	3
Field failing to extract (ServiceNow) Hi,I have used the Service Now add on to pull in the incident table. We have a custom SNow field called "dv_u_configu... by shazbot79 Path Finder in Splunk Search 01-28-2021 0 2	0	2
multiple values in pie chart i am trying to figure out what the output values are not showing up in my pie chart. i would eventually like to grap... by gcue Loves-to-Learn in Splunk Search 01-28-2021 0 2	0	2
Question on setting up the alerts I have a search query that outputs the count of the event for all the host (i.e., \| stats count by host)Now if the co... by prettysunshinez Explorer in Splunk Search 01-28-2021 0 4	0	4
What is this issue with the monitor stanza in inputs.conf? I am having an issue with one of my monitor stanza in inputs.conf. The stanza is as below: [monitor://E:Speech\Tomca... by Abha11 Explorer in Splunk Search 01-28-2021 0 3	0	3
ip location and microsoft/google Hello Everyone, We are currently working on exchange logs (IIS), and trying to detect abnormal traffic from different... by sweiland Path Finder in Splunk Search 01-28-2021 0 10	0	10
Two conditions for Lookup Hi,iam stuck with a problem where i need help from you guys. I have a search that runs IDs against a lookup to determ... by DanielAmlung Path Finder in Splunk Search 01-28-2021 0 3	0	3
Compare data between multi column tables and find difference Hi,I have a query that gives a table of records satisfying certain condition. Have another query that gives the same ... by renSplunk New Member in Splunk Search 01-28-2021 0 3	0	3
Search by time, then visualize in Hello Splunkers ! i want to write a command that shows a timeline of authentication activities as following:index=MyI... by moayadalghamdi Path Finder in Splunk Search 01-27-2021 0 2	0	2
Search Time Masking Using Calculated Field Hi Splunkers,Good day. I am trying to perform search time masking using a Calculated Field to replace _raw with the r... by arielpconsolaci Path Finder in Splunk Search 01-27-2021 0 6	0	6
Time Difference and Average I am trying to get the average of a time difference by using \| stats avg(time_dur) by type and since I am using this ... by geekf Path Finder in Splunk Search 01-27-2021 0 12	0	12
How to get Start and End time from failed condition Hi Splunk,We have data like this: ( how to get the result like on the table StartError EndError and SumCall ?) I have... by bernanda Explorer in Splunk Search 01-27-2021 0 4	0	4
Bitbucket and Splunk integration I want to view bitbucket files changed , owners who changed bitbucket files in Splunk. Can someone please share the s... by VS0909 Communicator in Splunk Search 01-27-2021 0 0	0	0
Comparing sum results between several days I am trying to average the sum of power consumption readings between 2 days and compare that sum to a 3rd day. If the... by KaitoKozo Explorer in Splunk Search 01-27-2021 0 2	0	2
How to regex specific word string? Hello,Ignoring commas and spaces, how do I grab just the name string from the below log? Below regex kept returning t... by limalbert Path Finder in Splunk Search 01-27-2021 0 4	0	4
Can I change _time based on time within data that is ingested Hi , I have a report that is ingested in splunk. Due to the report format not correctly ingested by splunk, I had don... by janesh22 Explorer in Splunk Search 01-27-2021 0 4	0	4
Extracting field with spath from JSON sourcetype overwrites field in other None-JSON sourcetype Hi,looked through documentation and Splunk answers but did not find reason/root cause for the following obervation:We... by flle Path Finder in Splunk Search 01-27-2021 0 1	0	1
Splunk alert for peak errors only Hi, I am working on a query to write an alert where i need to monitor few pages for 500 Errors. Now currently there ... by shashank_24 Path Finder in Splunk Search 01-27-2021 0 1	0	1