Splunk Search

Discussions

Thread Info

Controlling Text - Output Table formatted data to text

We are in the process of generating Events in ServiceNow using the Splunk add-on for ServiceNow. We are passing Even...

by Engager in

Why "*" start does not include the void value

Hello everyone, I'm working on Splunk Entreprise and on the Search & Reporting app. I made many drop-down menu to fil...

by Explorer in

Searching a lookup

I have this lookup I want the total count when the timeval is latest. (in this case 2023) any solution

by Contributor in

How to find the difference of time between the 2 fields ?

Hi Can you please tell me how can i extract the events for which the difference of current_time and timestampOfR...

by Path Finder in

How to filter results of a 2nd search from the main search

I have a use case where I want to setup Splunk Alerts for certain Exception events. I have already defined standard E...

by New Member in

Updating App Macros

Hi Community People. Our team has stood up a new instance of Splunk, and we have deployed out some cool new apps. O...

by Communicator in

How to use Not Exists function in Splunk when 2 indexes are involved ?

Hi Can someone help to explain how we can use Not-exists in Splunk. Example is attached below for which i need ...

by Path Finder in

Interpretation of integers

I am wondering why the two following requests, when applied to exactly the same time range, return a different value:...

by Explorer in

Reordering fields

Hello Splunkers, I've a Region filter over the dashboard. This Region filter has values AMER and EMEA. ...

by Path Finder in

To extract a field using the REX Command

Hello I want to extract the field issrDsclsrReqId" using the Rex command. Can someone please help me with the co...

by Path Finder in

Report NOT running 1 week

I have this query in my report scuedhled to run every week, but results are for all time, how can i fix ? index=dlp...

by Explorer in

IndexScopedSearch The search failed. More than 1000000 events were found

I read many articles about it but no one knows how to fix it. so how can I fix it? Error in 'IndexScopedSearch'...

by Explorer in

Help with Outbound SMB traffic Rule SPL, please. Thank you!

Can someone please help me with this rule? I have been assigned to create a bunch of similar rules but I am strugglin...

by Path Finder in

Fix Error: IndexScopedSearch?

Hello Splunk enjoyers!I loaded some data(10 000 000), with fields: updated_time, info, user and discription, to my n...

by Explorer in

How to monitor a certain rule from McAfee?

Hi!  I want to write a query that will show me all the events that jumped because of a certain rule that I se...

by Loves-to-Learn in

Need an help to create a SPL's.

Hi, Could any one pls figure out from these below logs to achieve the use case like when we launch rdp,proxy from s...

by Builder in

Checking specific index data for large server list

Hi all, I have list of 3k+ servers for which i want to check data flow from specific index. How can i do this with ...

by Path Finder in

Calculate Percentage of status code for 200 by _time

I want to calculate the Percentage of status code for 200 out of Total counts of Status code by time. I have written ...

by Explorer in

How to create summary index?

I have a dashboard which contains 5 panels in table format.Query for panel1:index=xxxx sourcetype=xxxxx stroage_name...

by Path Finder in

best/fastest way to match results from two sets of data in the same index

I have an index that is receiving JSON data from a HEC, but with 2 different data sets and about 2M per day:DS1{guid:...

by Path Finder in

Return on certain field values in my search

Hi Community, I'm fairly inexperienced when it comes to anything other than quite basic searches, so my apologies i...

by Engager in

information about Splunk audit events

Hi at all, I need to create some Correlation Searches on Splunk audit events, but I didn't find any documentation a...

by SplunkTrust in

How to extract Title from this XML data

Hello I have a very long xml record that I am trying to spath some data from but I cant seem to get it to work. Can...

by Path Finder in

Possibility to extend the hover description

Hello everyone, I am still relatively new to Splunk. I would like to add an additionalTooltipField to my maps v...

by Loves-to-Learn in

Output of one String as an input to another search

I have this query which is working as expected. There are two different body axs_event_txn_visa_req_parsedbody and ax...

by Explorer in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Controlling Text - Output Table formatted data to text

Why "*" start does not include the void value

Searching a lookup

How to find the difference of time between the 2 fields ?

How to filter results of a 2nd search from the main search

Updating App Macros

How to use Not Exists function in Splunk when 2 indexes are involved ?

Interpretation of integers

Reordering fields

To extract a field using the REX Command

Report NOT running 1 week

IndexScopedSearch The search failed. More than 1000000 events were found

Help with Outbound SMB traffic Rule SPL, please. Thank you!

Fix Error: IndexScopedSearch?

How to monitor a certain rule from McAfee?

Need an help to create a SPL's.

Checking specific index data for large server list

Calculate Percentage of status code for 200 by _time

How to create summary index?

best/fastest way to match results from two sets of data in the same index

Return on certain field values in my search

information about Splunk audit events

How to extract Title from this XML data

Possibility to extend the hover description

Output of one String as an input to another search

.conf25 Registration is OPEN!

Detecting Cross-Channel Fraud with Splunk

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

MLTK - What algorithm should I use?

How to show the line when its value is NULL with ...

Search for triggered save searches and their actio...

MLTKC how should i check jupyter notebook func in ...

ITSI thresholds: adaptive vs static

Splunk Search

Are you a member of the Splunk Community?

Discussions