Splunk Search

Community Activity

How to identify the hosts (Primary or Secondary) that have stopped reporting to Splunk using lookup table All,I am looking for a solution to identify the hosts that have stopped reporting to Splunk using lookup table. Howev... by gauravu_14 Explorer in Splunk Search 03-30-2024 0 3	0	3
Calculating data throughput for cloud I'm trying to calculate the data throughput for a cloud computing solution that will be charging based on outgoing da... by taijusoup64 Loves-to-Learn Lots in Splunk Search 03-30-2024 0 3	0	3
How to generate output/report from unstructured log records in splunk Hi,I have following log data that are in splunk. Below is example data taken from splunk:2024-02-04T00:15:15.209Z [jf... by RS Engager in Splunk Search 03-30-2024 0 7	0	7
splunk search lookup help Hello,I have a splunk query returning my search results index="demo1" source="demo2" \| rex field=_raw "id_num \{ dat... by MVK1 Path Finder in Splunk Search 03-29-2024 0 14	0	14
How to list _key value pairs for all entities in ITSI ? Hello all ! Can anyone help me in editing the below SPL so it can only list the _key - value paris for the entities ?... by Suara Explorer in Splunk Search 03-29-2024 0 2	0	2
How to break out a column and append it to the bottom of another column? From the Subject Title, what I mean is it will increase the row count and decrease the column count - that is my inte... by ClubMed Path Finder in Splunk Search 03-29-2024 0 2	0	2
Query to return events when all the objects of an array where a field value is equal to a certain value I need help with a splunk query to return events where an array of object contains certain value for a key in all th... by rajesh143rs Engager in Splunk Search 03-28-2024 0 5	0	5
Facing issue while extracting required fields and while using mvexpand command Hi Team,The below is the event which we have received into the splunk,Dataframe row : {"_c0":{"0":"{","1":" \"0\": {"... by Renunaren Loves-to-Learn Everything in Splunk Search 03-28-2024 0 7	0	7
cron schedule we are trying to set up a cron schedule on alert to run only on weekends(sat and sun) at 6am, 12pm, 8pm , 10pmi tired... by mahesh27 Communicator in Splunk Search 03-28-2024 0 3	0	3
fillnull for all the field names with a pattern I need to use fillnull command but I don't have the exact field names before hand. All my fields starts (which I want... by asingla Communicator in Splunk Search 03-28-2024 1 3	1	3
Facing Issue with Extraction of fields using rex Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"EN... by Renunaren Loves-to-Learn Everything in Splunk Search 03-28-2024 0 2	0	2
eval returns a field rather than a scalar When I do this search: index="mydata" \| eval mymean=avg(floatnumbers) \| table floatnumbers,mymean mymean just mimics ... by riley_lewis Loves-to-Learn Lots in Splunk Search 03-28-2024 0 1	0	1
Compare values in two different json objects Hello, This question has probably been asked and answered, but I just can't seem to find a best solution. So, in the ... by barosan007 Explorer in Splunk Search 03-28-2024 0 4	0	4
Having issue with multiple events in tier3 Hello team, I am facing an issue with multiple events getting merged as a single event in tier 3. I do not have this ... by srinivas_gowda Path Finder in Splunk Search 03-28-2024 0 1	0	1
Filter Particar results from Macros Below query i am using to get the list of all indexes\| eventcount summarize=false index=* \| dedup index \| fields inde... by alex4 Loves-to-Learn Lots in Splunk Search 03-28-2024 0 1	0	1
Pulling out duplicates from multivalue fields and counting I'm trying to achieve the following and hoped someone could help?I have a multivalue field that contains values that ... by steve_b_88 Engager in Splunk Search 03-28-2024 0 3	0	3
Need a Help with Query I have two lookups, 1 with 460K rows and another with 10K rows. I used join to get the 10K results from 460K rows, ho... by satyaallaparthi Communicator in Splunk Search 03-27-2024 0 3	0	3
Subsearch I have two SPL#1 index=index1 service IN (22, 53, 80, 8080) \| table src_ip #2 index=index2 dev_ip IN ( value from #1... by bigll Path Finder in Splunk Search 03-27-2024 0 4	0	4
Regex in Playbook I have required where the CEF comes as URL and I need just a part of the URL to pass as input(ARTIFACT.CEF.URL) to ac... by chandraprathi Explorer in Splunk Search 03-27-2024 0 5	0	5
Filtering out events based on common field and collecting wildcard sub-fields I'm trying to achieve the following search and hoped others might have some helpful suggestions?I have two events fro... by ms2151077 Engager in Splunk Search 03-27-2024 0 2	0	2
problem with join this is the query, so i'm still a baby in this world (so I'm sorry if there is a dummy mistakes that might drive you ... by Mahmoud Engager in Splunk Search 03-27-2024 0 1	0	1
How can I get regex to over ride the host value with another field value from an interesting field? Hi All, Need a help in regex for doing the host over ride with dvc_host field value from the interesting fields for a... by Hemnaath Motivator in Splunk Search 03-26-2024 0 31	0	31
Cron schedule We have an alert where the cron schedule runs for every 6hours0 /6 * *but I don’t want to receive the alert at 6pm... by Ash1 Communicator in Splunk Search 03-26-2024 0 6	0	6
Eval error via REST API Hi, I'm receiving the following error message: Error in 'EvalCommand': Failed to parse the provided arguments. Usage... by naorbarlev Engager in Splunk Search 03-26-2024 0 13	0	13
How to calculate the average based on fields. Hello I think this should be simple enough but somehow I am not able to understand how to approach it. Here is the s... by theouhuios Motivator in Splunk Search 03-26-2024 0 5	0	5