Splunk Search

Community Activity

eventtype which contains macro is not working Hi Splunkers, I have distributed environment. when I tried searching for eventtype which contains macro is not worki... by thambisetty SplunkTrust in Splunk Search 09-23-2019 1 8	1	8
How to add multiple fields count values Hello, I have 6 fields that I would like to count and then add all the count values together. For example I have S... by cooperjaram Engager in Splunk Search 09-23-2019 0 7	0	7
Can we make a search id persistent Dear Team, We want to make a search id persistent in splunk can we do that? by using the search id we want to run th... by santosh11 New Member in Splunk Search 09-23-2019 0 0	0	0
Alternative for join. index=core a=BuilderService AND "decision.received" "Overrides" NOT "ItemOverrides=()" NOT commitCode=null \| rename ... by sandeepmakkena Contributor in Splunk Search 09-23-2019 0 3	0	3
How to calculate time difference between two identical events I have the following events **2019-09-20 01:39:25 INFO Listener processing event with message metal:AUD:ADJ 2019-09... by peeeeeeeeeeter Engager in Splunk Search 09-23-2019 0 5	0	5
Extract fields from array of data and find best performing currency. SSP Request: {<!-- --> "disableAMLFlag" = "false"; "orderAttributes" = {<!-- --> "OrderAttributes" = {<!-- --> "requestPostalIn... by sandeepmakkena Contributor in Splunk Search 09-23-2019 0 0	0	0
How to find values that are not in a summary index Good day, I have sysmon information collected in an index called sysmon. I also have created a summary index "HASh256... by mpasha Path Finder in Splunk Search 09-23-2019 0 1	0	1
How to calculate state based on values from many searches I'm using a dashboard to display the state of some services. For this purpose, I must takes single values from many s... by prsepulv Explorer in Splunk Search 09-23-2019 0 5	0	5
How do we invoke a sub search with parameters from the parent search? We have a parent search that looks like - index=os_linux * \| eval length = len(process) \| where length = 7 \| sea... by danielbb Motivator in Splunk Search 09-23-2019 0 6	0	6
Force python3 on custom commands Hi all, I´ve a custom command but it requieres python3 for launch properly. Errors on job inspector: 09-17-2019 13:... by cpm003 Path Finder in Splunk Search 09-23-2019 0 4	0	4
How to compare output of a search to a lookup file? Hello, I have a lookup filled with hostnames. I want to compare the hostnames with the host field in the index. If... by mkamal18 New Member in Splunk Search 09-23-2019 0 3	0	3
How can I set timechart span=2h count for a day to start plotting from midnight? Hi, Could anyone know how to start plotting from midnight when time range is something like earliest=-1d@d latest=@d... by melonman Motivator in Splunk Search 09-23-2019 2 5	2	5
Help creating a search that involves an IF statement and JOIN There are three different events. Each event has the same fields. The fields I am focusing are "NumberOfRecords" and ... by tyhopping1 Engager in Splunk Search 09-23-2019 0 2	0	2
Help putting a condition match for a search with three possible results to show/hide either both or one of two panels I'm trying to either hide or show two panels depending on a search result from a different panel which will have 3 op... by jaffar20 Explorer in Splunk Search 09-23-2019 0 1	0	1
Search not giving correct results (Join,Append,Union) Hello All, I am working the below search - When I am running these two main which joined using join command are givi... by punyanit Path Finder in Splunk Search 09-23-2019 0 8	0	8
How to speed up my search? I am trying to show the count of events where any external IP is attempting to connect to port 136-139, 445 from diff... by bayman Path Finder in Splunk Search 09-23-2019 0 9	0	9
Timechart not displaying for some selections despite having results. It's invisible for some reason, but shows when it edit mode I have a timechart dependent on a dropdown at the top of the dashboard that selects the customer to show the results ... by jaffar20 Explorer in Splunk Search 09-23-2019 0 2	0	2
How to get sum of field based on it's value? Hi, I would be grateful for any help. In my fields we are having two fields which are: data.user_id and data.confi... by swdowiarz Path Finder in Splunk Search 09-23-2019 0 6	0	6
Time difference by grouping identical events Suppose I have the following events. 2019-09-20 01:40:09 INFO Listener processing event with message key A1:B1:C1... by peeeeeeeeeeter Engager in Splunk Search 09-23-2019 0 1	0	1
Field extract and zip them. (product=X Phone , 512 ГБ, золотой,shipMethodCode=E3,qty=1,deliveryType=STH,partNumber=MRU/A,deliveryDate=4 Окт - 11 ... by sandeepmakkena Contributor in Splunk Search 09-22-2019 0 4	0	4
Append the columns of a search onto the results of another search many times [lookup, but for a search] Search A returns many events for each ID. Search B returns a single event for each ID. My end result is a table wit... by ccunov New Member in Splunk Search 09-22-2019 0 6	0	6
Find the date on max value I have a table below, how can I find the date I have the most income? Thanks. date Income 9/18/2019 20... by jgan New Member in Splunk Search 09-22-2019 0 2	0	2
custom generating command 'Command xxx appears to be statically configured for search command protocol version 1' I am attempting to use custom generating command protocol version 2, but my command seems to be detected as version 1... by pmeyerson Path Finder in Splunk Search 09-21-2019 0 0	0	0
eval, if, len, substr to produce specific results So far, I've had success with the following command: eval Port=if(len(Port)>=22,substr(Port,1,len(Port)-2),Port) ... by noob4now New Member in Splunk Search 09-21-2019 0 1	0	1
Account Lockouts Report for Active Directory Hello, I'm running the following search that gives me accounts that get locked out and targets the specific domain c... by brookshelpdesk Engager in Splunk Search 09-20-2019 0 3	0	3