Splunk Search

Community Activity

Can I have a subsearch that returns a list of sources for the main search to use? Hello,I'm working on a splunk alert that monitors processes. If a process has been running for a long time I want to ... by schilds427 Explorer in Splunk Search 01-14-2021 0 2	0	2
Extract values from field conditionally on other field value Hi Splunkers,Below is my issue:Having multiple xml files, I need to monitor all the files and extracted the values fr... by dhirendra761 Contributor in Splunk Search 01-14-2021 0 9	0	9
Show multiple machines for lockouts Hi all,A past consultant of ours wrote the following correlation search to detect excessive user account lockouts:ind... by Ewong Explorer in Splunk Search 01-14-2021 0 3	0	3
three queries that produce tables, need to combine the results into one table Need some help with and advance joining of 3 queriesI have three queries that produce tables, I need to combine the ... by okretzer Engager in Splunk Search 01-14-2021 0 2	0	2
Creating drilldown to new tab for auto search without adding custom search I am trying to make it so if a user clicks on any cell in a Dashboard showing a Statistics table, that will result in... by aalvino Engager in Splunk Search 01-14-2021 0 3	0	3
There are 2 timestamp formats in a log file <Jan 10, 2021 6:58:06 PM CST> <Info> <WorkManager> <BEA-002942> <CMM memory level becomes 0. Setting standby thread p... by lish123 Loves-to-Learn Lots in Splunk Search 01-14-2021 0 10	0	10
Functionality of keepevicted not clear I'm trying to understand the functionality of keepevicted. I've read several documentation about it but it's still no... by rrovers Contributor in Splunk Search 01-13-2021 0 4	0	4
Combining 2 regex searches to a single one breaks the output results \| Shows complete event instead of regex filtered I have an index cloud_stats on which I need to create a daily error count by source report, so that we can work on th... by sysamit Engager in Splunk Search 01-13-2021 0 2	0	2
What's Wrong With This Query? Hoping to filter a search based on a list of values from a subquery where in both cases it's matching against a rex'd... by ahcarpenter Engager in Splunk Search 01-13-2021 0 3	0	3
Match fields in different searches and send alert Hi, I have two searches Search 1 = index="appv" sourcetype="AppV-User" PUT /packageSearch 2 = index="appv_latest" s... by SS1 Path Finder in Splunk Search 01-13-2021 0 6	0	6
Filter search by subsearch values Hi,What's the best way to filter a search against a set of unique id's in a subsearch?Currently, approaching it as su... by ahcarpenter Engager in Splunk Search 01-13-2021 0 1	0	1
Find the most common individual characters in a field Hi longtime splunker, first time posterso my goal here is to find the most common and uncommon characters in a field ... by suspicious_link New Member in Splunk Search 01-13-2021 0 1	0	1
field value appears to be null I'm running a search (below) that has results that sometimes in certain fields will display in the gui as empty (null... by wtaylor149 Explorer in Splunk Search 01-13-2021 0 1	0	1
Splitting field then searching each result We are monitoring users who are deleting tables in our system. We have a field "user_query" which I want to parse by ... by sk Explorer in Splunk Search 01-13-2021 0 4	0	4
extract a value from raw field Hi ,There is a way to extract a value from field even there is no = between Key and Value? After extracting I want to... by alexanderschlau Explorer in Splunk Search 01-13-2021 0 4	0	4
Timecharts and how to avoid "no results found inspect" I'm trying to avoid "no results found. inspect" message when my query returns 0 value. I just want an empty chart to... by subtrakt Contributor in Splunk Search 01-13-2021 0 12	0	12
Start time and End Time of Multiple Autosys Job runs for the same Jobname. Hello Folks,I am having some Autosys Job that runs multiple times in a day, having status lifecycle of Starting, Run... by larry_merchant Explorer in Splunk Search 01-13-2021 0 1	0	1
timechart returning no results Helloim trying to count the number of events of each alert the alerts are saved in a lookup file which looks like thi... by sarit_s Communicator in Splunk Search 01-13-2021 0 8	0	8
How to merge two field as sourcetype? Hi,I wanna merge two fields into sourcetype as below:props.conf[source::/path/to/folder/*]sourcetype = coalesce(field... by rendie Path Finder in Splunk Search 01-13-2021 0 2	0	2
How do I remove the chart on the top of the PDF? I'm running a report on Splunk 6.x and would like to remove the chart on the top of my PDF that is rendered? by rsimmons Splunk Employee in Splunk Search 01-13-2021 3 3	3	3
Need to get response time and tps in a single dashboard Hi Team,I would like to get response time and transaction per second in one graph timechart. Kindly help with the rig... by aaa2324 Explorer in Splunk Search 01-12-2021 0 2	0	2
IIS logs I am learning Splunk and playing with different log types. So far I have exported the CSV files and played around. I ... by cybermonk3y5 New Member in Splunk Search 01-12-2021 0 1	0	1
Python SDK - mTLS support Hi,I want to Authenticate a client(written in Python) to Authenticate against Splunk using mTLS.I can use splunklib.c... by ravitezu New Member in Splunk Search 01-12-2021 0 0	0	0
conditional search via based on total count Hello,Here is my search output. I want see , if Count of "Down" > "Up" criteria. Than I can understand, interface is... by corehan Explorer in Splunk Search 01-12-2021 0 3	0	3
Search peer intermittently reported down Quite often I saw this warning from dashboard panels.I have no cue what happened with following message. The search p... by phil_wong Explorer in Splunk Search 01-12-2021 0 2	0	2