Splunk Search

Community Activity

How to combine two splunk searches based on a common field and display as single chart or table? HI,I have two searches per belowindex=* host=* source=*\| eval TopicName=split(topicName,".")\| chart sum(size) as Toda... by vdalvi Explorer in Splunk Search 10-08-2020 1 2	1	2
Count field value occurences I have search result like below with repeating values in 'src _ip' fieldand looking to count occurrences of field val... by niuk Engager in Splunk Search 10-08-2020 0 1	0	1
extract http response code I have events consisting of a msg field with data like below:dev.scurry.com - [2020-01-05T19:08:10.7658789Z] "PUT /ca... by praveenvvn Explorer in Splunk Search 10-08-2020 0 1	0	1
Looking for processes executions in temp directories with random file names I'm trying to get results which show randomized filenames but it's giving me randomization in the path directory loca... by fdevera Path Finder in Splunk Search 10-08-2020 0 1	0	1
How to select Year-Month from a search output 3 months ahead ? Hello Experts,I have the below output for a splunk search, i only want to display "Year-Month" rows 3 months ahead of... by promukh Path Finder in Splunk Search 10-08-2020 0 4	0	4
[Need Help]how to put columns for one DataCenter together Hi team,I have below query:sourcetype=xxxx AND "POST /123?123_form_type=review&itrModule=cherie*"\| rex field=_raw "PO... by cheriemilk Path Finder in Splunk Search 10-08-2020 0 3	0	3
Dynamic outputlookup file name Hello ! Need your help splunkers !I want to append or create a csv for each rows of my query I do this for assignate... by Fadom1013 Explorer in Splunk Search 10-08-2020 0 1	0	1
Further filtering out events in a stats group by based on fields Hi,I have a relatively simple search, grouping events based on a extracted correlation id like this:\| eval id=coalesc... by hudson2000 Engager in Splunk Search 10-08-2020 0 2	0	2
Calculate vulnerabilty age by month with vulnerabilities that span over a month Hi,I would like to create a graph showing the average vulnerability age for each month by severity. I use this search... by unitrium Explorer in Splunk Search 10-08-2020 0 5	0	5
Does sequence matter in search? Does sequence matter in search? from below 2 queries, which is recommended or both will perform with same performance... by Pathik Path Finder in Splunk Search 10-08-2020 0 3	0	3
Splunk fails timestamp recognition on almost identical event Hi, needs some help with timestamp recognition problem. I have two almost identical events that are sendt over udp to... by hethu Path Finder in Splunk Search 10-08-2020 0 8	0	8
Multiple Stats from Base Search Hi, I'm trying to populate a dashboard using a base search and then pulling multiple stats from those results.base s... by cdstealer Contributor in Splunk Search 10-08-2020 0 3	0	3
Finding embedded dates for an automated search My search is pulling out events with the date embedded within the event, eg:[2020-10-05 07:23:08.308] ALL **** sendin... by jboustead Explorer in Splunk Search 10-08-2020 0 2	0	2
How to get multiple values of one id in different columns I got the output in the form ofsearch is : stats values(status) by id..Id statusIDStatus1AgreedN/ANegoiate2AgreedSu... by renuka Path Finder in Splunk Search 10-08-2020 1 10	1	10
Need help with timestamp recognition I have struggled with getting splunk to recognize timestamps in timestamps from an udp input. I have tried for many h... by hethu Path Finder in Splunk Search 10-08-2020 0 3	0	3
Filter duplicate rows based on a condition Hello Everyone!I have an output in the below format and would like to filter the duplicate ids with 'fieldA' value as... by kiru2992 Path Finder in Splunk Search 10-07-2020 0 8	0	8
use rex to define a string as a field Hi, I have an index that returns alarms with details as string. I want to define the text in bold as a field. The s... by c799651 Explorer in Splunk Search 10-07-2020 1 3	1	3
Trending sum count Hi,I am trying to create a trending single value however having trouble setting it up. Essentially the stats below su... by munisb Explorer in Splunk Search 10-07-2020 0 2	0	2
Converting strings I've got email subjects extracted into a field, which are encoded in UTF-8 or ISO-8859-* Examples: =?ISO-8859-15?Q?... by mborner Explorer in Splunk Search 10-07-2020 2 4	2	4
Capture peak hour and use the same hour in a sub search I am preparing a volume report for my project. My requirement is to capture the peak hour (hour which has highest cal... by Allampally Path Finder in Splunk Search 10-07-2020 0 11	0	11
Can the precision of numerical results be changed in the search? Let's say you have the following search:... \| stats sum(eval(sc_bytes/1073741824)) AS Gigabytes BY date The resulting... by CarbonCriterium Path Finder in Splunk Search 10-07-2020 0 3	0	3
How do I edit my search to have a moving timespan to count user connections within any 60 seconds? We're looking to identify the users that connect the most within a 60 second window. Currently our search looks like ... by solson3 New Member in Splunk Search 10-07-2020 0 4	0	4
Help with search Hi, I am using Splunk to grab disk drive metrics but often times I am pulling metrics for drives I don't care about. ... by unifirst101 Engager in Splunk Search 10-07-2020 0 3	0	3
Help with API query HelloIm trying to run this query from Splunk API and getting this error:'rex' is not recognized as an internal or e... by havatz Explorer in Splunk Search 10-07-2020 0 0	0	0
How To String Multiple Searches To Update KV Store Hello, I have been banging my head on a problem. What I am trying to do is run a first query to get a list of assets,... by joemarty82 Explorer in Splunk Search 10-07-2020 0 0	0	0