Splunk Search

Community Activity

how to map lookup field doesn't exist in splunk event Hi All, Could you please help me with a query to map a lookup table with splunk events but not aware on matching f... by rakeshksingh New Member in Splunk Search 01-23-2019 0 0	0	0
Accessing whole row / other fields in table format colorPalette expression in Simple XML - 'value' only? Hello Splunkers, I am developing dashboards in a Splunk instance which I don't manage, so I have little room for add... by wowczarek Engager in Splunk Search 01-23-2019 1 5	1	5
How do I get the eval token to wait for the set token to finish? Hi Is there a way to get my eval token to wait for the full result. I am setting a token time_selection_BUFFER.earli... by robertlynch2020 Influencer in Splunk Search 01-23-2019 1 2	1	2
Joining 2 Lookup Tables I'm trying to join 2 lookup tables. To make the logic easy to read, I want the first table to be the one whose data ... by weidertc Contributor in Splunk Search 01-23-2019 0 10	0	10
regex to mask password in props.conf I am need of help to build the regex to mask a password string looking similar to this Password: 22222222abc22222222... by caitcait Explorer in Splunk Search 01-23-2019 0 10	0	10
Regex Help; exceeded configured match_limit I have this query that works in all regex assist sites but is too greedy for my Splunk Environment. I am unable to ad... by JoshuaJohn Contributor in Splunk Search 01-23-2019 0 3	0	3
Using Wildcard as value in a variable Is there any way to use a wildcard as a value to a variable? \| inputlookup Functionalities.csv \| search AppNo=$app$ ... by weidertc Contributor in Splunk Search 01-23-2019 0 15	0	15
How do you format a table row as currency but not the column field only a specific row? I have a table that has various columns of Totals. However, the CurrentYear can represent different information. I o... by EmEdwards Path Finder in Splunk Search 01-23-2019 0 1	0	1
Search help I have the Sophos XG forwarding logs to Splunk. How do i search for users who logged into Sophos XG in Splunk. by ticbos New Member in Splunk Search 01-23-2019 0 2	0	2
How to prevent Eventgen from generating duplicates Hi, I´m new to Splunk and Eventgen. I have a sample with 24 events distributed over 1 day (timestamps from 19.11.2018... by ttyurina New Member in Splunk Search 01-23-2019 0 0	0	0
Can you help me with a lookuptable question? Hello all, I have indexed data that contains an extracted field (domain) and a CSV (https.csv) file with the followi... by adabud6267 Explorer in Splunk Search 01-23-2019 0 4	0	4
Is it possible to have a common URL for Splunk? Hi, We have three different URLs for Splunk for example, https://splunk1.com, https://splunk2.com; https://splunk3.... by dbashyam Explorer in Splunk Search 01-23-2019 0 4	0	4
Why does the stats function remove my fields and what Splunk solutions can I use for the following order: 1st do lastest(_time) -> then do sum(on the result of latest) Hi, I've read a while ago how easier Splunk is vs SQL, but I do not agree within the context of my issue:( I want t... by net1993 Path Finder in Splunk Search 01-23-2019 0 20	0	20
Is it possible to calculate 'responseTime' values in a cumulative stats table? I have identified an issue with a response time stats report that was built by a former Splunk specialist at my organ... by alexandermunce Communicator in Splunk Search 01-23-2019 0 3	0	3
Splunk forms I would want to know if I can create a form as below : Time : 23/01 No of Events ... by Deepz2612 Explorer in Splunk Search 01-23-2019 0 3	0	3
How do you transform table values to a column replaced by values? Hi Folks, I'm still new to Splunk queries. I'm struggling with the following (simple) table transformation: All val... by mgutschelhofer Explorer in Splunk Search 01-23-2019 0 3	0	3
What does the following Splunk health check warning mean? For one of the app we are getting error: Health Check: msg="A script exited abnormally with exit status: 1" What d... by mbagali_splunk Splunk Employee in Splunk Search 01-22-2019 0 1	0	1
How do I count events for the past 45 days when the start date is the 15th of each month? Please Help !!!! I am trying to create an SPL query to count events for the past 45 days from the start date the 15t... by amilavsky Engager in Splunk Search 01-22-2019 0 2	0	2
Does anybody have idea on "INFO PipelineComponent - Process delayed by 1524.266 seconds, perhaps system was suspended?" log message? All my summaries are running and completed successfully. But I can see "INFO - Process delayed by 1524.266 seconds, p... by sesharao92 Explorer in Splunk Search 01-22-2019 2 0	2	0
What's wrong with my rex? I'm trying to time an event. The event occurs within a burst of log events, which arrive at my Splunk server and usu... by stcrispan Communicator in Splunk Search 01-22-2019 0 15	0	15
Why is my single visualization w/trendline total display off by 1? i have the following query and the events/results show "5" but the Single w/Trendline Visualization shows "4". index... by jaj Path Finder in Splunk Search 01-22-2019 0 2	0	2
tabulate timeline of a notable event I'm trying to create a table that displays the timeline of the notable event based on its status from creation. So, ... by pthalasta New Member in Splunk Search 01-22-2019 0 0	0	0
Services.sh with Init doesn't seem to give service status We've been using services.sh to get service status on systemd boxes without issue. But when we started looking at ol... by splunk219783 Path Finder in Splunk Search 01-22-2019 0 0	0	0
How do you capture values with regex? Hi, I am fairly new to regex and cannot figure out how to capture certain strings. Here is an example of the string... by ebkeys94 Engager in Splunk Search 01-22-2019 0 4	0	4
Can we decide to not show fields ? I have a log file date which is split on different fields ( date_hour, date_second, date_hour etc...) Can i decide t... by magilbert1 Explorer in Splunk Search 01-22-2019 0 3	0	3