Splunk Search

Discussions

Thread Info

Find and compare a value from one event in a subsequent future event

Hello, I'm trying to figure out how to search and compare values in subsequent/sequential JSON messages where a us...

by Explorer in

Displaying 2 counts (error and total)

There is a requirement in which i need to display total count and errors(in total count). error message is in raw tex...

by New Member in

How to find concurrent VPN users per hour?

We are using pulse secure as our VPN solution and I'm looking to build a search that tracks concurrent users per hour...

by Influencer in

How to set time to search

Hi am getting the earliest tie through a text box and I want to set the latest time automatically to (earliest+24h). ...

by Explorer in

How can i create a "key" for two searches and combine them to one search with a new column by "key"

Hello community i hope you can help me, I'm new here... The field "moid" for 'folder' has the same values like the fi...

by Engager in

Regex working on Regex101 but not in splunk

I am having below event - Subject: Security ID: EMEA\abc Account Name: XXXXXXX Account Domain: EMEA Logon ID: XXXXXXX...

by Path Finder in

query in splunk to check the previous jobs completed

Hi All, I am trying to write a query where we have to check all the jobs in success or not built status before the...

by Builder in

Squid URL lookups?

All, Any service you recommend for doing domain classification and lookups against my Squid proxy logs? Just gene...

by Builder in

Compare case-sensitivity of fields

I'm using a rex to extract a field called field1 from my search... how do I take all the results of field1 and call o...

by Communicator in

Index time extraction

Hi all, I have 10 events containing events from events 1,event2,event 3,....event 10. I need to cobine events2,3,4 an...

by New Member in

Unable to index data to splunk using add-on builder modular input method though the event shows in output console

Hi, Event is successfully getting displayed on AOB output console but it is not getting indexed to splunk and it show...

by Explorer in

how to use a wild card in if condition in eval?

I have an eval condition as below which is working good. | eval Project=if(app=="abc_def_123", "XYZ", "ZXT") N...

by Builder in

help with regex for windows event log

I'm trying to parse out data from an event log in xml format. I'm posting an example of two logs that are coming from...

by Engager in

Unable to extract Time in search results

Hi All, I have proper timestamp logs in Splunk. I am able to extract time for all the searches except one. inde...

by Explorer in

How to configure the number of event rows in the Event Log Collection list.

I have some problems with configuring rows in the event log collection list. For now, we use default Splunk data for ...

by New Member in

Time filtering

Current code that am using is below index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeD...

by Communicator in

How to group an event with multiple regular expressions to form a single event

Hi, I have the following log format, How can I break this multiline event on condition that "2020-03-23 16:41:0...

by Path Finder in

changing font size on iframe

Hi, I want to embed the outcome of Jenkins latest version(https://updates.jenkins.io/stable-2.204/latestCore.txt) in ...

by Explorer in

stats values

Hi Splunk Team! i have a query: index=mail sourcetype=webmail | stats values(time) as time values(severity) as severi...

by Path Finder in

possiblity of getting an alarm in terms of sound for an event.

Hi All, I am having a working code. index=opennms "uei.opennms.org/nodes/nodeDown" AND "PGPMVCP1-LANRTC001" | ...

by Communicator in

Index a small file (2 KB)

Hi I need to index a small file (2KB) (on Heavy Forwarder ) the file is not indexed [monitor://\raanana\Tabi4Splu...

by Contributor in

Different output in execution of same splunk query.

Hello Splunkers, I am writing a simple splunk query to append 2 lookup. |inputlookup test1.csv | inputlookup append=t...

by Communicator in

Subsearch: How can we only see results when they are NOT found?

I running a subsearch where i use a ID to find events from the index B in the index A. What I want to do is: list ...

by Explorer in

Unable to get substring from the splunk log

I have an requirement to get only the exception related substring from the splunk log, My log will be in the followin...

by Path Finder in

Splunk query to list all the knowledge objects that use splunk internal indexes(_*) ?

Is there any way in splunk to pull all the list of dashboards, macros, saved searches, and data models that uses the ...

by Builder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Find and compare a value from one event in a subsequent future event

Displaying 2 counts (error and total)

How to find concurrent VPN users per hour?

How to set time to search

How can i create a "key" for two searches and combine them to one search with a new column by "key"

Regex working on Regex101 but not in splunk

query in splunk to check the previous jobs completed

Squid URL lookups?

Compare case-sensitivity of fields

Index time extraction

Unable to index data to splunk using add-on builder modular input method though the event shows in output console

how to use a wild card in if condition in eval?

help with regex for windows event log

Unable to extract Time in search results

How to configure the number of event rows in the Event Log Collection list.

Time filtering

How to group an event with multiple regular expressions to form a single event

changing font size on iframe

stats values

possiblity of getting an alarm in terms of sound for an event.

Index a small file (2 KB)

Different output in execution of same splunk query.

Subsearch: How can we only see results when they are NOT found?

Unable to get substring from the splunk log

Splunk query to list all the knowledge objects that use splunk internal indexes(_*) ?

Exporting Splunk Apps

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Build Your First SPL2 App!

splunk threat intelligence taxii data

Splunk DB connect add-on InfluxDB 2.6

openshift_events sourcetype suddenly missing in S...

Issue with StateSpaceForecast from the MLTK app

Notepad++ SPL syntax highlighting