Splunk Search

Community Activity

Why is multiline regex blacklisting all events for specifically 4656 only? Hi All, I cant seem to get this right. I am trying to use regex to blacklist 4656 events where: The account name en... by geraldcontreras Path Finder in Splunk Search 11-26-2019 0 2	0	2
Regex by ID removing duplicates Hello everyone. I have a code below where each event is determined by the line break. I am wanting to take the value... by leandromatperei Path Finder in Splunk Search 11-26-2019 0 3	0	3
How to search syntax to exclude dhost or URL New to Splunk here. Trying to run a search for user BLAHBLAH that does NOT contain dhost of api.drift.com Would someo... by trojan_81 Path Finder in Splunk Search 11-26-2019 0 1	0	1
How to adjust search to include names that are also hyphenated We ingest patient records into Splunk and some compliance users need to search to see if an employee accessed records... by dougsummersett New Member in Splunk Search 11-26-2019 0 5	0	5
How to find a follow-up event after certain interval Say, when a user connects his VPN, it will do policy checking (event--> policy_checking) and within 5 minutes will be... by cyber_castle Path Finder in Splunk Search 11-26-2019 1 8	1	8
Searching in multiple indexes I am trying to create a search to do the following: 1) Look in a table where information is tagged in a certain way ... by willadams Contributor in Splunk Search 11-26-2019 1 2	1	2
How to combine duplicate Latitude and longitude values in the stats tale of a cluster map I just want to clean up my search of 'noise'as my stats table gets populated by duplicate values from the save latitu... by schalkrust Engager in Splunk Search 11-26-2019 0 2	0	2
Generate percentage and filter based on it from events with count in them (so I cannot use "top")? Hi Experts, I need to create a alert , if HTTPCode_Target_5XX_Count is greater than 5% of Total count then i need t... by arun_kant_sharm Path Finder in Splunk Search 11-26-2019 0 4	0	4
[tpl10082inf63] Field 'total' does not exist in data Hi, I am using below query. I am getting data but in chart i am getting warning '[tpl10082inf63] Field 'total' does... by sachinbansal New Member in Splunk Search 11-26-2019 0 2	0	2
How come a specific macro ends up in generic searches and breaks some of them? We use the TA-Varonis-DatAlert and it creates the varonis_index macro defined as index=*, which is global. When runn... by danielbb Motivator in Splunk Search 11-26-2019 0 5	0	5
Reporting on VM capacity over time Date, VM1, VM2, VM3, VM4 5/1/2019 100, 100, n/a, 450 6/1/2019 100, 140, n/a, 450 7/1/2019 105, 200... by clintla Contributor in Splunk Search 11-26-2019 0 3	0	3
Can I fill a null value with another field's value in the event? I have seen two other related questions but neither of the answers have worked for me. Data: Events with a control... by donk23 New Member in Splunk Search 11-26-2019 0 3	0	3
Count of distinct values for emails I have events coming in from an email spam appliance and would like to have an alert on spam campaigns with a unique ... by hattrells Engager in Splunk Search 11-26-2019 0 3	0	3
Why is this regex pattern breaking after adding a few more characters to expression I have the following sample text that's embedded inside a log: (Response=200) {"log":{"properties":"rob"}} I am ... by hinhrt Explorer in Splunk Search 11-26-2019 0 9	0	9
How i can show my result in below format I have table in below format. Order_Creation_Time Order_Count Brand 00 6 brand1 00 ... by nilbak1 Communicator in Splunk Search 11-26-2019 0 18	0	18
add field values for null field I have t wo coloum alog with data dataset A datasetB User A 1.2.3.4 User B Us... by raiqbal47010 New Member in Splunk Search 11-26-2019 0 1	0	1
Why am I getting error "libssl.so.1.0.0: cannot open shared object file: No such file or directory" trying to implement a custom search command in Python? Trying to implement custom search commands on Python and just have been crazy frustrated with the amount of issues I ... by joseph_caraccio Engager in Splunk Search 11-26-2019 4 2	4	2
Combine 2 searches such that for each row on the first search, all rows on the second search will be joined I have a saved search which contains the following information: ServerName Environment Server1 Prod ... by mgbersales Loves-to-Learn in Splunk Search 11-26-2019 0 5	0	5
Is there a way to create a dynamic threshold in timechart I'm trying to create a timechart by combining running jobs data from two source. The first set of data being the job... by crap30 Engager in Splunk Search 11-26-2019 0 2	0	2
Splunk Integration with UiPath I have robot (TransferFile.xaml) created by UiPath studio. I want to trigger this robot based on dashboard's column v... by vishal9023 New Member in Splunk Search 11-26-2019 0 0	0	0
How to extract URL into a new field? What would be a command to extract the url and create a new field from Cisco eStreamer logs using the rex command? by Vfinney Observer in Splunk Search 11-26-2019 0 7	0	7
Use of tokenizer option with makemv I am trying to break a field based on some regex. Apparently this can be done with the tokenizer option of the makemv... by agodoy Communicator in Splunk Search 11-25-2019 0 3	0	3
Why do two different users using same Sh, same app, same query, and same permissions, getting two different results? Why 2 different users using same Searchhead, same app and same query and same permissions get 2 different results? Co... by muizash Path Finder in Splunk Search 11-25-2019 0 8	0	8
How to write admin credentials within the command Hello guys, Is there any possibility to execute a CLI command within the credentials (username and password)? Like... by splunk_user_99 Explorer in Splunk Search 11-25-2019 0 3	0	3
Is this the actual total cost of Splunk? Hello all, I will be contacting the sales team as well but for now I wanted to get some clearer idea of the actual c... by mustafag1 Explorer in Splunk Search 11-25-2019 0 2	0	2