Splunk Search

Community Activity

Sending entity names in the email triggered from Correlation Searches. Hi Team, I have a KPI with split by entity say "Ent1". I have made a correlation search using this KPI and in the tr... by veerendra_modi Loves-to-Learn in Splunk Search 05-21-2020 0 2	0	2
eval or rex help Message="Internal event: Function ldap_search entered.SID: S-1-5-18Source IP: 127.0.0.1:25855Operation identifier: 68... by keyu921 Explorer in Splunk Search 05-21-2020 0 5	0	5
How to show the whole text in a table column while hovering on it ? I want to display the text of a column of a table in one line. After hover to it, it should show whole the descriptio... by patra966 Path Finder in Splunk Search 05-20-2020 0 0	0	0
Help building regex for searches based on cs_username field. I'm having no luck building a regex to match cs_usernames. What I'm looking for are two separate searches both base... by Vfinney Observer in Splunk Search 05-20-2020 0 2	0	2
Timechart glich with column VALUE Got a cenario where timechart returned me a column named 'VALUE' where I don't have a value=VALUE in my logs as part ... by gorosco Engager in Splunk Search 05-20-2020 0 2	0	2
srchMaxTime default unit in authorize.conf Hello guys, is it OK to use srchMaxTime = 9000, it looks like it does 9000 seconds? In authorize.conf doc it asks f... by splunkreal Influencer in Splunk Search 05-20-2020 0 2	0	2
How to return a single value from a subsearch into eval Part 2 I found a different answer article with an example of what I'm trying to do, but I can't get it to work on my end. I... by hollybross1219 Path Finder in Splunk Search 05-20-2020 0 1	0	1
How to create search for daily license usage report per host? Hi All, I need to create a Splunk License usage report on a daily basis for all the reporting hosts. Can someone ple... by nnimbe1 Path Finder in Splunk Search 05-20-2020 0 2	0	2
Filter results based on aggregates (Another question of Splunk's way to emulate SQL's "HAVING" ) My goal is to design an alert that will populate a table of raw results, but only when certain evaluation aggregates ... by hollybross1219 Path Finder in Splunk Search 05-20-2020 0 5	0	5
Crowdstrike TA error Hi, Running into this error trying to setup the Streaming API: 04-03-2020 11:37:21.473 +0000 INFO TcpOutputProc - ... by warrenkobalt New Member in Splunk Search 05-20-2020 0 2	0	2
How do you add a static drop-down for specific field values with conditonal? System OS ABC Windows-Server-2016 ABC Windows-10-Enterprise ABC Mac-OSX DEF Windows Server-2016 DEF Windows Server-2... by UMDTERPS Communicator in Splunk Search 05-20-2020 0 4	0	4
Need to create a search thatshows both success percentage and failure count in dual axis combo chart. Hi, I need to write a search that shows both the success percentage and failure count in a dual axis combo chart. ... by vijaysubramania Path Finder in Splunk Search 05-20-2020 0 2	0	2
Rex mode=sed diff between replace and substitute What are the differences between option "s" and "y"? index=_internal sourcetype=splunkd \| rex mode=sed “s/idx=\d+\.... by ben_leung Builder in Splunk Search 05-20-2020 5 4	5	4
CSV Lookup - Exclusions - Help Required. Hi guys, I'm trying to work out what's wrong with my search (see below). I have a CSV lookup file with a list of nam... by driva Path Finder in Splunk Search 05-20-2020 0 4	0	4
Extract Comma seperated fields I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon). Example... by rsantkumar Observer in Splunk Search 05-20-2020 0 2	0	2
How to filter values to remove attributes from a table? Hello Splunkers, I appended two different searches within Splunk. Then I created a table, and now I need to filter t... by gmartinv New Member in Splunk Search 05-20-2020 0 3	0	3
How to convert tabular data to time series data? I have a lookup file, which is of the format: "Department", "Jan FY20", "Feb FY20", "Mar FY20", "Apr FY20" "Sales", ... by hmallett Path Finder in Splunk Search 05-20-2020 0 6	0	6
How do I extract a comma separated field during search? I have event data in Splunk that look like this: 2013-02-14 11:32:46.4314 app=ws3 sev=INFO mid=1325748 , Fooo, Barr,... by andyk Path Finder in Splunk Search 05-20-2020 0 5	0	5
How to display count from last week and avg from last month on one timechart I'm trying to plot count of errors from last week per day and daily average value from month. The result from query b... by slipinski Path Finder in Splunk Search 05-20-2020 0 7	0	7
How to extract data of JSON in one row? I have this JSON, and I want extrac the value when the name is "ca-channel" and value when name is "Ca-Request-Id" bu... by jhonatancuartas New Member in Splunk Search 05-19-2020 0 2	0	2
Another method to connect two search results other than using the join command? Hello is there another way to connect these two other than join... I have read that stats is faster than join ... is ... by xnx_1012 Explorer in Splunk Search 05-19-2020 0 2	0	2
Remove extra fields I search the syntax and find Account_Domain result contains two column. How can I result first column so that I left ... by keyu921 Explorer in Splunk Search 05-19-2020 0 3	0	3
Search time knowledge and lispy I have been participating in Splunk Advanced Searching and Reporting course and there is one thing that is mentioned ... by charlesmeo Explorer in Splunk Search 05-19-2020 0 0	0	0
How to count number of API calls on multiple distributed hosts? Hi Team, I have 10 APIs, which run on two distributed hosts, and I want to know the count of API calls on each of th... by rbachu1 Explorer in Splunk Search 05-19-2020 0 4	0	4
Average of stats two fields values I have Below Splunk query to get some data from my logs index=myindex sourcetype=mysourcetype "search string" \| sta... by paragvidhi Engager in Splunk Search 05-19-2020 0 4	0	4