Splunk Search

Community Activity

how to use rex to extract two words ...from raw logs 2020-12-17T01:21:44.690341+00:00 txn1.test-fdb-us-south-004 2020-12-17T01:21:44Z { "Severity": "10", "Time": "1608168... by rajneeshdba Explorer in Splunk Search 12-16-2020 0 1	0	1
SPL Query Hello Team,I have my service now ticketing logs enabled into my splunk. I do required a below help and suggestions.L... by SabariRajanT Path Finder in Splunk Search 12-16-2020 0 1	0	1
Match mix of CIDR Ips and IPv4 Ips from a lookup to search I have a lookup table which consists of src_ip. This source Ip has mix of Ips in the format:Src_ip163.74.7.212163.74.... by dwibedi03 Explorer in Splunk Search 12-16-2020 0 3	0	3
how to dynamically change rex pattern Hello All,I hope you all are doing well.I have a situation wherein i have to pass current day value (Sun, Mon, Tue et... by vikasverma Engager in Splunk Search 12-16-2020 0 4	0	4
Alert when row count for two searches are not equal I have two events: items received, and items acted on. I want to set an alert when the count by transactionID is not ... by seomaniv Explorer in Splunk Search 12-16-2020 0 2	0	2
Search by values in field In the below table, I was to search by field "Core Content" where "Core Content" should take top 2 highest value. Co... by nivethainspire_ Explorer in Splunk Search 12-16-2020 0 8	0	8
Where are the results of a base search stored? I'm interested in the mechanics of a base search (for a dashboard). Where would the results of a base search be store... by BernardEAI Communicator in Splunk Search 12-16-2020 0 1	0	1
Splunk search Using CURL is not working Hi,Below used query is working perfectly fine when i searched directly in SPLUNK WEB. but when i use the same query i... by manoharkalva Engager in Splunk Search 12-16-2020 0 1	0	1
Regex a value Hello,I have multiple values for a field in my search results and they look like the ones below. Can you show me the ... by timyong80 Explorer in Splunk Search 12-16-2020 0 3	0	3
how to monitor and alert Auto-forwarding rule using O365 activity logs Hi all,Need help to build a query which helps to identify the users that possibly leaking /auto-forwarding emails t... by Newton Engager in Splunk Search 12-15-2020 0 1	0	1
how to replace join in this query? Hi,Anyone please help me in rewplacing join in this below queryindex=168347-np [ \| `last_np_sourcetype("index=168347-... by pstalin_ Engager in Splunk Search 12-15-2020 0 7	0	7
How to replace join in below query? @bowesmana Hi,could you please help me in replacing the join in below query?index=168347-np [ \| `last_np_sourcetype("... by priyastalin Explorer in Splunk Search 12-15-2020 0 5	0	5
Tokens I have a dashboard with two panels. One is sales data and one is returns. I would like to have a drop down that I ent... by kwholley63 Loves-to-Learn Lots in Splunk Search 12-15-2020 0 2	0	2
stats command to get count of NULL values I am using a DB query to get stats count of some data from 'ISSUE' column. This column also has a lot of entries whic... by anoopambli Communicator in Splunk Search 12-15-2020 1 3	1	3
Calculate Bucket Thaw Time Hey All,Was just curious if there is a way to calculate how long it should take to thaw\rebuild frozen buckets for se... by adalbor Builder in Splunk Search 12-15-2020 0 0	0	0
how to split string in splunk Hi @all, i have following string which i want to break into there fields: service_name, host and port_idmetics-ha-592... by Khushboo Explorer in Splunk Search 12-15-2020 0 3	0	3
Searching for Hash Values on the Network Hello All! I have a .csv file that contains a list of about 100 or so hash values that I'd like to create an aler... by itsmevic Communicator in Splunk Search 12-15-2020 1 2	1	2
Replace a character with a linebreak in table results I would like to replace all characters "___" in a certain field with a linebreak in my Table module. I am currently ... by cmak Contributor in Splunk Search 12-15-2020 0 7	0	7
How to extract a field that has value more than 10 sec? I have a splunk query that gives me all the logs of slow queries(AQL) but I need to know which ones have taken more t... by splunknoob2020 Engager in Splunk Search 12-15-2020 0 3	0	3
Time-based lookup for KV Store I'm trying to get the time-based functionality to work on a kvstore, but I'm not getting anywhere. I have taken a loo... by BernardEAI Communicator in Splunk Search 12-15-2020 0 0	0	0
Remove spaces in result of format function I would like to make use of the format function to modify the results of a sub-search. I'm getting spaces in the outp... by BernardEAI Communicator in Splunk Search 12-15-2020 0 1	0	1
File Extraction with empty field on Space delimited events My events are as below: Mon Nov 23 09:21:57 2020 6 10.0.0.3 3783 /root/A/P2/source1/POL.IDM b s i r kumar ssh 0 * Mo... by rangarbus Path Finder in Splunk Search 12-15-2020 0 1	0	1
How do I extract data from this aide output All, I had originally handles this with HUGE pile if SED commands and loops in a BASH script. But I am thinking the... by daniel333 Builder in Splunk Search 12-14-2020 0 4	0	4
Alternative method to using Join command Hello,I am a big fan of using Join for combining results of different sourcetypes and indexes (especially with a type... by zekiramhi Path Finder in Splunk Search 12-14-2020 0 7	0	7
Inefficient Query - Same Base Query, Multiple Time Ranges earliest -24h, -30d, -60d I need some suggestions on how to make this query more efficient. We would like distinct count of workstation by sit... by splunkyj Path Finder in Splunk Search 12-14-2020 0 2	0	2