Splunk Search

Community Activity

How can we define -- to be a comment? We would like to set -- to be a comment in SPL. Can we do that and if so what's needed. We are on 7.3. by danielbb Motivator in Splunk Search 08-16-2019 0 5	0	5
How to calculate employee retention from previous month Hello, We are trying to calculate employee retention by the department for the previous month. The challenge is tryi... by lbrhyne Path Finder in Splunk Search 08-16-2019 0 2	0	2
How to build custom charts using Splunk Highcharts I need to develop a custom donut chart using Highcharts API. I came to know that Splunk internally uses Highcharts fo... by ram1042 New Member in Splunk Search 08-16-2019 0 2	0	2
Is it possible to integrate two splunk instances with a single service now instance? I am trying to integrate two splunk instance with a single Service Now module. One SPL instance is an ITSM module and... by ketandessai1992 New Member in Splunk Search 08-16-2019 0 0	0	0
How does a Splunk server decide which IP to use when it connects to a master node? We have two IPs for a single indexer host. We are using this command to add a peer to the indexer cluster: /opt/spl... by alanzchan Path Finder in Splunk Search 08-16-2019 0 1	0	1
Results in percentage Hello fellow Splunkers. I made a query that shows the right results. I would like to show these results in percentage... by KarnN Engager in Splunk Search 08-16-2019 0 5	0	5
help with outputcsv and map commands needed Hello, I desperately search the way to overcome the issue with the map command overwriting the variable values. I ca... by damucka Builder in Splunk Search 08-16-2019 0 5	0	5
licensing question concerning fields from HEC? All, Just curious if "cool-fields" are billed against our license in the example below? curl -k https://hec.doma... by daniel333 Builder in Splunk Search 08-15-2019 0 2	0	2
Convert single and multivalue JSON to table Hi all, I haven't been able to work this out and I was hoping someone can help answer. I am looking to create a tabl... by shierlawa Engager in Splunk Search 08-15-2019 0 7	0	7
Cisco syslog only send console logs even if already set to debugging level. Hello we are having a problem on cisco syslog. We set the syslog level to debugging but we are not receiving anythi... by ygdrassilp Explorer in Splunk Search 08-15-2019 0 0	0	0
what is the best way to enrich events from another search? I have two data sources Source A time action src_ip session user - "action" varies between (logon, logoff and relog... by pwild_splunk Splunk Employee in Splunk Search 08-15-2019 1 4	1	4
chart over multiple counts of string values - single row the events data set looks like this: 2:05:34.067 PM 3DS: auth_validate_success Proceeding with payment authorization... by jerrysplunk88 Explorer in Splunk Search 08-15-2019 0 1	0	1
How to split field into multiple fields for comparison Hello, need help from the experts. My search results (_raw) is this: Event 1 minute ago, vmrit-c4ca0001.lm.lmig... by owie6466 Explorer in Splunk Search 08-15-2019 0 12	0	12
[Search & Reporting] Coodinates Hi, I have a fleet of scotter who are geolocated. My sourcetype is like this: 20190101150909 49.86587 2.32952 NGQ 201... by oxthon New Member in Splunk Search 08-15-2019 0 1	0	1
Splunk extract exact match for a customer name Here is my splunk log line {"line":"2019-08-15T17:48:28.935Z LCS {\"configName\":\"Apple-SQS\",\"customerName\":\"Ap... by balash1979 Path Finder in Splunk Search 08-15-2019 0 2	0	2
distinct first n characters of string Lets say .. My result would produce a.log a.log.1 a.log.2 a.log.3 b.log b.log.1 b.log.2 b.log.3 c.log c.log.1 c.log... by reverse Contributor in Splunk Search 08-15-2019 0 6	0	6
search in the training does not return any results Hi I started the Fundamentals 1 training a couple a weeks ago. I had to stop until today. So I started up by reviewi... by jgmit New Member in Splunk Search 08-15-2019 0 7	0	7
Timechart bug. index="iedss_was_prd" OR index=iedss_mule_prd \| rex field=source "(?P<logType>[^\\\]+)$" \| eval raw_len=len(_raw) ... by reverse Contributor in Splunk Search 08-15-2019 0 13	0	13
Modifying Splunk query to include multiple host from Production and DR app servers without duplicating data I have a dashboard prepared in Splunk Enterprise for Production where input data is coming from one of my application... by kapiljagdishwal New Member in Splunk Search 08-15-2019 0 5	0	5
Multivalued fields in a lookup file I have a csv file like : User_id,emails 375352,foo@foo.com foo@foo.ca foobar@foobar.co.uk 872352,toto@foo.com note: ... by lzaexpert Explorer in Splunk Search 08-15-2019 1 8	1	8
Why count searchmatch return double counts? the events data set looks like this: 2:05:34.067 PM 3DS: auth_validate_success Proceeding with payment authorizatio... by jerrysplunk88 Explorer in Splunk Search 08-15-2019 0 2	0	2
Calculate % of each field as ratio? I have the table: _time Ip_1 Ip_2 Ip_3 a 36 ... by Joycetran New Member in Splunk Search 08-15-2019 0 2	0	2
Using lookup table matches to limit Web datamodel results I have created a lookup table which contains iocs, a subset of which are IPv4 addresses. I am trying to use events f... by adamblock2 Path Finder in Splunk Search 08-15-2019 0 1	0	1
Search criterial I have a search that takes logs from an SSL vpn and shows me failures what I would like to do is put a time frame in ... by andy_macn New Member in Splunk Search 08-15-2019 0 1	0	1
splunk query with sub search not returning the desired results Query is: index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input \| rex ".]*Rpc id :(?[0-9][... by vivek991985 New Member in Splunk Search 08-15-2019 0 3	0	3