Splunk Search

Community Activity

	Looking to query a domain account and find out the device it is logged into or running on I wrote a simple query to parse my Windows Event Security logs to look for a user account, however I am looking to ad... by Sotu Engager in Splunk Search 05-01-2024 0 2	0	2
	Search for non ascii characters Is there any way to search for events which has any special characters? thanks in advance for any help. by bhupalbobbadi Path Finder in Splunk Search 05-01-2024 0 4	0	4
	Does SOURCE_KEY have the same limitations as EXTRACT I'm working with a field named Match_Details.match.properties.user. It contains domain\user information that I'm try... by jwhughes58 Contributor in Splunk Search 04-30-2024 0 2	0	2
	Permissions issue Executable for Splunk App Hi,I am facing a executable permission issue for the few scripts for a splunk app and seeing these errors on various ... by Roy_9 Motivator in Splunk Search 04-30-2024 0 5	0	5
	Splunk queries Hi all,A query, can calculate http calls, success responses and error response. I need an addition to the query to g... by saidAb Explorer in Splunk Search 04-30-2024 0 10	0	10
	role problem Hello, I'm having problems using roles.I use this search, which gives me results via the admin role. [search index="... by anissabnk Path Finder in Splunk Search 04-30-2024 0 1	0	1
	Splunk alret Hello everyone,I am looking for a Splunk search query to get the duration time of three sequential response code 200.... by saidAb Explorer in Splunk Search 04-30-2024 0 9	0	9
	Using regex to extract summary in raw data I have portion that I would like to use in report. "changes":{"description":{"before":"<some text or empt... by bigll Path Finder in Splunk Search 04-30-2024 0 4	0	4
	Extract data from 2 different logs Hello community!I want to extract data from 2 different logs like bellow:Log 1: 2024-04-28 06:38:51 INFO Start auth f... by chimuru84 Path Finder in Splunk Search 04-30-2024 0 3	0	3
	extract a name from file location Hi,How do I extract word "Dev" from below file locationsource=/test1/folder1/scripts/monitor/log/env/dev/Error.logand... by guru333 Engager in Splunk Search 04-30-2024 0 7	0	7
	Searching on a specific field in JSON This is probably an entry level question. I have raw data that looks something like this:{"id": 99999, "type": "HOST... by fredsnertz Observer in Splunk Search 04-29-2024 0 2	0	2
	How do I verify if splunk forwarder dropping event from the queue? Splunkd log _internal. In my index I don't see all the logs being forwarder by the Splunk UF. How can monitor when event is drop from event ... by abi2023 Path Finder in Splunk Search 04-29-2024 0 1	0	1
	transaction startswith from a lookup file Hello I have the following sample log lines from a splunk search query line1 line2 line3: field1 : some msg line4 l... by MVK1 Path Finder in Splunk Search 04-29-2024 0 7	0	7
	How to check empty values in coalesce? Hi All,I have a field called File1 and File2 and I combined in coalesce .In the table but the value is not getting i... by karthi2809 Builder in Splunk Search 04-29-2024 0 7	0	7
	Alternative to join, correlating TOP 1 matches from second search? Hi,I have a background with T-SQL and reading the forums I start to realize that "join" is not so good to use with Sp... by dannepannesthlm Explorer in Splunk Search 04-29-2024 0 8	0	8
	Difficulty Locating Newly Added Calculated Field (Eval) Hello,I recently encountered an issue with Splunk Cloud. After creating a new eval in the "Fields" menu under "calcul... by Ismail_BSA Path Finder in Splunk Search 04-29-2024 0 2	0	2
	Alert set for count in range Hi Team,I am trying to setup an alert if the count of errors are in range of between 10 to19(more then 10 and less t... by cbiraris Path Finder in Splunk Search 04-29-2024 0 2	0	2
	How to create a filter on the field fetch using REX? Hi Can someone help me to find a way to create a Dropdown Input on the field which is extracted using a REX command.E... by Real_captain Path Finder in Splunk Search 04-29-2024 0 3	0	3
	count(eval(execution-time)>1000) not working when I run below query I am not able to get the sla_violation_count index=* execution-time=* uri="v1/validatetoken" ... by VamshiBavu Engager in Splunk Search 04-29-2024 0 3	0	3
	service status of a service including Disaster Recovery situation Just in a situation where I have 2 servers, where 1 is active and the other is passive. I had to deploy the TA on bot... by ashraf_sj Explorer in Splunk Search 04-29-2024 0 2	0	2
	Comparing an incidents event timestamp to Splunk landing timestamp I would like some help creating a report that will show the seconds diff between my event timestamp and the Splunk la... by auzark Communicator in Splunk Search 04-28-2024 0 5	0	5
	How to get SharePoint excel files in to Splunk? Hi What is the best practice to get the SharePoint excel files, which will be added every week to get in to Splunk a... by kiran331 Builder in Splunk Search 04-28-2024 0 3	0	3
	group threefields and get the latest timestamp record and retrieve additional column value corresponding to that group HiI have a vast data set with a sample as below. Need to group the data based on three columns latest timestamp data ... by NathanAsh Path Finder in Splunk Search 04-28-2024 0 10	0	10
	How to compare same fields from different events to find past occurrence Editing to make it better:Let's say I have login events with 2 important fields: past_deviceid, new_deviceidI want to... by Josh1890 Explorer in Splunk Search 04-27-2024 0 10	0	10
	Include literal dataset in search query / Ensure fixed number of rows in result set Anyone know how to accomplish the Splunk equivalent of the following SQL? SELECT * FROM (SELECT 'dev' AS env, 0 as va... by trevorreed Explorer in Splunk Search 04-26-2024 0 2	0	2

Get Updates on the Splunk Community!

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Splunk Search

Looking to query a domain account and find out the device it is logged into or running on

Search for non ascii characters

Does SOURCE_KEY have the same limitations as EXTRACT

Permissions issue Executable for Splunk App

Splunk queries

role problem

Splunk alret

Using regex to extract summary

Extract data from 2 different logs

extract a name from file location

Searching on a specific field in JSON

How do I verify if splunk forwarder dropping event from the queue? Splunkd log _internal.

transaction startswith from a lookup file

How to check empty values in coalesce?

Alternative to join, correlating TOP 1 matches from second search?

Difficulty Locating Newly Added Calculated Field (Eval)

Alert set for count in range

How to create a filter on the field fetch using REX?

count(eval(execution-time)>1000) not working

service status of a service including Disaster Recovery situation

Comparing an incidents event timestamp to Splunk landing timestamp

How to get SharePoint excel files in to Splunk?

group threefields and get the latest timestamp record and retrieve additional column value corresponding to that group

How to compare same fields from different events to find past occurrence

Include literal dataset in search query / Ensure fixed number of rows in result set

Quick connection discovery mode for forwarders

Build and Launch AI Agents from Your Splunk Workflows

Splunk Cloud Application Management in Terraform

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation