Splunk Search

Community Activity

How to get a field extraction match up till the first time a string is found? This is the regex I've come up with so far. Unfortunately, it's either matching too much or not enough. I want it to ... by jeck11 Path Finder in Splunk Search 03-14-2019 0 4	0	4
How to lookup and match fields across sources? Hello, I have two sources: 1: Device, SiteName, Long, Lat 2: Device, Clients (Number of current clients) I wish to... by krisalexroberts New Member in Splunk Search 03-14-2019 0 1	0	1
Show IP address while using Geostats and iplocation I created a map showing connections outside the US but when I hover over the markers it only shows the lon and lat. I... by aking76 Path Finder in Splunk Search 03-14-2019 0 0	0	0
How to extract date of the latest event after group by? Hi Team, I am facing issue after using group by clause. (Need date of the grouped event in DD-MM-YYYY ) The search ... by sagar1992 Explorer in Splunk Search 03-14-2019 0 3	0	3
How to merge rows with a common field? Hello, I have 1 single table that comes from two different searches/indexes/sourcetypes using append. I need to join... by ndaniel88 Explorer in Splunk Search 03-14-2019 0 6	0	6
Javascript tooltip showing results of a CSV lookup Hi all, we do have a table showing (besides other information) HTTP status codes. I'm trying to implement a tooltip ... by alai Explorer in Splunk Search 03-14-2019 0 7	0	7
Regex, and extracting the IP + hostname from _internal One of my ongoing gripes with splunk is that there is no way to see the IP and the hostname -- either my forwarder se... by oliverj Communicator in Splunk Search 03-14-2019 0 4	0	4
How to use round function in appendpipe? This search works well and gives me the results I want as shown below: index="index1" sourcetype="source_type1" resp... by JarrettM Path Finder in Splunk Search 03-14-2019 0 2	0	2
Why is basic eval not returning results? Hello I dont understand why: index="x" sourcetype="wmi:BatteryFull" OR sourcetype="wmi:BatteryStatic" \| dedu... by jip31 Motivator in Splunk Search 03-14-2019 0 11	0	11
Why are user details missing in the splunk logs? Hello All, I have an ongoing issue with my Splunk environment. Actually an user "Alex" have added remote desktop use... by mailmetoramu Explorer in Splunk Search 03-14-2019 0 8	0	8
How to find common errors in different log files? In my environment I got one scenario like have to find common errors in iis log, applog,apache log and db log. How to... by Reddi694325 Path Finder in Splunk Search 03-14-2019 0 3	0	3
Why is the search bringing "-" account results for event 4625? Hi, This is the search that we are using for the dashboard and it brings all events with value "-". index=wineventl... by sjimenezp New Member in Splunk Search 03-14-2019 0 2	0	2
How to create a search for the fields using regex? Hello, I have the following string pattern (source): /trace/DB_BWP/xsengine_ls5925.30246.crashdump.20190312-213001.... by damucka Builder in Splunk Search 03-14-2019 0 2	0	2
How to match search with KV lookup files? Hello, I have a KV file that is auto generated with username using a script running every hour. I want to match the u... by kiranpatil1985 New Member in Splunk Search 03-13-2019 0 2	0	2
How to update lookup using macro? When I want to update lookup using search like below, it updates lookup table even if there is no results, but I want... by yutaka1005 Builder in Splunk Search 03-13-2019 0 4	0	4
Alter the width of single value panel How to resize the width of single value dashboard panels in case if I have only one column in a row, instead of makin... by gokool2u Explorer in Splunk Search 03-13-2019 0 7	0	7
Is there any other way other than the Lookup Editor to edit and manage lookup files? Hello All, I was wondering if there's a way to manage lookup files in Splunk. What I want to do is to create/upload... by jvmerilla Path Finder in Splunk Search 03-13-2019 0 1	0	1
How to identify and correlate events that happened before a specific event I have an "interesting event," how can I find an event meeting specific criteria that happened before my interesting ... by JWBailey Communicator in Splunk Search 03-13-2019 0 2	0	2
How to do multiline field extraction with delimited regex? Hello Splunk Folks ! Currently I am experiencing Splunk as student, and I'm having a hard time with some mail logs, ... by feldunost Engager in Splunk Search 03-13-2019 0 13	0	13
How do I append a specific field with specific values an counts to "no results" search results? I've read about the many ways to have a dashboard panel show something other than "No results found", but none of the... by williamcharlton Path Finder in Splunk Search 03-13-2019 0 9	0	9
How to visualize count of messages between .. and .. MB, .. and .. MB etc.? Hi, i want to see how many messages are send, which are between 0 and 1 mb, between 1MB and 2MB, 2 and 3 etc, but I ... by svester New Member in Splunk Search 03-13-2019 0 3	0	3
How to show the top command with distinct value? I've got proxy logs and I want to show the top 5 urls and for that the count of distinct users who tried to access i... by igschloessl Explorer in Splunk Search 03-13-2019 1 2	1	2
How to retrieve names from comments and assign values to those names? Hi, We have closed cases and escalated cases,in that single person can work on particular case as well as multiple p... by ramesh12345 Explorer in Splunk Search 03-13-2019 0 3	0	3
Understanding command in search Hello everyone, I need help understanding the search command. I tried to read documents and still did not understand.... by davidsplunk100 New Member in Splunk Search 03-13-2019 0 3	0	3
Query execution time Hello, When searching through Splunk the following request: index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY ... by benji00 New Member in Splunk Search 03-13-2019 0 2	0	2