Splunk Search

Discussions

Thread Info

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

We are discussing the subsearch_max configuration setting in limits.conf internally and trying to better understand t...

by Path Finder in

Substring only the displayed data

The goal here is to let the search filter on the full values but only return a portion (substring) of the "Message" f...

by Engager in

How do I find out Splunk API query row count?

I am using Python API call to get Splunk data. I was running to a limit where I was hitting a limit of 50k. I saw thi...

by Communicator in

Searching for a string from one sourcetype in another sourcetype which is present as a list

Hi All, I have two source type , for example. 1) sourcetype 1 2) sourcetype 2 In sourcetype 1 I have a str...

by Explorer in

Is it possible to write switch case statements in Splunk like other programming languages?

Hi , Can it be possible to write switch case statements in Splunk like other programming languages? If so, can yo...

by Explorer in

Joining two searches

Hi , I want to join two searches without using Join command ? I don't want to use join command for optimization is...

by Explorer in

How do you make a regex expression to capture everything after the timestamp?

Hello, Cannot crack this one. I have the following event: Fri Oct 26 07:19:41 2018 STATS: GATHER_STATS_JOB enco...

by Path Finder in

How do you use a variation of the stats command on different fields?

I have 3 fields: IPAddress, ServiceStatus, BackupStatus. ServiceStatus field consists of "Services Fine", "Service...

by Engager in

How do you calculate the average across columns in a table?

Hello Splunkers I tried a few of the suggested solutions, but none of them got me where I need to be, so i'm aski...

by Path Finder in

Is there a possibility in splunk to pull records by one field ( uniqueID) and generate a report with custom fields?

I would like to get a report based on a unique customer id. Is there an option in splunk to generate this Query b...

by New Member in

How do you create a transaction out of a 500 error?

Hi, I want to create a single transaction out of a 500 error and a specific type of error thrown immediately after th...

by New Member in

How do you find a search that finds open windows locked-screen sessions?

Trying to figure out a string to find open windows locked-screen sessions Monitored all security events when doing...

by Path Finder in

How do you combine one REST search with one of the _internal license_usage.log?

The REST search | REST /services/data/indexes | search NOT title=_* NOT title=splunklogger NOT title=firedalerts ...

by Motivator in

Can you help me with my multi-field field extraction query?

I have a field in an event that contains a number of separate individual fields. What would be the most efficient way...

by Communicator in

Which is the best approach to use with an eval+case+wildcard+chart by 2 fields?

I've read as many examples as I can and I still can't figure out how to get this to work. We are using 6.6.2. I am...

by Loves-to-Learn Lots in

Limit for chart with split-by clause ?

Hi, i have this search: index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by appl...

by Communicator in

Combining events into one

We're experiencing a problem with having indexed data with the default MAX_EVENTS value of 256. While this can be fix...

by Builder in

How do you route windows event logs based on filters on a heavy forwarder?

Hi, We have had this working in the past, but for some reason, now, i am unable to forward filtered events to one ...

by Path Finder in

How to do regex based on commas

I have data like this: 21,enrollmentgroup,19936,40:G6:7Q:G6:89:FG,,nitro - Circle.one10,Phone,11.1.11313,C,10/25/1...

by Contributor in

Is it possible to list the filters of the initial search with the results of a subsearch?

Here is the scenario. I have two indexes (index=AV and index=Packet_Analysis) I use index=AV to find attack sig...

by Builder in

Collect values from syslog logging

Hello, I am new to splunk and have the following question. Below is snippet from a syslog logging. I would like to...

by New Member in

How do I list unique IPs of infected computers per day and then list new IPs from the previous day?

I have a query that looks at SEP logs. index=SEP Sig_String='Attack: Bad Stuff" Remote_IP=10.* | bin _time span=...

by Builder in

What is the best way to pull out IP Addresses from a multivariate field?

Basically, I have a multi value field where each value is a free form piece of text corresponding to dated text entri...

by Path Finder in

How do I get a subtraction of two fields when they share a common value?

I am having three columns in primary_key, service_name , timestamp. I want to get a subtraction of values present ...

by Path Finder in

How to group by month if we have data from.

Hello everyone. Want to display the output only for the time which crosses 18 months (earliest time)

by New Member in

Get Updates on the Splunk Community!

Splunk Search

Discussions

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

Substring only the displayed data

How do I find out Splunk API query row count?

Searching for a string from one sourcetype in another sourcetype which is present as a list

Is it possible to write switch case statements in Splunk like other programming languages?

Joining two searches

How do you make a regex expression to capture everything after the timestamp?

How do you use a variation of the stats command on different fields?

How do you calculate the average across columns in a table?

Is there a possibility in splunk to pull records by one field ( uniqueID) and generate a report with custom fields?

How do you create a transaction out of a 500 error?

How do you find a search that finds open windows locked-screen sessions?

How do you combine one REST search with one of the _internal license_usage.log?

Can you help me with my multi-field field extraction query?

Which is the best approach to use with an eval+case+wildcard+chart by 2 fields?

Limit for chart with split-by clause ?

Combining events into one

How do you route windows event logs based on filters on a heavy forwarder?

How to do regex based on commas

Is it possible to list the filters of the initial search with the results of a subsearch?

Collect values from syslog logging

How do I list unique IPs of infected computers per day and then list new IPs from the previous day?

What is the best way to pull out IP Addresses from a multivariate field?

How do I get a subtraction of two fields when they share a common value?

How to group by month if we have data from.

Build Your First SPL2 App!

Exporting Splunk Apps

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

Splunk DB connect add-on InfluxDB 2.6

openshift_events sourcetype suddenly missing in S...

Issue with StateSpaceForecast from the MLTK app

Notepad++ SPL syntax highlighting

How to splunk api to get statistics in python