Splunk Search

Community Activity

ASA searching for current open connections that have been Built but with no teardown Hello,I'm pretty new to SPLUNK and I'm looking for help trying to find ASA open connections between two endpoints.Mos... by FC50 Path Finder in Splunk Search 12-07-2020 0 4	0	4
result of makemv not as expected With this searchindex=useradmin sourcetype=role_capabilities\| eval capabilities=replace(capabilities,"\s",",")\| makem... by rrovers Contributor in Splunk Search 12-07-2020 0 3	0	3
Concatenation of records between two keywords ? Hello.It is not a question, it is a use case that I don't arrive to resolve.The situation :a log file on remote serve... by pck_npluyaud Explorer in Splunk Search 12-07-2020 0 0	0	0
Display row, even when count over value is zero I have the following search:index=aa sourcetype="bb" Service="/abc" OR Service="/mno" OR Service="/xyz" \| chart count... by JMFrank215 Explorer in Splunk Search 12-06-2020 0 8	0	8
How to replace join from the below query? index=105261-cli sourcetype=show_system_resources\| dedup deviceId\| eval nexus_percent_used=round(100*memory_used/memo... by pstalin_ Engager in Splunk Search 12-06-2020 0 4	0	4
Trying to take a value from one search and place it in another search I have a search that runs with no issues-ComputerName=CompName* (event_simpleName=written OR event_simpleName=Direc... by aking76 Path Finder in Splunk Search 12-06-2020 0 3	0	3
Evaluate multiple events as one Hi everyone,I have a data set such as:Log1: EventId + EventType1Log 2: EventId + EventType2Log 3: EventId + EventTyp... by insatiableavi Observer in Splunk Search 12-06-2020 0 3	0	3
How to filter out few data showing up from my search string while setting a alert notification on triggering condition Hello team,My search string is as below: index=qrp STAGE IN ("*_RAW", T_FEED_MESSAGES) \| stats sum(TRADES) as "TradeC... by Snehaan Explorer in Splunk Search 12-04-2020 0 1	0	1
Join field form inputlookup failed Hi, I am getting crazy with a simply JOIN statement to use Tenable data in Splunk.The goal is to enrich the KV store ... by jacortijo Explorer in Splunk Search 12-04-2020 0 1	0	1
Query to delete multiple row in kvtable or csv table using splunk query I have kv lookup table named bingo_kv_table. There are multiple rows having same hosts along with other hosts. I wan... by Saikat001 Explorer in Splunk Search 12-04-2020 0 1	0	1
Number of aggregated events per username in a time window I am trying to monitor for higher than threshold number of events per user. Alert is run once in an hour and I need t... by LegalPrime Path Finder in Splunk Search 12-04-2020 0 2	0	2
LDAP query for users Hello,I want to search AD for all users in my organization. But as the list is huge, there is memory error occurring ... by Rody333 New Member in Splunk Search 12-04-2020 0 0	0	0
Using rex to filter fields Hello everyone,I have the following pattern of logs and I'm trying to use rex to filter the values.I started doing it... by leandromatperei Path Finder in Splunk Search 12-04-2020 0 1	0	1
Field alaises my field aliases are set like this:browser = BROWSERreferrer = REFERRERreq=REQreq_id=REQ=IDsrc=SRCDuring my search in... by Ephrem32 Explorer in Splunk Search 12-04-2020 0 3	0	3
Error after configuration in Splunk Hi All!I need your help !After checking that we're receiving logs into splunk mgt, I wanted to do Configuration in sp... by pacifikn Communicator in Splunk Search 12-04-2020 0 2	0	2
how can i change column values to field names i'm trying to convert values in column to fields names, But not able to achieve.table is like ENV LABEL ... by kirrusk Communicator in Splunk Search 12-04-2020 0 5	0	5
Replacing a field value which is present in another field using rex sed command Hi All,I am trying to replace values which are already fields present in another field using rex and mode = sed. Exam... by akil8295 New Member in Splunk Search 12-04-2020 0 1	0	1
Dashboard is running extremely slow. Hi team, I have created a dashboard with 8 panels, but it is running extremely extremely slow. how to improve the per... by cheriemilk Path Finder in Splunk Search 12-03-2020 0 6	0	6
How to compare the value of a field (search) with the value of a csv field when you have to adapt a field first Hello team!I would like to ask you a question since I have been thinking about it for a while and I am not getting it... by christianubeda Path Finder in Splunk Search 12-03-2020 1 2	1	2
Filtering mstats data using eventtypes and tags I'm looking for help to filter my mstats data using eventtype OR tag I've created for groups of hosts..Here's an exam... by johnward4 Communicator in Splunk Search 12-03-2020 0 0	0	0
How do i merge rex command to accommodate different set of events coming from same source ? I have below 3 different set of events coming from same source. So i have extracted the field using rex command for e... by georgear7 Communicator in Splunk Search 12-03-2020 0 6	0	6
rex stop after first match i have a field with several strings likefieldname = AT-field2-field3fieldname = DE-field2fieldname = DE-field2-field3... by poisar Explorer in Splunk Search 12-03-2020 0 2	0	2
how to show other field related to filtered out results with stats count in one query Hi there, I am not sure if I am missing out the obvious but I would pretty much like to be able to run stats count of... by loocayak Observer in Splunk Search 12-03-2020 0 1	0	1
How to break out multiple key-value json fields with spath and mvexpand? Hi,I am looking for a bit guidance breaking out multi-kv pairs in json logs.For example, I have json email logs wher... by Glasses Builder in Splunk Search 12-03-2020 0 2	0	2
Missing or malformed messages.conf stanza for TCPOUT:FORWARDING_BLOCKED___default-autolb-group_10 Hi, I have this error message and it is stopping any data being shown in data summary, I can't add any data as .zip o... by roderick001 Explorer in Splunk Search 12-03-2020 0 6	0	6