Splunk Search

Community Activity

SAML authentication with LDAP authorization Ask the question of Splunk support and was told "not possible". I am counting on the fact that we are not the only o... by tlmayes Contributor in Splunk Search 11-01-2018 0 9	0	9
Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class" Rexex101 works GREAT. However, Splunk gives me an error. I keep getting the following error with the regex below: I... by Task1906 Explorer in Splunk Search 11-01-2018 0 3	0	3
Can you help me create a regular expression to remove unwanted data from a column based on a field? i want to apply a regular expression to remove unwanted data in a column based on the field. If field value starts w... by DataOrg Builder in Splunk Search 11-01-2018 0 5	0	5
Splunk 7.2 searches do not work after install. I can't run a search on either the Splunk 7.2 indexer or search head that I just installed. I get the error "Could no... by nick405060 Motivator in Splunk Search 10-31-2018 0 10	0	10
Why will timechart not give me hourly updates? I have the following query that shows me that date/time is getting parsed correctly and is now displaying and a regul... by jamesandy51 Explorer in Splunk Search 10-31-2018 0 5	0	5
Query works fine in search, not on dashboard Update: So doing a little more investigation it looks like the line \| search Result="Correct" is what is actua... by troyward Explorer in Splunk Search 10-31-2018 0 4	0	4
How do you customize the time span for searches and reports? Hi, I need to know if Splunk allows searching back a "specified" time instead of using only earliest and latest. I ... by mbasharat Builder in Splunk Search 10-31-2018 0 4	0	4
How do you timechart count for 3 fields where Date is on x-axis and the remaining fields are on y axis? I have a query as below \| inputlookup sample_lookup.csv \| rename "Count Type" as count_type which gives the result ... by pavanae Builder in Splunk Search 10-31-2018 0 2	0	2
How can I use dynamic drilldown to go to external link/rdp session and fill field from the value clicked? I'm trying to use dynamic drilldown to do the following: Open an external URL after a user clicks on a specific fiel... by hubbardw New Member in Splunk Search 10-31-2018 0 0	0	0
How do I create a timechart with spans that aren't aligned to the start of a minute/hour/day etc? I'm using timechat to count the number of events per minute in a single value display: search \| timechart span=1m cou... by lukemundy New Member in Splunk Search 10-31-2018 0 2	0	2
Number of events in GUI search does not match number of events in output of export API Hi, I am trying to export data from Splunk to ingest it into another analysis tool. If I search Splunk for this: i... by andrewbeak Path Finder in Splunk Search 10-31-2018 0 0	0	0
How do I count how many times a value appears in other fields? Hi, I've merged two lookup files using this query: \|inputlookup master_inventory.csv \|join type=inner IP [\|inputlo... by russell120 Communicator in Splunk Search 10-31-2018 0 2	0	2
How do I stats both the `latest()` and `values()` of a multi-value field? I am trying to get both latest() and values() of a multivalue field. I am sending the field to Splunk as a comma-sepa... by camillak Path Finder in Splunk Search 10-31-2018 1 2	1	2
Change thousand separator on chart Hi Ninjas Might be simple but i didn't figured it out yet- I have values in a timechart command, displayed in a lin... by claudio_manig Communicator in Splunk Search 10-31-2018 0 0	0	0
The output of the tstats command won't work for trellis charts, only stats... why? I really like the trellis feature for bar charts. It works great when I work from datamodels and use stats. However, ... by murdermostfowl New Member in Splunk Search 10-31-2018 0 2	0	2
How to 2 spunk search into one result and substract the sum value of 1 search to another search and display it? index=oswindows sourcetype="winhost" host=npe OR host=npw source=service earliest="-30d@d" latest="@d DisplayName="Vo... by archonixm New Member in Splunk Search 10-31-2018 0 3	0	3
Getting the previous event displayed in search results I'm using Splunk to analyze Linux audit logs. My query looks like this: index="my index" action=success (type=USER_L... by mikemichaleson Engager in Splunk Search 10-31-2018 1 2	1	2
How do you use a count without a parameter? Most of the examples I've seen (still learning) use count like so: \| stats count(src_ip) as IP but I occasionally ... by jkrobbins Engager in Splunk Search 10-31-2018 0 2	0	2
How do you extract user names from a field that contains an email address? Hi Experts, I have a data field called "userId" (FirstName.LastName@DomainName) in one of my data sources. Is there... by PanIrosha Path Finder in Splunk Search 10-31-2018 0 8	0	8
Can you help me with my wildcard search involving two columns? In my Report Table, there were multiple lines of actions performed in the Active Directory. I want to take the value ... by timyong80 Explorer in Splunk Search 10-31-2018 0 10	0	10
How do I sum up all values on one line to give a max count ? Hi Splunk! Would someone be able to help me with following? How do I sum up all values on one line to give a max ... by luckyman80 Path Finder in Splunk Search 10-31-2018 0 9	0	9
Searches cancelled remotely or expired I am currently running Splunk Enterprise 6.5.2, though this problem has persisted in one of our instances for a bit. ... by tlabue Path Finder in Splunk Search 10-31-2018 2 4	2	4
I have created a panel of bubble chart in that how to adjust the height to appear that in center The top and bottom bubbles are cropped how to get the original bubble shape by anirudhgowtham Loves-to-Learn in Splunk Search 10-31-2018 0 0	0	0
Query in Verbose mode results but while finalising in Fast mode, the results arent displaying ? Hi, I have a query which finalises me all JSP pages performance for every month. It provides me correct result in Ve... by sangs8788 Communicator in Splunk Search 10-30-2018 0 3	0	3
How to pass list of values from the first search into the second search ? Here is what I do to get required search results using two separate searches: SEARCH#1 I use the following query ... by raylex_splunk_d Explorer in Splunk Search 10-30-2018 0 14	0	14

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...

Splunk Search

SAML authentication with LDAP authorization

Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

Can you help me create a regular expression to remove unwanted data from a column based on a field?

Splunk 7.2 searches do not work after install.

Why will timechart not give me hourly updates?

Query works fine in search, not on dashboard

How do you customize the time span for searches and reports?

How do you timechart count for 3 fields where Date is on x-axis and the remaining fields are on y axis?

How can I use dynamic drilldown to go to external link/rdp session and fill field from the value clicked?

How do I create a timechart with spans that aren't aligned to the start of a minute/hour/day etc?

Number of events in GUI search does not match number of events in output of export API

How do I count how many times a value appears in other fields?

How do I stats both the `latest()` and `values()` of a multi-value field?

Change thousand separator on chart

The output of the tstats command won't work for trellis charts, only stats... why?

How to 2 spunk search into one result and substract the sum value of 1 search to another search and display it?

Getting the previous event displayed in search results

How do you use a count without a parameter?

How do you extract user names from a field that contains an email address?

Can you help me with my wildcard search involving two columns?

How do I sum up all values on one line to give a max count ?

Searches cancelled remotely or expired

I have created a panel of bubble chart in that how to adjust the height to appear that in center

Query in Verbose mode results but while finalising in Fast mode, the results arent displaying ?

How to pass list of values from the first search into the second search ?

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation