Splunk Search

Community Activity

There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps? I have multiple apps on shcluster, "/application/splunk/etc/shcluster/apps" . I need to check if there are any Knowle... by Nilesh3110 Explorer in Splunk Search 01-14-2020 0 6	0	6
How to use rex to perform field extraction from the end of the field as opposed to the beginning I want to extract the top level domain from the CN field of a certificate in Splunk. The CN field may have multiple ... by thomas_porter Explorer in Splunk Search 01-14-2020 0 3	0	3
Index feed is having low throughput Dear All, I am a SplunkAdmin and we are facing significant data low throughput in some of the indexes. There are man... by EHariharan Explorer in Splunk Search 01-14-2020 0 2	0	2
Is it possible to run a search within an eval if statement? Hello, I am wondering if it possible to do a search within an "if" statement. I have tried what I have in the searc... by WoolarCJ New Member in Splunk Search 01-14-2020 0 6	0	6
Splunk Other category when group by Hi, I have saved search below Queryone and want to classify anything not falling under regx pattern for APIFamily in ... by msrama5 Explorer in Splunk Search 01-14-2020 0 4	0	4
Splunk group by value with pattern matching I have saved search below FirstQuery which group by values with pattern matching and want to classify anything not fa... by msrama5 Explorer in Splunk Search 01-14-2020 0 1	0	1
Search query: Unique values based on time Hi Community, I'm using the search query to search for the user activity and I get the results with duplicate rows wi... by siddharth1479 Path Finder in Splunk Search 01-14-2020 0 17	0	17
Create a query to compare Asset Inventory to see if an Asset exists between data pushes? I am trying to create a dashboard that will showcase, between data pulls, the assets that no longer exists in the ind... by dscott10 New Member in Splunk Search 01-14-2020 0 0	0	0
Convert a string in ISO 8601 to local time zone (accounting for DST) I have a string from a complex JSON event providing an ISO 8601 date/time in UTC. I want to convert it to the local t... by jkotula New Member in Splunk Search 01-14-2020 0 8	0	8
How to run a parameterized map command as a savedsearch report? Hi everyone, I have the following dummy search saved as a report: \| makeresults count=1 \| eval test="Hello" \| map ... by bojanjanisch New Member in Splunk Search 01-14-2020 0 1	0	1
Timechart mouse over Is it possible to have a mouse over hover in a dashboard with several timecharts that will highlight the exact time o... by ialahdal Path Finder in Splunk Search 01-14-2020 1 1	1	1
Return value based on missing field I want to make a search that will return a count of session_id based on the following fields logged_out, logged_in I ... by ialahdal Path Finder in Splunk Search 01-14-2020 0 4	0	4
regex field extraction I have an event that is in an HTML tag format, I'd like to extract data within it in a specific manner, as follows: <... by ialahdal Path Finder in Splunk Search 01-14-2020 0 2	0	2
[help]eval expression for dynamic field is invalid Hi Team, I have below appendpipe clause \| appendpipe [\| eventstats first(eval("step3".mvindex(list_behavio... by cheriemilk Path Finder in Splunk Search 01-14-2020 0 1	0	1
Query - SPlunk _internal Index Hi, I was trying to get amount of data getting indexed in particular index per day and analyze it as a trend. I used... by rupeshn Explorer in Splunk Search 01-13-2020 0 4	0	4
How to search any column and count if a search string is matched I have a saved search of the following format ServerName Metric1 Metric2 Metric3 Metric4 Server1 Error Erro... by mgbersales Loves-to-Learn in Splunk Search 01-13-2020 0 1	0	1
Working out % change of field value based on events logged 1 day apart Hi, Apologies for the unclear title. I could not think of a logical description for the problem statement. I have cr... by 373782073 Explorer in Splunk Search 01-13-2020 0 4	0	4
How to find missing values from a field Hi, My database has two data sources. Data source 1 sends a string with a list of expected values, so the field mig... by wkelsey Explorer in Splunk Search 01-13-2020 0 11	0	11
Combine stats count results Hello all, I feel kind of dumb even asking this question, but I've been up and down these forums looking for an answe... by myoung54 Explorer in Splunk Search 01-13-2020 0 2	0	2
Splunk not sorting Dates properly across year 1/5/2020 1/12/2020 6/16/2019 6/23/2019 6/30/2019 7/7/2019 7/14/2019 7/21/2019 7/28/2019 8/4/2019 8/11/2019 8/18/2019 ... by reverse Contributor in Splunk Search 01-13-2020 0 5	0	5
How to extract a specific field (number "n") from an event How to extract a specific field from an event, like "awk '{print $13}'", In this example I want to extract field 13 (... by leifab New Member in Splunk Search 01-13-2020 0 1	0	1
Removing null columns from a table I've found some previous posts with similar questions but the results dont seem to be correct so I'm hoping someone c... by hogan24 Path Finder in Splunk Search 01-13-2020 6 28	6	28
Feature Request: add support for middle click on chart data point In a splunk dashboard you can click a data point which will navigate the current page to the results that drove that.... by swazimodo Path Finder in Splunk Search 01-13-2020 0 3	0	3
Use field values from main search in subsearch I have a two lookup files events_lookup and risky_events_lookup . I have the following search; \| inputlookup events_... by hawifaris11 Engager in Splunk Search 01-13-2020 0 0	0	0
transaction command I have many events against session_id. but I am interested to only list down three type of events 1- AD authenticat... by riqbal47010 Path Finder in Splunk Search 01-13-2020 0 2	0	2