Splunk Search

Community Activity

srchMaxTime default unit in authorize.conf Hello guys, is it OK to use srchMaxTime = 9000, it looks like it does 9000 seconds? In authorize.conf doc it asks f... by splunkreal Influencer in Splunk Search 05-20-2020 0 2	0	2
How to return a single value from a subsearch into eval Part 2 I found a different answer article with an example of what I'm trying to do, but I can't get it to work on my end. I... by hollybross1219 Path Finder in Splunk Search 05-20-2020 0 1	0	1
How to create search for daily license usage report per host? Hi All, I need to create a Splunk License usage report on a daily basis for all the reporting hosts. Can someone ple... by nnimbe1 Path Finder in Splunk Search 05-20-2020 0 2	0	2
Filter results based on aggregates (Another question of Splunk's way to emulate SQL's "HAVING" ) My goal is to design an alert that will populate a table of raw results, but only when certain evaluation aggregates ... by hollybross1219 Path Finder in Splunk Search 05-20-2020 0 5	0	5
Crowdstrike TA error Hi, Running into this error trying to setup the Streaming API: 04-03-2020 11:37:21.473 +0000 INFO TcpOutputProc - ... by warrenkobalt New Member in Splunk Search 05-20-2020 0 2	0	2
How do you add a static drop-down for specific field values with conditonal? System OS ABC Windows-Server-2016 ABC Windows-10-Enterprise ABC Mac-OSX DEF Windows Server-2016 DEF Windows Server-2... by UMDTERPS Communicator in Splunk Search 05-20-2020 0 4	0	4
Need to create a search thatshows both success percentage and failure count in dual axis combo chart. Hi, I need to write a search that shows both the success percentage and failure count in a dual axis combo chart. ... by vijaysubramania Path Finder in Splunk Search 05-20-2020 0 2	0	2
Rex mode=sed diff between replace and substitute What are the differences between option "s" and "y"? index=_internal sourcetype=splunkd \| rex mode=sed “s/idx=\d+\.... by ben_leung Builder in Splunk Search 05-20-2020 5 4	5	4
CSV Lookup - Exclusions - Help Required. Hi guys, I'm trying to work out what's wrong with my search (see below). I have a CSV lookup file with a list of nam... by driva Path Finder in Splunk Search 05-20-2020 0 4	0	4
Extract Comma seperated fields I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon). Example... by rsantkumar Observer in Splunk Search 05-20-2020 0 2	0	2
How to filter values to remove attributes from a table? Hello Splunkers, I appended two different searches within Splunk. Then I created a table, and now I need to filter t... by gmartinv New Member in Splunk Search 05-20-2020 0 3	0	3
How to convert tabular data to time series data? I have a lookup file, which is of the format: "Department", "Jan FY20", "Feb FY20", "Mar FY20", "Apr FY20" "Sales", ... by hmallett Path Finder in Splunk Search 05-20-2020 0 6	0	6
How do I extract a comma separated field during search? I have event data in Splunk that look like this: 2013-02-14 11:32:46.4314 app=ws3 sev=INFO mid=1325748 , Fooo, Barr,... by andyk Path Finder in Splunk Search 05-20-2020 0 5	0	5
How to display count from last week and avg from last month on one timechart I'm trying to plot count of errors from last week per day and daily average value from month. The result from query b... by slipinski Path Finder in Splunk Search 05-20-2020 0 7	0	7
How to extract data of JSON in one row? I have this JSON, and I want extrac the value when the name is "ca-channel" and value when name is "Ca-Request-Id" bu... by jhonatancuartas New Member in Splunk Search 05-19-2020 0 2	0	2
Another method to connect two search results other than using the join command? Hello is there another way to connect these two other than join... I have read that stats is faster than join ... is ... by xnx_1012 Explorer in Splunk Search 05-19-2020 0 2	0	2
Remove extra fields I search the syntax and find Account_Domain result contains two column. How can I result first column so that I left ... by keyu921 Explorer in Splunk Search 05-19-2020 0 3	0	3
Search time knowledge and lispy I have been participating in Splunk Advanced Searching and Reporting course and there is one thing that is mentioned ... by charlesmeo Explorer in Splunk Search 05-19-2020 0 0	0	0
How to count number of API calls on multiple distributed hosts? Hi Team, I have 10 APIs, which run on two distributed hosts, and I want to know the count of API calls on each of th... by rbachu1 Explorer in Splunk Search 05-19-2020 0 4	0	4
Average of stats two fields values I have Below Splunk query to get some data from my logs index=myindex sourcetype=mysourcetype "search string" \| sta... by paragvidhi Engager in Splunk Search 05-19-2020 0 4	0	4
Field Extraction from Raw Data Hello, Im new to splunk and just started learning it and im having little issues extracting some fields from a raw d... by Dandanos Engager in Splunk Search 05-19-2020 0 3	0	3
How to search how much bandwidth a forwarder is using? I'm trying to find how much bandwidth a forwarder is using and how many hosts are sending over the forwarder. I want ... by sbattista09 Contributor in Splunk Search 05-19-2020 8 8	8	8
index vs lookup Hello All, Am trying to optimize the performance of a dashboard that was built some time back. The existing dashboar... by johnsasikumar Path Finder in Splunk Search 05-19-2020 0 1	0	1
Using sort 0 to avoid 10000 row limit Sorry for the silly attention-grabbing dancing question mark.  Thanks for any help on this. I've had to dive into t... by leica0000 Engager in Splunk Search 05-19-2020 0 2	0	2
How to rename fields in a subsearch and keep results of the original field name? I have a subsearch query that uses a wildcard keyword list as an inputlookup to find filenames that contain a keyword... by Glasses Builder in Splunk Search 05-19-2020 0 2	0	2