Splunk Search

Community Activity

How to create a lookup search for matching 2 fields? I have 2 devices: fw and waf. I want to make a lookup, my lookup file is mal_ip that has 4 fields : mal_ip category ... by badoomi New Member in Splunk Search 06-17-2019 0 7	0	7
Ironport: How to get all 'from' emails for specific user Hello, I am trying to run a search to get the "Email_From_Address" of a specific user within ironport. Can someone ... by cosmo360 New Member in Splunk Search 06-17-2019 0 2	0	2
Why are we only able to extract the first value of a comma separated list for a given field? Hi, (In Splunk) I am only able to extract the first value of a comma-separated list for a given field in which the f... by varunawasthi9 New Member in Splunk Search 06-17-2019 0 5	0	5
How to get eval values from two fields My current search is this: index="x \| timechart count(eval(statusCategory="B")) I want to add one more statusCate... by rashi83 Path Finder in Splunk Search 06-17-2019 0 8	0	8
_txn_orphan field missing from transaction command after upgrade Just upgraded SH from 7.0.2 to 7.2.5.1 (indexers still in progress) and some reports which rely on _txn_orphan broke.... by eugenek Path Finder in Splunk Search 06-17-2019 0 2	0	2
How to extract HTTP status codes in report? Hi, I know how to extract the HTTP Status from Splunk. But I need it in the below format which I am not able to do: ... by ruchijain New Member in Splunk Search 06-17-2019 0 3	0	3
How to swap X and Y axis? I have an area chart with Time_Taken on the x axis and count on the y axis and I want them to be switched, please hel... by bryceweb22 Path Finder in Splunk Search 06-17-2019 0 5	0	5
show top 5 values in column chart Hello im trying to show top 5 values in column chart this is my query: index="ssys_*_fdm" pauseReason: NOT "pauseRe... by sarit_s Communicator in Splunk Search 06-17-2019 0 21	0	21
Command to display percentage increase in stats count Hi, Is there a way of showing the percentage increase or decrease from the command: "stats count as daycount by date... by colinmchugo Explorer in Splunk Search 06-17-2019 0 4	0	4
Splunk.intersplunk: Receiving error "could not locate the time (_time) field..." How come I can't locate the time (_time) field on some results returned from the external search command? Hi, I use... by santosm New Member in Splunk Search 06-17-2019 0 1	0	1
How can gaps be detected in data? Hello, is there a way to detect gaps in data by some id? As well as check if the gap is greater than 4 hours, then s... by sarit_s Communicator in Splunk Search 06-17-2019 1 40	1	40
Why it doesn't work ? 2 searchs joined and two different counters I want to do this but it doesn't work, why ? How can I fix this ? index=xxxx eventtype="perfmon_windows" objec... by henriq_c Explorer in Splunk Search 06-17-2019 0 6	0	6
How to join searches based on condition? I have two searches : Duration for which a device uses the system index=device \| fields device_start_time,device_end... by AnujaJ Path Finder in Splunk Search 06-17-2019 0 2	0	2
In a text field, am I able to detect if a user entered an IP Address or a HostName? Hi, In a text field, I would like to be able to detect if a user entered an IP Address or a HostName. At the moment,... by baty0 Explorer in Splunk Search 06-17-2019 0 1	0	1
Need where clause query to be implemented on specific value Hi, If anyone can help. Below is my table which represents volume (count) Country wise. But I want to apply filter li... by sahil237888 Path Finder in Splunk Search 06-17-2019 0 5	0	5
Generate value of a field corresponding to duplicate value of other field I have 3 columns in my data. Minutes Store_ID 10 81165 20 80234 30 81165 40 80234 50 82345 I wish to g... by nikita012 New Member in Splunk Search 06-17-2019 0 1	0	1
help for displaying a message in case of any results I use the search below which works fine I just have an issue when there is no results In this case, I would like to d... by jip31 Motivator in Splunk Search 06-16-2019 0 5	0	5
After Zoom in splunk map not showing the piechart ! Before zoom in, I get the correct result. After zooming in I don't get the proper result. If we further zoom in... by ajitshukla61116 Path Finder in Splunk Search 06-16-2019 0 4	0	4
Why is Appending two search queries with different conditions giving me the same results? I have two survey types "a" and "b" and there are two details need to be displayed as 'a%' (For all kind of "Data") ... by monyathomas New Member in Splunk Search 06-16-2019 0 2	0	2
How do i reference columns that have been displayed as a result of previous chart command I have done a chart command --> chart count over "Survey Month" by "Survey Type" and the result displays the two su... by monyathomas New Member in Splunk Search 06-16-2019 0 5	0	5
Extract fields from JSON array We are moving log from AWS infrastructure to Splunk index via SQS service, but somehow JSON formatted logs breaking w... by rups260386 New Member in Splunk Search 06-16-2019 0 4	0	4
Remove events from search that match comma-separated text input Running Splunk Enterprise 7.3 I am using a text input box to get a list of values from the user to exclude from my se... by noahdietrich Explorer in Splunk Search 06-16-2019 0 1	0	1
Creating multiple fields by extracting values from single field Hi, I have a field name Family. This field contain names of husband and wife in below Figure 1 format: All values ... by mbasharat Builder in Splunk Search 06-16-2019 0 3	0	3
How to create a subsearch with multiple results? Hi, I've a question about sub search, I'm probably misunderstanding docs and other posts. This is my search: index... by trucall New Member in Splunk Search 06-15-2019 0 7	0	7
Percentage on field summary values Hello, I am trying to do percentage on fieldsummary values , following is the query and results for the query - inde... by msrama5 Explorer in Splunk Search 06-15-2019 0 1	0	1