Splunk Search

Community Activity

Alternatives to mvexpand for decreasing memory usage Hello! I have some JSON events that each look something like this:{ "id": 12345, "steps": [ { "stepName... by arosenwinkel Observer in Splunk Search 11-25-2020 0 5	0	5
Haversine Issue Hello, I am working with a GPX file and installed the haversine app to calculate the distance between lat/lon coordin... by genesiusj63 Explorer in Splunk Search 11-25-2020 0 0	0	0
Inputlookup command not working Hi all,I have been trying to use a search in order to compare two results. One is my lookup and one with an ldapsearc... by Sasquatchatmars Communicator in Splunk Search 11-25-2020 0 2	0	2
How to fetch relevant data from the different log lines based on a unique ID ? Hi There,I need to fetch some data based on a unique ID from the different log lines can you please help me with th... by 2chs Explorer in Splunk Search 11-25-2020 0 1	0	1
Missing seconds in Realtime query with 10ms span on python-sdk Hi, i'm trying to get Splunk realtime results using splunk's python-sdk.Everything works well, but in the results, th... by timoti Explorer in Splunk Search 11-25-2020 0 0	0	0
Rename the Values in the Json fields Hi,Could someone please help me with the rename of the string Values in the fields.I want to remove the spaces from t... by Supriya Path Finder in Splunk Search 11-24-2020 0 4	0	4
Help with searching command Hi Everyone! I'm having a stuff time trying to figure out a search command for this lab assignment. So I inputted in ... by drobles96 Engager in Splunk Search 11-24-2020 0 2	0	2
How do I create a time field? I have the EVENT_TIMESTAMP_UTC field with the values of - 2020-11-19 13:50:08.393085 2020-11-19 13:50:08.3517 2020-11... by danielbb Motivator in Splunk Search 11-24-2020 1 3	1	3
Unmatched regex re-routing How can i route this kind of data to there proper index.Data:transaction_1transaction_2transaction_01 transaction_02t... by jadengoho Builder in Splunk Search 11-24-2020 1 2	1	2
Search in an nested array object I have the following Json object:object{<!-- -->Id 123 , status : {<!-- -->Id : 123value: NotKnown}Id 456 , status : {<!-- -->Id : 456value: ... by coderworld7939 New Member in Splunk Search 11-24-2020 0 1	0	1
How do I search for correlating events from Source log? So we log API calls and response errors. However I'm having issues searching for the corrilating event from a log. E... by roderickjones Engager in Splunk Search 11-24-2020 1 1	1	1
main search \| where not IN [subsearch] not working HelloI have similar situation where I have 2 sources of data and in data I get filenames processed but filenaming con... by marshad Explorer in Splunk Search 11-24-2020 0 3	0	3
How can i change my dashboard from English language to Japanese ? Can i change my dashboard to appear in Japanese language, it tried changing en_US to ja-JP in URL that change the de... by yogeshpunia05 Explorer in Splunk Search 11-24-2020 0 2	0	2
Can't use "Where IN ([subsearch])" Hello, I'd like to match the result of my main search with a list of values extracted from a CSV. So at the end of m... by pleymort Explorer in Splunk Search 11-24-2020 0 5	0	5
Discrepancy between Fundamentals PDF and Module 5 Video Regarding Timeline Search The Splunk Fundamentals Part 1, Module 5 "Using Search" video says that both selecting and zooming into the timeline ... by superkara Engager in Splunk Search 11-24-2020 0 1	0	1
success vs failed graph Hi, Below is the information from one of my logs. "Information","ajp-nio-127.0.0.1-8016-exec-642","11/24/20","13:30:1... by muzeebm Explorer in Splunk Search 11-24-2020 0 2	0	2
Display EventCount for specific index. Want to count all events from specific indexes say abc, pqr and xyz only for span of 1h using tstatsand present it in... by shinde0509 Explorer in Splunk Search 11-24-2020 0 5	0	5
Mask the last 4 digits of a number which is 8 digits longer Hello!I am struggling to mask the last 4 digits of my numbers. \| rex field=FIELD_XY mode=sed "s/[0-9#]{3}$/###/g" Wit... by VipeRafajzat Explorer in Splunk Search 11-24-2020 0 4	0	4
How to convert epoch time to human readable format in the splunk query Could someone please help me convert epoch time to human readable time?"Date":1605030538646 by Supriya Path Finder in Splunk Search 11-24-2020 0 8	0	8
Search 2 tables with limited characters Hi All, I would like to search for a specific 7 character length of data from 2 tables. Within these 2 tables I have ... by VipeRafajzat Explorer in Splunk Search 11-24-2020 0 2	0	2
How union 2 dbxquery from 2 different tables I have 2 searches:1) \|dbxquery query="select member, gate, port from fo.member connection=fo_member"2) \|dbxquery quer... by Luninho Explorer in Splunk Search 11-24-2020 0 1	0	1
How to search suspicious user-agent in web request logs? I put web request logs into Splunk. I did a lookup csv file that included suspicious user-agents characters like belo... by j0hnn1ck Loves-to-Learn in Splunk Search 11-23-2020 0 4	0	4
how can I search not IN as I was working on a solution building for not including multiple parameters. ..........NOT[search logLevel IN (DEBUG,INFO)]........... it is not giving desired results. how can I search not IN a... by Santoshku10 New Member in Splunk Search 11-23-2020 0 1	0	1
Data Model Acceleration TSTATS where clause NOT working The following SPL is returning multiple values for nmds_adapter_survey.iccid when the where clause is set to a value.... by simpkins1958 Contributor in Splunk Search 11-23-2020 2 1	2	1
Does outputlookup append or overwrite? Does the outputlookup command overwrite or append to the existing specified lookup file? The documentation does not ... by hulahoop Splunk Employee in Splunk Search 11-22-2020 7 8	7	8