Splunk Search

Discussions

Thread Info

How to run a search and retrieve elements from a Splunk API in java

Hi. I am trying to run a search from a Splunk API in java, store the results with fields host, sourcetype, source in ...

by New Member in

How to clear SearchManager results once processed with on('data')

I have a modal dialog that pops up and shows a table of results. When I click OK on that, I do some processing on the...

by SplunkTrust in

Field search needs unnecessary wildcard character *

I am doing search on data coming from fluentd k8s. On top of that data , I wanted to filter on basis of field. ...

by New Member in

Join a search by field across indexes

I have two different indexes, with the common field being username. One index that contains phishing history data...

by Explorer in

Fields extraction from TXT file with fixed position varrying event formats in each line

I need to monitor a text file. Each line in this file is considered an event. There are three different types of even...

by Builder in

How to create static baseline on chart without showing data for baseline

I created a baseline by adding eval field as shown below: | eval BaseLine=1000|fields _time, ResponeTime, BaseLine...

by Communicator in

Help with eval and wildcards

Hi, I'm trying to use eval for hosts, and need to use wildcards. I tried the following, but it's not working. How ...

by Champion in

How to combine multiple queries and then use the final result in one final query?

DON'T GET INTIMIDATED BY THE LENGTH OF THE QUESTION. I'm getting account numbers from the first three queries. I wan...

by Explorer in

group by from fields

I have events similar to these: component, technology, mydate silva, java, 06/20/2019 souza, java, 06/20/2019 silv...

by New Member in

lookup value based on current search results

New to Splunk and having a difficult time returning the correct results. The below query works... meaning that it con...

by Path Finder in

Case and Match do not retrieve the right results

I have the following logs where the output can be from application or database or from third party source. id=1111...

by Explorer in

error in timechart graph

Hi all, We are having trouble regarding a query in which we need to display multiple metric_labels of a host in a sin...

by Explorer in

Two searches with different source and producing results in form of filename in column A and B respectively.

There are 2 searches from 2 different sources that are fetching file name details in column A and B respectively. We...

by New Member in

Not able to generate timechart from a multivalue field

I am getting my input in json format like below, {"message":{"SID":"DEV","TIMESTAMP":1563095600,"PARAMS":[{"PROC_C...

by Communicator in

Feasibility of regex to keep specific events and discard the rest

I want to keep specific events which contains few strings in event but around 30 OR statement I have to write in rege...

by Builder in

Help with eval division calculation

Hey all, I need an eval expression for the below output: _time minutes bminutes 2019-06-01 1349511.54 105472800...

by Path Finder in

whats preventing me to get the desired output

Hi Team, I am not able to get the values for SLA Time and time_diff_epoch. when i am running two queirs indvidu...

by Explorer in

CWE-610, CWE-918 vulnerabilities?

Hello, my red team just did an engagement against Splunk and among their findings is a SSRF vulnerability and so far,...

by Engager in

Can we include OR/AND operator in a transaction

I have the following log sets, one for success case and one for the failure case Success: id=11111 msg=Begin proce...

by Explorer in

How to use the INPUTLOOKUP command on Splunk Cloud

Hi Everyone, So we are using SPlunk Cloud and I have created a dashboard that searches for the top 100 most reoccurri...

by New Member in

eval if(X,Y,Z) always returns Z whether X matches or not

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/ConditionalFunctions#if.28X.2CY.2CZ.29 I'm tryi...

by Communicator in

Use makemv on all fields

I have quite a bit of single-value fields in my dataset which really should be multi-value fields. They are all forma...

by Path Finder in

Age calculation based on Date

Hi, I have a field in my data that is called "date". This "date" is when a vulnerability was seen the first time. ...

by Builder in

How to rename column values when making a chart

I have a table which has a store_id, a shopper_id. For example (1, 5231). Each store_id corresponds to a the store na...

by Explorer in

How to regex the raw data?

hi all, I am trying to extract field from Splunk "extract more fields" feature, its not showing as the logs in events...

by Path Finder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How to run a search and retrieve elements from a Splunk API in java

How to clear SearchManager results once processed with on('data')

Field search needs unnecessary wildcard character *

Join a search by field across indexes

Fields extraction from TXT file with fixed position varrying event formats in each line

How to create static baseline on chart without showing data for baseline

Help with eval and wildcards

How to combine multiple queries and then use the final result in one final query?

group by from fields

lookup value based on current search results

Case and Match do not retrieve the right results

error in timechart graph

Two searches with different source and producing results in form of filename in column A and B respectively.

Not able to generate timechart from a multivalue field

Feasibility of regex to keep specific events and discard the rest

Help with eval division calculation

whats preventing me to get the desired output

CWE-610, CWE-918 vulnerabilities?

Can we include OR/AND operator in a transaction

How to use the INPUTLOOKUP command on Splunk Cloud

eval if(X,Y,Z) always returns Z whether X matches or not

Use makemv on all fields

Age calculation based on Date

How to rename column values when making a chart

How to regex the raw data?

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

Using splunk-sdk in user-defined functions in Spar...

Verification of SAML assertion using IDP's cert fa...

ジョブを消しても復活する現象について

splunk threat intelligence taxii data

Splunk DB connect add-on InfluxDB 2.6