Splunk Search

Community Activity

2 index join not working Hi All,I need some advice or help,so I have 2 index I'd like to join but it seems not working as I expected :index an... by Laxman24 Explorer in Splunk Search 11-01-2020 0 1	0	1
searching in 3 specific time periods HelloI have a sourcetype that have a lot thousands of event each minute so it is very big.i have a use case that i ne... by avishni01 Explorer in Splunk Search 11-01-2020 1 3	1	3
Search WinEventLogs based on user as Variable Hi,I'm new to Splunk & just getting used to it. I'm trying to search for Windows event logs relative to the "TargetUs... by cam98 Engager in Splunk Search 10-31-2020 1 1	1	1
help for sorting time helloI use a time field like this but I am unable to sort the time with descending sortHow to do this please?\| eval t... by jip31 Motivator in Splunk Search 10-31-2020 0 3	0	3
timechart overlay Hi I have this search which graphs calls to phone numbersindex=myindex sourcetype=mysource Number IN (5551,5555,55557... by c799651 Explorer in Splunk Search 10-30-2020 0 2	0	2
Not receiving logs in Splunk Add on for Service now Hi All,I installed splunk add on for service now and configuration and inputs were made.But i am not receiving any l... by alexspunkshell Contributor in Splunk Search 10-30-2020 0 2	0	2
Match two lines of text in an event as single instances For some background on how the data is structured, it is JSON data that I have ingested a specific way, using a regex... by jmontgomerysc Engager in Splunk Search 10-30-2020 0 2	0	2
Help request for Streamed search execute failed My current splunk search stops after 5 errors of "Streamed search execute failed because: Error in 'rex' command: ". ... by Alex_NL Observer in Splunk Search 10-30-2020 0 0	0	0
Mask sensitive info with SEDCMD I am attempting to mask sensitive information using SEDCMD. However, it does not seem to take effect.I've run btool, ... by geoffmoraes Path Finder in Splunk Search 10-30-2020 0 4	0	4
Line Chart Overlay based on previous month and previous month-1 Hi,I would like to compare the data of the previous month to the month before (i.e. now its October, so the default s... by ronaldtanhj Path Finder in Splunk Search 10-30-2020 1 13	1	13
sequential or execution in join (or simulating join) Hi,I'm in Splunk since August after 20 years working in SQL, a lot of new things and I need help.I've a daily cron jo... by jgm1977 Engager in Splunk Search 10-30-2020 0 1	0	1
search query - categorizing results based on a field Hi, bit new to splunk, looking for suggestions on one of my search queries:Here's some sample events that I receive{<!-- -->"... by milanpatel7 New Member in Splunk Search 10-29-2020 0 0	0	0
Creating Field from Inputlookup Hello.I'm trying to create a field for all events in a search. The field is a value from a inpulookup. There is no sh... by TooManyQuestion Explorer in Splunk Search 10-29-2020 1 4	1	4
Error in 'eval' command: The expression is malformed. An unexpected character is reached at ') , user)'. Help Please I have a search running fine by itself, index=indexA user=ABC123 \| where isnotnull(USER_NAME_FROM_ACEE) \| table USE... by samlinsongguo Communicator in Splunk Search 10-29-2020 1 2	1	2
UX question about login page community.splunk.com Hi All, one question related to community.splunk.com login page.. so on the login page, we get username textbox, afte... by inventsekar SplunkTrust in Splunk Search 10-29-2020 0 6	0	6
Adding avg and changing min to minutes Ill start off i am newer to splunk.... I am using the following search index=server source="WinEvent" EventCode=1234... by eb1929 Explorer in Splunk Search 10-29-2020 0 1	0	1
I can`t get more than 10.000 results in a join command Hi, I would like to know if there is some way to create a query where I can get more than 10.000 results when I used ... by jjofret Explorer in Splunk Search 10-29-2020 0 1	0	1
How to line up 2 reports Hello Splunk Community,I have 2 reports trying to combine into 1. The fields are different to each other. Say Report ... by iamsplunker Communicator in Splunk Search 10-29-2020 0 3	0	3
Is there a way to do a NOT IN search something like; [search index= myindex source=server.log earliest=-360 latest=-60 " by riotto Path Finder in Splunk Search 10-29-2020 0 10	0	10
How to pass a field value from one search to another search? Hi All,I'm extremely new to Splunk and have been tasked to do the following:Perform a query against one host (Server1... by hillsw19 Explorer in Splunk Search 10-29-2020 1 4	1	4
WinEventLog input xmlRegex modifier -- When did THIS become available? I've been on the struggle bus with WinEventLog blacklist entries this week and stumbled upon the new xmlRegex modifie... by dstaulcu Builder in Splunk Search 10-29-2020 0 2	0	2
Splunk Alert Create alert based on count over past time frame Hi Splunk Community I need some assistance with a Splunk alert, the search result provides exactly what I require but... by Pmeiring Explorer in Splunk Search 10-29-2020 0 1	0	1
How show 0 when not result I need show any value in every minute, but I only get value > 0Search:\| tstats count WHERE index=XXXXX C_TXN_A IN (1,... by Luninho Explorer in Splunk Search 10-29-2020 0 2	0	2
How to set a backup TCPOUT group in Outputsconf Hi,From my understanding, the param `defaultGroup` under the stanza `[tcpout]` in `outputs.conf` can be set to a comm... by morethanyell Builder in Splunk Search 10-29-2020 0 5	0	5
need help in order to compare 2 columns and display one related field Hi, I'm Alex from Franceas almost everyone here, I need some splunk guru ^^fields computer and user are in index1, co... by maz38 New Member in Splunk Search 10-29-2020 0 7	0	7