Splunk Search

Community Activity

Splunk Get Earliest Data by Index and Sourcetype Hi All, Is it possible to get the Earliest available date of index and source type . I tried "Tstats" and "Metadata"... by jadengoho Builder in Splunk Search 02-11-2020 0 3	0	3
LIcense Usage by Source Type Can someone help me include sourcetype to my search below? I am trying to run a report for the past 60 days and need ... by fmpa_isaac Path Finder in Splunk Search 02-10-2020 0 6	0	6
Need help with rex command Hello I'm trying to run a rex command to extract "is set to expire" Relying party trust 'ButterCup Games - Test' xx... by locose Path Finder in Splunk Search 02-10-2020 0 2	0	2
nslookup TXT queries with Splunk I am trying to see if its possible to run nslookup -q=TXT domain 8.8.8.8 so i can compare the results of the output t... by urana Engager in Splunk Search 02-10-2020 0 3	0	3
Splunk Regex Engine Fails? We're trying to extract fields that match this [ FIELD_NAME = S0m3 Valu3 w\ reaLLy $pec!aL ch*rac+3rs ] and write th... by morethanyell Builder in Splunk Search 02-10-2020 0 9	0	9
time-based lookups and kvstore Hello all, We are having some problems defining a time-based kvstore lookup on Splunk 6.2.0. We tried defining a sim... by joaopcarvalho Explorer in Splunk Search 02-10-2020 0 17	0	17
kvstore lookups from database. Hi Please give me any feedback . ideas as to whether I am following the best action. I have a database table that is... by dmcintosh1972 Explorer in Splunk Search 02-10-2020 0 1	0	1
How to incorporate tag in the if-then-else Splunk construct Hello, I created SPL search, that should pull out the log entries, based on the if-then-else condition, but it does n... by chersergei New Member in Splunk Search 02-10-2020 0 3	0	3
Knowledge Objects for Orphaned searches I have a couple orphaned searches owned by a user who is no longer with the company ( his user id was deleted ) . Im ... by newsplunker1 Path Finder in Splunk Search 02-10-2020 0 2	0	2
Is it possible to have multiple break_only_before regex for one sourcetype I'm currently working through each of my companies Java apps and updating their sourcetypes using transforms and rege... by freern New Member in Splunk Search 02-10-2020 0 3	0	3
How to trim everything from a field after a comma I have a field that contains: CN=Joe Smith,OU=Support,OU=Users,OU=CCA,OU=DTC,OU=ENT,DC=ent,DC=abc,DC=store,DC=corp ... by sawyer2624 Engager in Splunk Search 02-10-2020 0 4	0	4
how to extract a string before the @ symbol from an email adress? I have the username filed extraction as follows in the props.conf which extracts the email address:- [sourcetype_X]... by pavanae Builder in Splunk Search 02-10-2020 0 2	0	2
Field extraction stanza help in props.conf? I have the username filed extraction as follows in the props.conf which extracts the username:- [sourcetype_X] EXTRA... by pavanae Builder in Splunk Search 02-10-2020 0 3	0	3
Can you please help me in creating a table with multiple rows of the same field using stats or some other code? I need to display multiple rows having the same PART_NUMBER value for each FLIT_COMPONENTS and AMOUNT sourcetype=fli... by dinu1701 Explorer in Splunk Search 02-10-2020 0 9	0	9
How to count top results in each column? Hi everyone, Trying to find out the top 10 values from different host long_message index functionality.. So tried l... by marisstella Explorer in Splunk Search 02-10-2020 0 5	0	5
change colon to dash in Search First, let me start by saying I am not a programmer, a Splunk expert, highly experienced with Regex or SED. I say thi... by bulu New Member in Splunk Search 02-10-2020 0 5	0	5
What's the best easter egg in Splunk 4.2? I think the title says it all. by amrit Splunk Employee in Splunk Search 02-10-2020 6 6	6	6
Removing values from a field how to remove values from fields highlighted in red index=main \| eval description=case(status == 200, "OK", status ... by gagareg Explorer in Splunk Search 02-10-2020 0 4	0	4
Outer Join not working I have data in a CSV called 25_million_Linie_Rule.csv (example below) host,source,count "INTERFACES_BUILD","/hp547s... by robertlynch2020 Influencer in Splunk Search 02-10-2020 0 5	0	5
Different element between two stats values() lists search made before ...\| stats values(user) as AllUsers, values(usr_mod) as ModifiedUsers And it returns two lists ... by rsaude Path Finder in Splunk Search 02-10-2020 0 17	0	17
How do I show full series name while mouse over on the legend? Hello, I have a line chart with multiple series in my dashboard. The series names are quite long, so they cut in the... by damucka Builder in Splunk Search 02-10-2020 0 0	0	0
Subtract One Field from Another Hi guys, I'm having trouble making a simple subtraction (well, I thought it would be simple!). Field1 is a number in... by driva Path Finder in Splunk Search 02-09-2020 0 2	0	2
What's the easiest way to return a multivalue result containing the values that are present in two multivalues? Hello, Working with Splunk 7.3.2. I have two multivalues that have a set of values in common: \| makeresults \| eval... by andrewtrobec Motivator in Splunk Search 02-09-2020 0 2	0	2
BREAK_ONLY_BEFORE_DATE=TRUE seems to not be working A custom web application produces logs in the tomcat format like this: 2020-01-31 18:19:02,091 DEBUG [com.vendor.mak... by mitag Contributor in Splunk Search 02-09-2020 0 7	0	7
Arithmetic on multi field values I am new to Splunk, and I need to perform arithmetic on some multi-field values. What is the best way to do this? H... by rtakatsuka Engager in Splunk Search 02-08-2020 0 1	0	1