Splunk Search

Community Activity

How do you route windows event logs based on filters on a heavy forwarder? Hi, We have had this working in the past, but for some reason, now, i am unable to forward filtered events to one Tc... by shivarpith Path Finder in Splunk Search 10-26-2018 0 6	0	6
How to do regex based on commas I have data like this: 21,enrollmentgroup,19936,40:G6:7Q:G6:89:FG,,nitro - Circle.one10,Phone,11.1.11313,C,10/25/18 ... by JoshuaJohn Contributor in Splunk Search 10-26-2018 0 7	0	7
Is it possible to list the filters of the initial search with the results of a subsearch? Here is the scenario. I have two indexes (index=AV and index=Packet_Analysis) I use index=AV to find attack signatu... by Log_wrangler Builder in Splunk Search 10-26-2018 0 5	0	5
Collect values from syslog logging Hello, I am new to splunk and have the following question. Below is snippet from a syslog logging. I would like to s... by admin_fred New Member in Splunk Search 10-26-2018 0 4	0	4
How do I list unique IPs of infected computers per day and then list new IPs from the previous day? I have a query that looks at SEP logs. index=SEP Sig_String='Attack: Bad Stuff" Remote_IP=10.* \| bin _time span=1d... by Log_wrangler Builder in Splunk Search 10-26-2018 0 5	0	5
What is the best way to pull out IP Addresses from a multivariate field? Basically, I have a multi value field where each value is a free form piece of text corresponding to dated text entri... by mumblingsages Path Finder in Splunk Search 10-26-2018 0 4	0	4
How do I get a subtraction of two fields when they share a common value? I am having three columns in primary_key, service_name , timestamp. I want to get a subtraction of values present in... by pal_sumit1 Path Finder in Splunk Search 10-26-2018 0 2	0	2
How to group by month if we have data from. Hello everyone. Want to display the output only for the time which crosses 18 months (earliest time) by rajhemant26 New Member in Splunk Search 10-26-2018 0 2	0	2
Eval round gives inconsistent half-rounding results I tried setting up a Splunk alert to check for inconsistencies between a rounded total and a raw total, but the alert... by pentwist Engager in Splunk Search 10-26-2018 0 5	0	5
Extracting unique Null Pointer Exception from the logs via Splunk I am looking to extract unique NullPointerException from the Splunk Logs. Unfortunately somehwere my regex is isnt ex... by ashirgao New Member in Splunk Search 10-25-2018 0 1	0	1
Can you help me with my stats count? hello I use the request below, which works: index="windows" sourcetype="wineventlog:Application" "SourceName=*" Typ... by jip31 Motivator in Splunk Search 10-25-2018 0 4	0	4
How do I use the eval command to calculate error rates and show them as percentages? Hello, I am creating a dashboard in which I am displaying total logins, successful logins, failed logins, error rate... by moizmmz Path Finder in Splunk Search 10-25-2018 0 20	0	20
How do I rename the values in the following field? https://drive.google.com/file/d/13tgNyaelfyPwxIvgAOA1Gn1hI628dGB2/view?usp=sharing[link text]1 I want to rename the ... by moizmmz Path Finder in Splunk Search 10-25-2018 0 2	0	2
search time data masking Hi I am trying to mask indexed data using following props.conf comfig for linux_secure. [linux_secure] EXTRACT-ip ... by melonman Motivator in Splunk Search 10-25-2018 0 3	0	3
Error message above search bar Hi All, When I am executing a search query something like "index=index1", I am getting the below error message above... by bsantosh New Member in Splunk Search 10-25-2018 0 3	0	3
Can you help me with an issue i'm having with the strptime function? I am trying to implement strptime command on my lookup named test.csv, which has fields _time, hits with data from ... by Divyachundu New Member in Splunk Search 10-25-2018 0 4	0	4
How do you convert numeric value from 5000 to 5k for a field? I am planning to convert the value of a count into 5k, 500k format rather than the whole number. May I know how I can... by arrangineni Path Finder in Splunk Search 10-25-2018 0 1	0	1
Make data in a stacked area chart 'float' Any way to make one series in a stacked area chart invisible? I've got a bunch of data I want to make a floating rib... by mikclrk Explorer in Splunk Search 10-25-2018 0 0	0	0
How come only one of many fields is not extracting? I have a weird behavior in my environment. When I get new data, I parse them using my regex (= as delimiter between ... by shayhibah Path Finder in Splunk Search 10-25-2018 0 6	0	6
How do I count occurrences with wildcard in count by field? Hi, I have the following values from my search result: /api/v2/nodes/107757943/nodes /api/v2/nodes/107758003/nodes... by mhornste Path Finder in Splunk Search 10-25-2018 1 4	1	4
Can you help me break my search up into two smaller ones? I have a query that is taking up too many resources I am told. I decided to break it up into two smaller reports (on... by bealm New Member in Splunk Search 10-25-2018 0 3	0	3
Splunk dbxquery to call stored procedure with subsearch to populate parameter not working I have two working Splunk queries as follows. The first one takes in an IP Address and datetime and returns a Mac Ad... by rdclark Engager in Splunk Search 10-25-2018 0 1	0	1
Why is HTTP is working while HTTPS is not? Hi, I tried to enable SSL on my Splunk instances. A few of them were successful. Some of them(specifically none of t... by graju89 Path Finder in Splunk Search 10-25-2018 0 2	0	2
In a statistics table, how do I make it so a row hides when clicked upon? Hello guys I want to hide the row of a table after clicking on a cell on this table. I guess I should look for JS so... by denys_k Explorer in Splunk Search 10-25-2018 0 2	0	2
Feature Suggestion: Panel-local variables for prebuilt panels Prebuilt panels would be more useful if they allowed local variables. This would parallel the way macros allow argum... by madkins23 New Member in Splunk Search 10-25-2018 0 1	0	1