Splunk Search

Community Activity

How do I extract the status from authentication logs into an action field? Hello! Please let me know how can I extract the status of the authentication from the following logs into an action ... by ysifusuf Engager in Splunk Search 05-29-2019 0 5	0	5
Correctly parsing into fields - Tenable SecurityCenter admin log (props and transforms) We need to ingest an administrative log within Tenable Security Center. Monitoring this log file is not part of the ... by BrianAbbott Explorer in Splunk Search 05-29-2019 0 0	0	0
Percentage correct utilization formula I have a search which gives me a list of calls. Whereby taking only business days and hours in a week- I need to tak... by splunkuseradmin Path Finder in Splunk Search 05-29-2019 0 1	0	1
Why are searches using certain fieldnames so slow? In most cases, I don't notice a huge difference when I specify a fieldname or do a free text search, but for some fie... by john_byun Path Finder in Splunk Search 05-29-2019 0 2	0	2
dynamic url for webscrape command @LukeMurphey It seem I can't inject an eval value to the url of a webscrape command as the latter needs to be the fir... by thomasdose Engager in Splunk Search 05-29-2019 0 0	0	0
Windows Event: How to get the complete event show up so it can be extracted? I created a Field Extraction and can see it on the list of Field Extractions. How do I add it to the Fields in a sea... by jcolon68 Explorer in Splunk Search 05-29-2019 0 2	0	2
How to ignore case sensitive input in lookup files? Hi, I have created a lookup file with the 10 rows in my splunk search. But while i'm using the lookup facing lot of ... by greeshmak Explorer in Splunk Search 05-29-2019 1 7	1	7
How to create a time chart with the percentage difference between two searches over time? In the search below I have appended two identical searches that are 1 week apart. I would like to find the differenc... by pr0n Explorer in Splunk Search 05-29-2019 0 5	0	5
How to make a GET request and fetch SID? Hi I am new to Splunk, I have created an Angular service that makes a get request to Splunk, I have a search and I... by ssharm02 Explorer in Splunk Search 05-29-2019 0 0	0	0
Add Custom tabs to the Configuration panel of an app created using splunk Add-On Builder I'm working on an app for which I need to have a configurable account in the Configurations panel. It needs to be sim... by yogesh9535 New Member in Splunk Search 05-29-2019 0 0	0	0
How extract dynamic json keys recursively and condition based add data to table? Hi, I am new to Splunk and I have been trying to generate report table format using json data, I am able to spath an... by pradiprwt New Member in Splunk Search 05-29-2019 0 1	0	1
Why are we unable to find any results when running the transaction command? Hi, I have ingested a ticket dump csv file. Transaction ID is one of the fields. Unable to find any events when I ru... by asm_coe Explorer in Splunk Search 05-29-2019 0 1	0	1
How to split a column into multiple columns? Hi, I have a table that looks like this: name \| count score1and2 \| 1 score1 \| 2 score2 \| 2 missed1and... by dojiepreji Path Finder in Splunk Search 05-29-2019 0 1	0	1
My 2nd indexer in Join case is giving only the latest values where I require value Matching with Time and 1st index Hi I created a join search for my environment where my 1st index is for my IPS and 2nd Index is for DHCP. DHCP inde... by hosniadnan New Member in Splunk Search 05-29-2019 0 0	0	0
How to join the result of an inputlookup and the output of a search? I have the following inputlookup \| inputlookup ad_identities \|search sAMAccountName=unetho \|table sAMAccountName, di... by kemnean2001 New Member in Splunk Search 05-29-2019 0 2	0	2
Is there setting to always enable auto_pause option? In 2010, the following Answers refered that there isn't a setting to always enable the auto_pause option, and that it... by yutaka1005 Builder in Splunk Search 05-29-2019 0 4	0	4
Disabling Splunk Sources Hi, I am trying to disable certain sources (using buttons) such that if they are taking using too much data they can... by jwtracey New Member in Splunk Search 05-29-2019 0 0	0	0
Help with search Hi everyone! I have this serach: index=_internal [set_local_host] source=license_usage.log type="Usage" \| eval h=i... by amirarsalan Explorer in Splunk Search 05-29-2019 0 13	0	13
Bluecoat proxy query Hello. I'm trying to create a query that will show total traffic to a url. Showing total traffic by top users per d... by shandman Path Finder in Splunk Search 05-29-2019 0 1	0	1
How to add a search bar in a column of a table in splunk dashboard? Hi All, Hope you are doing well. I created a table with a stats command which gives me a the avg of cpu and memory... by niks987 Explorer in Splunk Search 05-28-2019 0 10	0	10
Why are we unable to evaluate a field obtained from rex? Using below query: index="incident" sourcetype="csv" \| rex max_match=0 "(?(?i)(order))" \| stats count by classifica... by nilbak1 Communicator in Splunk Search 05-28-2019 0 8	0	8
How to sort columns values(Desc) for a column chart in decreasing order? Hello, I wanna know if it's possible to sort columns in decreasing order in a column chart. Thanks in advance for y... by rahhali22 New Member in Splunk Search 05-28-2019 0 13	0	13
How do you table multiple interesting fields values side by side? I would like to create a table that shows a list of all computers that have specific apps installed and those that do... by talaveralino New Member in Splunk Search 05-28-2019 0 3	0	3
How do I extract fields with Rex? Hello I have these events : copy and upload completed for day: 2019-05-27 Tue May 28 12:24:40 UTC 2019 going to cop... by sarit_s Communicator in Splunk Search 05-28-2019 0 14	0	14
Does using dedup improve performance? And where to place it in search? I just finished the Splunk Fundamentals 1 course and in one of the videos they said: For best performance we place... by kamryn Explorer in Splunk Search 05-28-2019 1 1	1	1