Splunk Search

Community Activity

	How to include arguments in search macros with non-alphanumeric values I have arguments for my macro that contain other values e.g. $env:user$ and $timepicker.earliest$/$timepicker.latest$... by cherrypick Path Finder in Splunk Search 08-15-2024 0 4	0	4
	How to trigger an alert when status field is true for more than 5 min no matter the amount of event I have search query, if the Status is field is true for more than 5 min, I need to trigger an alert no matter the Ev... by Cheng2Ready Communicator in Splunk Search 08-15-2024 0 3	0	3
	Count not showing up for events I am not seeing results for count on each of the fields for the 2 different searches below: The first one shows the... by kmm2 Path Finder in Splunk Search 08-15-2024 0 5	0	5
	HOWTO monitor previous 2 log lines from a specific log line and calculate time difference? This is my current search queryindex=abc sourcetype = example_sourcetype \| transaction startswith="Saved messages to ... by wm Loves-to-Learn Everything in Splunk Search 08-15-2024 0 3	0	3
	inputlookup I have a csv with ip addresses. I would like to conduct a search for addresses that are NOT listed in that csv. I wa... by timgmanCORP Observer in Splunk Search 08-14-2024 0 2	0	2
	Time Stamp Help! Hello, I have time stamps that are not matching. How do I table the actual "Event log time stamp" ? Splunk Time stamp... by kc_prane Communicator in Splunk Search 08-14-2024 0 5	0	5
	Search multiple hosts with one search string How would I search multiple hosts with one search string? I have 6 hosts and want the results for all: Search Strin... by Xe03kfp Path Finder in Splunk Search 08-14-2024 0 10	0	10
	search for who modified system settings in splunk cloud Is there a way to see who modified system settings in Splunk Cloud? For example we recently had an issue where an Sp... by jay_cambra Observer in Splunk Search 08-14-2024 0 1	0	1
	Splunk data to Postgres database Hello.I have Splunk Enterprise (https://splunk6.****.net run from a browser) and am running a query collecting result... by MK3 Explorer in Splunk Search 08-14-2024 0 1	0	1
	I want to find the percentage of success rate over the total amount events need help Hi, So, I got an issue where I have a log and the log has a field called ERROR_MESSAGES for each event that ends in... by OgoNARA Explorer in Splunk Search 08-14-2024 0 2	0	2
	Using input lookup Hello,If I want to use a external file that contains 2 columns C and D and use those mappings to a existing query tha... by MK3 Explorer in Splunk Search 08-14-2024 0 3	0	3
	Wants to compare last 4 hours data with last 2 days data over the same time Hi Splunk experts,I want to compare the response code of our API for last 4 hours with last 2 days data over the same... by Sishad Explorer in Splunk Search 08-14-2024 0 4	0	4
	Compare 2 calculated values in a chart Hi All,I am trying to calculate 2 values by multiplication and then compare these 2 values on a column/bar chart. My ... by Declan123 Explorer in Splunk Search 08-14-2024 0 2	0	2
	Help with self join Hi, I have a single search that produces the following table where fieldA and fieldB are arbitrary strings that may b... by tly22 Explorer in Splunk Search 08-14-2024 0 5	0	5
	Trying to create a new calculated field but the Eval expression is not evaluating correctly Hi there, Splunk Community! First time poster! Whoo! Let me outline the situation, goal, and problem faced briefly:I ... by trobknight7 Engager in Splunk Search 08-14-2024 0 1	0	1
	What does empty macro do? Is there any difference between a empty macro with () or "" I see search with both both return results but do not be... by zksplunk Engager in Splunk Search 08-13-2024 0 4	0	4
	Is there a way to capture the last line/sentence of the log in a field? There is no Pattern or punctuation so running Regex might not work in this situation since I cant know what kind of E... by Cheng2Ready Communicator in Splunk Search 08-13-2024 0 3	0	3
	How do I change the color of each individual bar in a visual chart from a single query? The original query: host="MEIPC" source="WinEventLog:Application" OR source="WinEventLog:Security" OR source="WinEven... by DataMechanic Engager in Splunk Search 08-13-2024 0 1	0	1
	How to get peak and average TPS for all the service call Hi, We are looking for a splunk query using which we have to create a dashboard to show average and maximum TPS for ... by sg86sourav New Member in Splunk Search 08-13-2024 0 8	0	8
	Splunk ES Threat Intelligence TAXII feed with API POST Argument Did someone ever faced or implementing this on Splunk ES?. Im facing an issue when try add TAXII feed from OTX API co... by elend Communicator in Splunk Search 08-13-2024 0 2	0	2
	rex during search convert to transforms/props during indexing help Hello. I have a data source that is "mostly" json formatted, except it uses single quotes instead of double, therefo... by jtm7x2 Explorer in Splunk Search 08-13-2024 0 2	0	2
	How to get events after error occured. Hello everyone, I am trying to get the queue or event counts with status=“spooling” that happened after the very firs... by Mondaya13 Explorer in Splunk Search 08-13-2024 0 2	0	2
	Search query to combine data from 2 different index not working Hi All,i need to consolidate / correlate data from 2 different indexes as explained below. I have gone thru multiple ... by neerajs_81 Builder in Splunk Search 08-12-2024 0 6	0	6
	Can we run parallel writes in lookup file? Hello All, I have a lookup file which stores data of hosts across multiple indexes. I have reports which fetch infor... by Taruchit Contributor in Splunk Search 08-12-2024 0 5	0	5
	Triggering third-party authentication Verification Hello! I'm trying to implement a mechanism to flag users who have not had a third-party authentication verification i... by chimuru84 Path Finder in Splunk Search 08-12-2024 0 7	0	7