Splunk Search

Community Activity

List fields after rare command Hi,Iam using below splunk to help identify least common values of runTime field in myEventRecType file . i get the re... by bmer Explorer in Splunk Search 12-22-2025 0 4	0	4
Long field names Good day, I often run up against the issue of wanting to drag the text of a field name from the browser into a separa... by andrewpense825 Explorer in Splunk Search 12-18-2025 1 4	1	4
Create a moving baseline week over week for firewall traffic Hi Team,I have been trying to work on a query I found on a blog that was trying to calculate and tag a week over week... by JohnEGones Communicator in Splunk Search 12-17-2025 0 4	0	4
Does retention policy depend on indextime or _time? how can we get the oldest index time of an index ? Does retention policy depend on indextime or _time ? by nawazns5038 Builder in Splunk Search 12-17-2025 1 20	1	20
REST query via console vs API showing different results Executive overview: We're using Splunk Cloud (Victoria Experience), and we're in the process of spinning up a new ins... by bpenny Explorer in Splunk Search 12-15-2025 0 1	0	1
json_extend Scalar Bug, or Coercing JSON Scalars into JSON Arrays Hi Splunkers!In the current json_extend documentation <https://help.splunk.com/en/splunk-enterprise/spl-search-refere... by tscroggins SplunkTrust in Splunk Search 12-14-2025 0 5	0	5
Why Long running searches, with time spent in ReducePhaseExecutor and PreviewExecutor Hi guys I have an installation on Splunk 8.1.2 where we have XmlWinEventLog data ingested. When we run this search:... by agneticdk Path Finder in Splunk Search 12-12-2025 1 4	1	4
How to build searches based on Incident Review Hello!SOC analyst here. I am looking to build a dashboard that gives data and statistics when an alert in Incident re... by ajmach343 Explorer in Splunk Search 12-12-2025 0 2	0	2
Track User Login/Logout exclude first 2 hours of the day (midnight-2am) index=endpoint_ms_winevents sourcetype=XmlWinEventLog user=TESTER EventID=4624 OR EventID=4634\| stats earliest_time(_... by wingfieldj Explorer in Splunk Search 12-12-2025 0 6	0	6
Looking for feedback on SPL design using map command (concerns about performance and safety) Hi Splunk Community,I have created the following SPL for scheduled alerts. Some parts are masked for confidentiality,... by Kimiko New Member in Splunk Search 12-10-2025 0 4	0	4
Streamstats with rex and multiple "by" fields I am attempting to rex out some fields from a source log and then if FIELD1 changes in a 24 hour period when the othe... by RobK700000 Engager in Splunk Search 12-10-2025 0 1	0	1
List of existing indexes Is it possible to get list of all indexes with creation time and who created the index? by Sailesh6891 Engager in Splunk Search 12-09-2025 0 3	0	3
Classify IPv4 and IPv6 addresses as Internal vs External How can I reliably classify IPv4 and IPv6 addresses as internal vs external? Requirements:Handle both IPv4 and IPv6V... by msquicc Path Finder in Splunk Search 12-09-2025 0 1	0	1
Splunk tstats search with IPV6 subnet - WHERE clause is not an exact query Hello,I want to run a datamodel tstats search, excluding some events with a lookup for src_ip's. In case I fill the l... by mfleitma Explorer in Splunk Search 12-09-2025 0 5	0	5
Matching with a lookup I'm trying to set up a regular search to check all our GitHub packages against the latest Shai Hulud npm packages.wit... by DaveBunn Path Finder in Splunk Search 12-07-2025 0 3	0	3
AnomaliDetection does not detect outlier data In the below dataset, there are two different ISPs for the user from their usual ones.NordVPN for John and Quadranet ... by ashishmgupta Explorer in Splunk Search 12-06-2025 0 2	0	2
Return results if join has no results. Hi all,I have a search with a Join. For the event I am Joining the Master search may not always have corresponding ev... by becksyboy Contributor in Splunk Search 12-04-2025 0 2	0	2
What exactly is a tsdix file? what exactly is a tsidx file? Can someone explain please? I don't quite understand the definition: "A tsidx file as... by aoliullah Path Finder in Splunk Search 12-02-2025 4 5	4	5
KVstore usage verification on Indexers \| check before disabling Background:I have a client with a large clustered environment, I have recently upgraded it to 9.4.6 and fixed wiredTi... by NullZero Communicator in Splunk Search 12-02-2025 0 10	0	10
Some AD groups are not displaying when setting up LDAP Hi all,I have setup an LDAP connection to my AD server. But when I click on LDAP Groups, not all groups are displayed... by DashZentin Explorer in Splunk Search 12-02-2025 0 3	0	3
How to process BOTS data? Hi everyone,I'm working with the botsv1 attack-only dataset and I need some guidance on how to approach a few SPL tas... by zakaria1996-cyb New Member in Splunk Search 11-29-2025 0 1	0	1
How to rename dynamic fields ? Hi All,Thanks in AdvanceI have a requirement we are onboarding CSV files that contain events. I am writing query to d... by karthi2809 Builder in Splunk Search 11-28-2025 0 4	0	4
Help Getting Grandparent Processes added to events I have an alert which filters process creation Windows logs. I'm attempting to add the grandparent process and comman... by dtaylor Path Finder in Splunk Search 11-27-2025 0 18	0	18
How get data for yesterday, last month on that day, and last year on that day I want o create a dashboard for my API response times and TPS for comparison between multiple timeframes. When ever s... by kuul13 Explorer in Splunk Search 11-26-2025 0 8	0	8
Alert Hi , I want to make an alert of all the indexes that are receiving 0 events in last 24 hr. Thanks by SN1 Path Finder in Splunk Search 11-25-2025 0 1	0	1