Splunk Search

Community Activity

How to use multiple saved searches for a single table Hi, We are using a table in our dashboard and its output is based on multiple saved search. How can I run multiple s... by AKG1_old1 Builder in Splunk Search 06-25-2019 0 2	0	2
Sample command limitations I noticed sample command in Splunk is limited in how many parameters can be used at the same time: https://docs.splun... by cosminstefanmar Explorer in Splunk Search 06-25-2019 2 9	2	9
How to group two field values into separate fields? I am working with data that is shared/backed up by two separate hosts. Each userID is linked to two hosts. When there... by bofasplunkguy Explorer in Splunk Search 06-25-2019 0 0	0	0
Two searches using three indexes with different fields I have this search below: index=BI_1 sourcetype=jobs_info fieldJ IN (Flamengo) \| search index=BI_2 sourcetype=tel_d... by nsantiago17 Explorer in Splunk Search 06-25-2019 0 4	0	4
Testing mmdb file in Splunk is there a command recommendation for risk scoring? I am currently attempting to test the GeoIP2-Anonymous-IP.mmdb file out in Splunk. I know we can either place it in ... by jjoh277 Engager in Splunk Search 06-25-2019 0 0	0	0
Using field option in join command If I get a search like below: index="main" ~~~~~ \| table _time value code \| join type=outer [search index="main" ~~~... by tkdguq0110 Path Finder in Splunk Search 06-25-2019 0 3	0	3
Is there a way to group apps in Splunk deployment? We have started to use the Splunk Deployment within in our infrastructure and I was wondering if there's a way (inclu... by d3ag0s Engager in Splunk Search 06-25-2019 0 2	0	2
Why is "�" character found in field values after uploading CSV file and indexing? Hi, After uploading csv file and indexing, I found out that most, if not all of my special characters becomes "�" wh... by dojiepreji Path Finder in Splunk Search 06-25-2019 0 3	0	3
How to save bracket syntax in a report Hi In my XML file, I use the syntax below which works perfectly \| search SITE=$tok_filtersite\|s$ But I need to... by jip31 Motivator in Splunk Search 06-25-2019 0 5	0	5
Help understanding real time searches Hello everyone, I think I don't fully understand the concept of real-time searches. If I configure a search as a rea... by astatrial Contributor in Splunk Search 06-25-2019 0 6	0	6
How to search for duration between events? Hello, Splunkers friends, I need your support; I have a script running on Splunk once at a day, it brings me passwor... by julian0125 Explorer in Splunk Search 06-25-2019 0 6	0	6
How to add custom start date and end date in splunk query (without the using splunk default date picker) ? Hi, I have to pass a custom 'startdate' and 'enddate' in Splunk query in the search tab (without the help of Splunk d... by sajithpm101 New Member in Splunk Search 06-24-2019 0 11	0	11
How to pass 0 to variable if no search result is found? I have scenario where I want variable (Loss) to be 0 if no result found of below search: \| dbxquery query="SELECT *... by ahmadsaadwarrai Explorer in Splunk Search 06-24-2019 0 1	0	1
How to create a conditional stats search based on a field value? Hi, I am trying to write a conditional stats command based on a field value. So for example: I have a field called ... by ronny_wang Explorer in Splunk Search 06-24-2019 0 4	0	4
Running jQuery on search results Hi, Hoping someone here can help because I've been running into walls on it. I'm trying to insert a link on every tr... by big_nuggets Explorer in Splunk Search 06-24-2019 0 1	0	1
Splunk alert to be triggered based on time of the day My search condition is checking for results less than 10 every 45 minutes. The problem is we don't have that much tra... by anweshar New Member in Splunk Search 06-24-2019 0 3	0	3
How to disable one search peer in cluster? Hello, Splunkers: I have a Cluster that contains 3 indexers and one search head. I want the search head to communic... by TISKAR Builder in Splunk Search 06-24-2019 0 3	0	3
How to sum same field twice I want to be able to sum the same field in order to create 2 different fields so that I can compare the Volume by app... by TylerJVitale Explorer in Splunk Search 06-24-2019 0 1	0	1
Using lookup tables to evaluate multiple conditions We're evaluating using Splunk to identify changes to a system's state (like installed apps, listening ports, ACLs, et... by BHumphrey_Tep New Member in Splunk Search 06-24-2019 0 3	0	3
Unable to nullqueue unnecessary lines without a date I have two lines of events that are unnecessary because there is no date and would like to null queue these out. I h... by babcolee Path Finder in Splunk Search 06-24-2019 0 7	0	7
How to calculate duration difference between events considering regex? Hello, I have the following logs: 2019-05-30 14:39:00,115 traceId=AAAAAA msg=Incoming with body {"parameters":[{"da... by amunag439 Explorer in Splunk Search 06-24-2019 1 3	1	3
How to join two searches? First search: index=A source="FunctionHandler@*" "ul-ctx-caller-span-id"=null With this search, I can get several... by jerrytao Engager in Splunk Search 06-24-2019 0 11	0	11
Concatenating fields in a field transformation We are trying to extract both fields and their names from events that have a variable number of elements. We have det... by wennebo1 Explorer in Splunk Search 06-24-2019 0 7	0	7
How can a row of average hourly event volume be appended to a chart with Fridays' hourly totals and added totals? Here is my attempt at creating a chart of hourly counts for previous Fridays. I have added row and column totals, but... by crisjnelson Explorer in Splunk Search 06-24-2019 0 0	0	0
How to create a search to find the same IP hitting specific URL (x number of times)? Having trouble creating a search that will determine if any single unique IP hits a defined URL 5 or more times withi... by sbhuie New Member in Splunk Search 06-24-2019 0 2	0	2