Splunk Search

Community Activity

transaction event not updated in 20mins Hi, I have a transaction ,begin and complete like below with session id. Want to generate an alert if the event not ... by samtechy Engager in Splunk Search 12-05-2019 0 2	0	2
[Resolved]Splunk eval - Error in 'eval' command: The expression is malformed. Hi team, I got error 'Error in 'eval' command: The expression is malformed. ' when running below query. Guess it's b... by cheriemilk Path Finder in Splunk Search 12-05-2019 0 3	0	3
Searching nested JSON to create audit dashboard I have some test JSON data that I am having trouble searching for. I need to create some Audit dashboards around thi... by Tylerdygert Path Finder in Splunk Search 12-05-2019 0 16	0	16
Search in fast vs smart modes does not return same number of events We ran into a problem where a search in smart mode returns 6 events, while the same search in fast mode returns 2 eve... by tomasmoser Contributor in Splunk Search 12-05-2019 1 14	1	14
How is my `set diff` returning any difference if I'm using the same macro as both subsearches? I'm building a dashboard where a user selects a dropdown item that has the value of a search macro name and then a si... by mbrownoutside Path Finder in Splunk Search 12-05-2019 0 2	0	2
Join two lines in the same search Hi all, I'm currently monitoring log files. I have exctrated 2 fields end_collection_timestamp & starting_collecti... by clementros Path Finder in Splunk Search 12-05-2019 1 9	1	9
How to join a lookup value for comparison? The query below works, but i need to add a lookup value 'interval' to compare against the 'hours since last seen' val... by nahfam Path Finder in Splunk Search 12-05-2019 0 10	0	10
Requesting Assistance Writing a Search Request I am writing a search which I intend to use to create an alert from. I keep getting "No Results" from this search unl... by dharveynswccd Path Finder in Splunk Search 12-05-2019 1 11	1	11
Getting full result in join/append I have a index, where i store values of items and their count (pulled from SQL DB). I run a search to return me items... by nkumar6 Explorer in Splunk Search 12-05-2019 0 10	0	10
External Python Lookup not working with Splunk 8.0 with Python 3 Hi, I have setup Splunk v8.0 in a separate VM and configured it to run strictly Python 3. Both my environments (Spl... by blueelvis Engager in Splunk Search 12-05-2019 0 0	0	0
Splunk searching nested json Hello I use automatic translation because I am not good at English. sorry. I took NVD 's CVE list (Json Feed) into S... by blaku Explorer in Splunk Search 12-05-2019 0 5	0	5
Multistep transaction using stats Hi, I have following stats table key EventCode ... by knarinen3 New Member in Splunk Search 12-05-2019 0 2	0	2
Can I count lines in table cell? Hi, I have a search to show the number of times an IP address was trying to reach some Customer IDs. How can I cou... by yossefn Path Finder in Splunk Search 12-05-2019 0 2	0	2
count of a field, and then sort by day Im looking to count by a field and that works with first part of syntex , then sort it by date. both work independant... by barneser Engager in Splunk Search 12-05-2019 0 2	0	2
How to merge two different queries with the same columns together? Hi, I have different queries: Query 1: \|inputlookup myLokkup \| eval count=0 \| table myField, count For Example: ... by shayhibah Path Finder in Splunk Search 12-05-2019 0 7	0	7
Help to extract fields from the URL I need to extract "internal-blue-ocf" as namespace and "stress-b.aps.gc1-b.lle.ocf.xxx.com" as service using rex fro... by maria_n Explorer in Splunk Search 12-05-2019 0 5	0	5
Date type issue on extracted fields Hi all, I have two date fields extracted (with regex) from log files. starting_collection_timestamp = Thu Oct 17 ... by clementros Path Finder in Splunk Search 12-05-2019 0 3	0	3
Splunk TA for Citrix NetScaler Hello All, I installed the Splunk Add-on for Citrix NetScaler https://splunkbase.splunk.com/app/2770/ And I do no... by edwardrose Contributor in Splunk Search 12-05-2019 0 2	0	2
Question on multiple condition value for Cell drilldown Hi, I have a panel in dashboard in table format. Example Table format as below : Signs Count Sigma 20 Bo... by prettysunshinez Explorer in Splunk Search 12-05-2019 0 1	0	1
Combine 2 lookup files and search query Hi, I want to create a "table" with different rows on every column. For example: Column A \| Column B... by shayhibah Path Finder in Splunk Search 12-05-2019 0 9	0	9
How to get the most recent event with specific fields by "dedup" command in indexer cluster condition? Our purpose is to get the most recent event with specific fields by "dedup" command in indexer cluster We have read... by davidgogogo Explorer in Splunk Search 12-05-2019 0 2	0	2
change date format HI, I am receiving data from Solarwinds Server and it is in following format November 27, 2019 8:34 AM I need to conv... by ChetanArgekar Explorer in Splunk Search 12-04-2019 0 3	0	3
Can you help me figure out what I'm doing wrong with my Base Collectd Configuration for a lab? All, I am not able to get collectD metrics to appear on my Splunk stand alone instance. I am setting up CollectD ... by daniel333 Builder in Splunk Search 12-04-2019 2 2	2	2
How to get data from two or more data models in Splunk through a search? Hi, Can anyone tell how I can get data from two or more data models in Splunk through a Splunk search? Like I want t... by gitanjali Explorer in Splunk Search 12-04-2019 0 9	0	9
timechart Index Time vs Raw Log's Time Hi, This search string have helped us a lot during investigation. It paints a timechart / graphicall representation ... by morethanyell Builder in Splunk Search 12-04-2019 0 1	0	1