Splunk Search

Community Activity

What is "batch mode" search? Hi, I'm testing out some features in 6.3, and looking at increasing our search and index throughput. One of the set... by a212830 Champion in Splunk Search 04-19-2020 1 6	1	6
About dropdown filter There is a dropdown filter on the dashboard. How can I select multiple values for that filter? by manakin New Member in Splunk Search 04-19-2020 0 2	0	2
Eval function for Variable Calculations I have a logic which I want to implement in Splunk, but I'm getting confused with the syntax.Let me explain what I am... by kulwindersandhu New Member in Splunk Search 04-19-2020 0 1	0	1
How to pass argument (dynamically) to searchmatch function without use map command Hi, I wonder test different pattern matching (format spl) dynamically with a field value without use the command "ma... by Testeur971 New Member in Splunk Search 04-19-2020 0 13	0	13
How can I create lookup table file(csv file) automatically? I just want to create csv file automatically everyday for example, today just is created 20200417.csv tomorrow will ... by tkdguq0110 Path Finder in Splunk Search 04-19-2020 0 4	0	4
Please help....I'm using \|eval case() with multiple values and need help with passing through the values to an IN() search There are three conditions in my eval: 1) date=2019-Present, '"/2019","/2020"' 2) date=2019, " /2019" 3) date=2020,... by motaghis Explorer in Splunk Search 04-18-2020 0 6	0	6
Unable to retrieve XML tags which as mutliple attributes Hi, I am novice to splunk and trying to learn explore things in it. Currently I am stuck with one problem while extr... by asoma0707 New Member in Splunk Search 04-18-2020 0 5	0	5
Joining two queries with same field name , but different values I am trying to create an alert which will check how many messages are stuck in the queue and whats the age of message... by bsaujla131984 Path Finder in Splunk Search 04-18-2020 0 8	0	8
UF splunkd.log says "Can't find or illegal IP address or Name" using DN or FQDN After manually installing splunkforwarder-5.0.3-163460-x64-release.msi on Windows Server 2008 R2 and specifying index... by valkyrie Engager in Splunk Search 04-18-2020 3 2	3	2
RegEx for pattern matching and extraction Hi, I have data that contains Sessions ID labeled as (SES) and User ID labeled as (ABC). When I look at the events... by mbasharat Builder in Splunk Search 04-18-2020 0 6	0	6
TOP 10 values I have a sample data from email logs where we have from and message size. how can I extract "Top ten sending address... by riqbal47010 Path Finder in Splunk Search 04-18-2020 0 2	0	2
dispatch.finalizeRemoteTimeline taking a long time? When I run a search in Splunk 6.x, the results come back quickly, but it seems like a lot of time is spent on "Finali... by dshpritz SplunkTrust in Splunk Search 04-18-2020 8 18	8	18
If my lookup size is too large (approx 2GB), will moving to KV store solve a search head replication issue? As of now, we use CSV lookups but some of the lookups are around 2 GB which is creating a problem in SH replication. ... by pargupta1234 New Member in Splunk Search 04-18-2020 0 0	0	0
How can I find my Splunk IP adress search head? I am very new with Splunk. I started lerning it with on line courses. I need to configure Forwarding in heavy forwa... by remartins New Member in Splunk Search 04-18-2020 0 1	0	1
Change other in Pie Chart (not in a dashboard panel) Hello, I want to change the field "other(n)" in a pie chart within the search results, not in a dashboard panel. Inst... by genesiusj Builder in Splunk Search 04-17-2020 0 0	0	0
"Other" values in pie chart Hi, Short explanation of my problem: I'm investigating a problem where two file downloads are apparently interrupted... by echalex Builder in Splunk Search 04-17-2020 1 11	1	11
How do I display a table with the fields extracted from regex? I built a regular expression to extract fields from a log file. However, after extracting I am not able to display th... by gvssaicharan Engager in Splunk Search 04-17-2020 0 3	0	3
How can we prevent users from creating knowledge objects within the Search app? A similar question as in Is there a way to prevent users from saving knowledge objects in the Searching and Reporting... by ddrillic Ultra Champion in Splunk Search 04-17-2020 0 7	0	7
Rename Extracted Fields Name Is there a way to rename the extracted fields in the Interesting Fields section? Example would be Interesting Fields... by wwhite12 Path Finder in Splunk Search 04-17-2020 0 3	0	3
Is there a systemd unit file for Splunk? systemd replaces SysV init scripts and some Linux distributions are migrating to or currently support systemd (such a... by Yorokobi SplunkTrust in Splunk Search 04-17-2020 14 66	14	66
Need to extract elapsed time hi, I have a query with the below mentioned resultset logger: com.optum.bh.benefit.plan.api.BhBenefitPlansResource ... by vipulg83 New Member in Splunk Search 04-17-2020 0 10	0	10
How to sum multiple columns by multiple names? Hi, how do I sum multiple columns using multiple columns? For instance, my data looks like this: How do I get two ... by tarantula Engager in Splunk Search 04-17-2020 0 1	0	1
How to subtract _time field from Multifield value Hello I have a search with an MV Value this is called HeartBeatTime. I like to create an allert when the HeartBeatTim... by zhonk Explorer in Splunk Search 04-17-2020 0 8	0	8
Has any one created SPL query for detecting Lateral movement of users I am currently trying to create a SPL query to detect any suspicious lateral Movement to be detected from windows log... by dikshaj Engager in Splunk Search 04-17-2020 0 1	0	1
spl query output mismatch index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf \|dedup hostname \|table hostname ... by vinitpathri Path Finder in Splunk Search 04-17-2020 0 6	0	6