Splunk Search

Community Activity

	How to get the latest violator value and its month and the number of times it has violated Hi,I have a below search result which shows Violators as red in color. Violators are more than 2 secI would like to g... by sangs8788 Communicator in Splunk Search 12-03-2020 0 2	0	2
	How to get the full directory path to a file? (e.g. dirname) Similar to the Regex to find a directory in a path question, how does one find the full directory path to an file (e.... by bwlm Path Finder in Splunk Search 12-02-2020 0 1	0	1
	Regex to find a directory in a path I have these paths as sources for an index (the paths are linux file system paths) /usr/local/myfiles1/myfacilityA/... by rileyken Explorer in Splunk Search 12-02-2020 0 3	0	3
	How do I compare search results from two different time periods? I have shown the queries I made with set diff and eval below. My aim is to compare the report of 07:00 to 07:00 of th... by dunyaelbasan Path Finder in Splunk Search 12-02-2020 0 0	0	0
	How to replace join command with any other alternative command for the below query? index=105261-cli sourcetype=show_processes_cpu pid=0\| dedup deviceId\| fields deviceId, idle, fiveMinutes\| eval cpuLoa... by pstalin_ Engager in Splunk Search 12-02-2020 0 1	0	1
	search optimization: getting values with tstats for fields that are sometimes NULL Search optimization question for y’all: We have an accelerated data model to try to drive improved performance for so... by wryanthomas Contributor in Splunk Search 12-02-2020 0 1	0	1
	creating a correlation search for data exfiltration via email using datamodel Hi all,I am trying to create a correlation search query for "data exfiltration via email" using email datamodelthe ru... by elaozz New Member in Splunk Search 12-02-2020 0 0	0	0
	Is there a SPL query pattern that can perform hierarchical counting? Is there a SPL query pattern that can perform "hierarchical counting" beyond the two levels of depth outlined in thes... by jfhopkins2 Engager in Splunk Search 12-02-2020 0 2	0	2
	List of events from transactions starting with A Hi all,I am using data from 3 different indexes. They contain events which can be attributed to specific transactions... by daisy_st Loves-to-Learn Everything in Splunk Search 12-02-2020 0 2	0	2
	How to count filled and blank cells in excel spreadsheet by writing splunk query? I need help on splunk query that will count both filled and empty cells in excel spreadsheet differently and give th... by ngwodo Path Finder in Splunk Search 12-02-2020 0 6	0	6
	Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads? Like the title says - how are individual searches in a multisearch handled?Are they distributed across any/all availa... by wmyersas Builder in Splunk Search 12-02-2020 0 1	0	1
	How to extract multiple hostname from one regex search in globalprotect logs? Hi everyone, I'm trying to create a simple list with all the devices found on the logs from globalprotect. The deal i... by briansarmiento Explorer in Splunk Search 12-02-2020 0 6	0	6
	List of all indexes containing access logs Hello all, and thanks for the assistance ahead of time. How can I produce a list of all Splunk index names for indexe... by bl Engager in Splunk Search 12-02-2020 0 3	0	3
	Extract multiple words in a filed Hi,I have some syslog logs and I need to extract the first words of a field values. The field value starts like this:... by marco_massari11 Communicator in Splunk Search 12-02-2020 0 3	0	3
	Transaction command - Way to change from timestamp to a different field? Good morning all,I'm leveraging the transaction command in order to gather statistics around the duration of my reque... by Maycockk Explorer in Splunk Search 12-02-2020 0 3	0	3
	Correlate different events with a common value Hi all, I'm a new Splunk user and I would like to have some help from you.I have two query:First query:index=osb sour... by Burton_snow82 Engager in Splunk Search 12-02-2020 0 4	0	4
	search Hi, I have 2 different events. these 2 events can be identified by "Id". I am trying to display it in table in the b... by ashukp Loves-to-Learn Lots in Splunk Search 12-01-2020 0 4	0	4
	Is there a workflow to populate field on page not in URL? I know through a workflow action I can add add a token value to a URL string. Is there any way to populate a value on... by aohls Contributor in Splunk Search 12-01-2020 0 0	0	0
	when consulting for sourcetype it does not bring data I understand that I should obtain results if I also consult only specifying the sourcetype and the rest of the search... by splunkcol Builder in Splunk Search 12-01-2020 0 4	0	4
	Best Way to Search based on a Token Value Hello,I am trying to find the best way to change my search based on a token value that I will pass through an input. ... by strehb18 Path Finder in Splunk Search 12-01-2020 0 2	0	2
	This search has encountered a fatal error and has been marked as zombied. I'm trying to optimize this report to successfully run without errors. It will currently run for 3-5 hours and grow ... by jhampton_3rd Explorer in Splunk Search 12-01-2020 0 0	0	0
	combining 2 rows in to a single row Hi,I was trying to add 2 rows in to a single row . After combining,I am getting results for 1st column .but not for 2... by shashidharh Explorer in Splunk Search 12-01-2020 0 0	0	0
	Newbee question: Looking for start events without end events with the same key Our system logs an event when it receives a message (with a unique key)Some time later our system also logs an event ... by mpjjonker Explorer in Splunk Search 12-01-2020 0 1	0	1
	Negate the field containing both the values in SPLUNK query Hi,I have written following query where a field consisting of 2 actions as below,Query:sourcetype="my_sourcetype" ses... by Janani_Krish Path Finder in Splunk Search 12-01-2020 0 1	0	1
	Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events My search is \| inputlookup "edgarlog2.csv"The lookup file has no events attached to it, what is a way to add events f... by roderick001 Explorer in Splunk Search 12-01-2020 0 4	0	4

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Splunk Search

How to get the latest violator value and its month and the number of times it has violated

How to get the full directory path to a file? (e.g. dirname)

Regex to find a directory in a path

How do I compare search results from two different time periods?

How to replace join command with any other alternative command for the below query?

search optimization: getting values with tstats for fields that are sometimes NULL

creating a correlation search for data exfiltration via email using datamodel

Is there a SPL query pattern that can perform hierarchical counting?

List of events from transactions starting with A

How to count filled and blank cells in excel spreadsheet by writing splunk query?

Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads?

How to extract multiple hostname from one regex search in globalprotect logs?

List of all indexes containing access logs

Extract multiple words in a filed

Transaction command - Way to change from timestamp to a different field?

Correlate different events with a common value

search

Is there a workflow to populate field on page not in URL?

when consulting for sourcetype it does not bring data

Best Way to Search based on a Token Value

This search has encountered a fatal error and has been marked as zombied.

combining 2 rows in to a single row

Newbee question: Looking for start events without end events with the same key

Negate the field containing both the values in SPLUNK query

Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation