Splunk Search

Community Activity

Two searches but only need to return results of the second search that match the first ok so...I have been banging my head against the wall on this one for a bit. I have tried using join (which I don't an... by RickerNJ New Member in Splunk Search 02-22-2019 0 5	0	5
Dedup search results not showing for a user I have a user that is a doing a search that has \| dedup in it. While I can see the results when I run the search (I'm... by toddhawkins New Member in Splunk Search 02-22-2019 0 4	0	4
help on join command please hi I use the search below index =* sourcetype=* \| dedup host \| stats count This search returns 87 events I try t... by jip31 Motivator in Splunk Search 02-22-2019 0 5	0	5
how to display a 0 result instead an empty result hi I use the search below and I would like to have a 0 results displayed when there is no events corresponding could... by jip31 Motivator in Splunk Search 02-22-2019 0 14	0	14
After integrating Splunk with JIRA, How can I see the list/count of defects created in last 7 days? I have integrated Splunk with JIRA. I want to see the list/count of defects created in last 7 days. I'm picking the c... by cadrija Path Finder in Splunk Search 02-22-2019 0 1	0	1
Search to find indexes with events and display index size, total events , earliest and latest events per index Hi, what would be the best way to find indexes with events and display its size, total events , earliest and latest ... by mlevsh Builder in Splunk Search 02-22-2019 0 4	0	4
Compare current and last one hour event value in same search. Hi All, I have to monitor the queues. And for that I have made the basic dashboard where it shows the details. Detai... by vaibhavvijay9 New Member in Splunk Search 02-22-2019 0 1	0	1
Can you help me create the regex for an Index time field extraction? Hi, We are trying to create an index time field extraction. I tried following the docs, but I am making a mistake so... by MattibergB Path Finder in Splunk Search 02-22-2019 0 3	0	3
Subsearch returns empty value, main search also returns no results , so the returned value from subsearch is not creating eval error index=app_core sourcetype=app_log cluster_name=app1_cluster is_scheduled=1 \| eval [ search index=app_core sourc... by nomadichunters Explorer in Splunk Search 02-21-2019 0 13	0	13
Is Splunk 7.x Fundamentals Part 1 (eLearning) free? I just finished all the modules and the final quiz, my question is Do I have to pay for the certification of "Splunk ... by dunix New Member in Splunk Search 02-21-2019 0 2	0	2
How do you search logs for a letter at a specific position? I'm very new to Splunk and need help with a search. I want to perform a search to show me the results where the 5th... by arthurva Explorer in Splunk Search 02-21-2019 0 3	0	3
Simple Regex in search I have a string of data that includes a field named user that has a value made up of domain\userid (eg prod\3245762 o... by balcv Contributor in Splunk Search 02-21-2019 0 9	0	9
lookup a csv if a field has certain value Good day, I have a lookup file "Mainlookup.csv" that contains an IP address, Mac address and Host name of Clients ma... by mpasha Path Finder in Splunk Search 02-21-2019 0 2	0	2
Replace Null values in xyseries chart Hello, Splunkers I have a search of index=sql \| bucket span=1h _time \| stats count by _time source \| xyseries _time... by essklau Path Finder in Splunk Search 02-21-2019 1 9	1	9
Find who all ran that query during a particular timeframe? I have a query, I want to know who all ran that query during a particular timeframe? Is it possible to know? Can some... by Harishma Communicator in Splunk Search 02-21-2019 0 1	0	1
List of event codes that found in another search Hi, I'm trying to create a query to provide a list of event codes that are found in one period time that is NOT found... by dyeo Engager in Splunk Search 02-21-2019 0 2	0	2
Count the number of users in more than one time bucket as percent of total users I want to count userid that are in more than one bucket. The goal is to see how many users are returning users. I use... by user93 Communicator in Splunk Search 02-21-2019 0 4	0	4
Why does my real-time alert continue to send emails/sms? I have a query for which I've configured a real-time alert when the query returns a result. I'm getting 25 to 35 emai... by blindfire_bandi Explorer in Splunk Search 02-21-2019 0 5	0	5
List all Windows domain members a user is logged in to How might one obtain a list of all the Windows domain members a specific user is currently logged in to? Our domain ... by staten Engager in Splunk Search 02-21-2019 0 0	0	0
Trouble appending columns for a second search Here is the example in the Splunk documentation: specific.server \| stats dc(userID) as totalUsers \| appendcols [ sea... by jlundtristate Engager in Splunk Search 02-21-2019 0 0	0	0
How do you perform a search if today is not the date listed in the lookup .csv file I have lookup file my_dates.csv like this: mydate, something 1/1/2019, sth1 2/12/2019,sth2 2/20/2019,sth 3/13/2019,s... by lucy2019 Explorer in Splunk Search 02-21-2019 0 5	0	5
Why is index=_internal source=license_usage.log returning no data? Running this search from a search head (also tried the indexer) and attempting to breakdown the daily license usage f... by joesrepsol Path Finder in Splunk Search 02-21-2019 0 6	0	6
Is it possible to perform a tstats from an accelerated savedsearch? I am asking because I attempted to use "savedsearch=" as a command after a \| tstats much like calling a "datamodel=" ... by ericg57 Engager in Splunk Search 02-21-2019 0 2	0	2
Upgrade Enterprise Security app to 5.2 - Any specific issues to note Hi All, I am planning to upgrade the Enterprise Security app on our environment from 4.7.0 to 5.2.0. Splunk Enterpri... by santosh_hb Explorer in Splunk Search 02-21-2019 0 9	0	9
Subtotals with Sum Hi, I wonder whether someone can help me please. I've written the following query: `wso2_wmf(RequestCompleted)`deta... by IRHM73 Motivator in Splunk Search 02-21-2019 0 6	0	6