Splunk Search

Community Activity

How do I group events based on contiguous runs of field value? I would like something like a stats command that groups events only if they form a contiguous run of a particular fie... by reed_kelly Contributor in Splunk Search 10-10-2018 1 2	1	2
Trying to manually Create Regex for search We have been trying to create a search for AWS:Simple Email Services to locate any Bounce Back emails that come in; S... by sgoodman26 Explorer in Splunk Search 10-10-2018 0 5	0	5
Can you help me with a query involving the eval command? I'm trying to set up a search for when a user disables their 2FA vs when IT disables it for them. I have the User A... by ColinJacksonPS Path Finder in Splunk Search 10-10-2018 0 8	0	8
Can you help me compare two searches and then print the difference? Hello, I am using two searches for seeking two windows events 4732 and 4733. I want to print into a new table events... by atyshke1 Path Finder in Splunk Search 10-10-2018 0 11	0	11
How do you use the arules command to identify the association between purchased items? Please could you help me on the working example with dataset using arules command? i'm planning to use this in my ma... by rolly_deguzman New Member in Splunk Search 10-10-2018 0 0	0	0
Chart examples Hi, I have the data in the below format i.e i have calculated base on Type A,B,C per month and the data looks like J... by chintan_shah Path Finder in Splunk Search 10-10-2018 0 4	0	4
Eval division of two results of the same field I want to find the ratio of failures and successful logins. Therefore I use one field in a data model, called Authent... by kokanne Communicator in Splunk Search 10-10-2018 0 8	0	8
How do you create a link in a table that directs to a form on the same page? Scoured a ton of related questions, but none exactly like this have been posted yet as far as I can tell. I have an ... by nick405060 Motivator in Splunk Search 10-09-2018 0 2	0	2
How to make rows value into columns. I am trying to convert values from rows into columns. below is a example data ServerName Counter Value server1 %_P... by pratapbhanu2047 Engager in Splunk Search 10-09-2018 0 8	0	8
Compare historical hourly average with today's hourly data I am trying to show two things in one graph: 1) bar chart of the count of events for last 24 hours in hourly interval... by splunk2018a New Member in Splunk Search 10-09-2018 0 2	0	2
regex multivalue grouping Hi Guys, I am pretty new to regex and need help with getting repeated values from one event (record). Splunk is sho... by kakarsu New Member in Splunk Search 10-09-2018 0 3	0	3
Is anyone having issues with base searches in 7.2? Having some strange behavior with base searches right now. For example, we have events like this flowing into Splunk... by paimonsoror Builder in Splunk Search 10-09-2018 0 3	0	3
How do I bind values from different indexes with different fields? Good day sirs! I have two different indexes with different fields but same value-ish. index=a: MTH=SEPTEMBER index=... by rajyah Communicator in Splunk Search 10-09-2018 0 3	0	3
How do I get top 10 values of output based on "count(_raw)' values displayed in descending order? My query ends with \| stats count(_raw) by user I want the values to be displayed in descending order based on the... by zacksoft Contributor in Splunk Search 10-09-2018 0 2	0	2
How do I remove a string between the first occurrence of two strings in a query? I am trying to remove all content returned in a field between two specific strings but only from the first occurrence... by Wondergoat77 Engager in Splunk Search 10-09-2018 0 4	0	4
How do I create a drilldown for a specific cell location (not cell value) in a table? Hi there, I read a bunch of related Splunk answers, but so far I haven't seen a solution posted to creating a drilld... by nick405060 Motivator in Splunk Search 10-09-2018 0 9	0	9
How do I compare results from 2 indexes on a common field? Hi guys, Has anyone ever written a search that can compare events(in this case "indicator" across 2 indexes and show... by mwdbhyat Builder in Splunk Search 10-09-2018 0 4	0	4
How do I create a custom key indicator search on a normal Splunk dashboard? Hi Splunker; How do I create a custom key indicator search on a normal dashboard? I don't want to create a custom ke... by abdullahalhabba Explorer in Splunk Search 10-09-2018 1 0	1	0
How do I modify ID results in a table to display a URL or filepath? Hey there, I've been having a look around on here, and through Google, but so far coming I'm up blank. I'm looking ... by replicamask Explorer in Splunk Search 10-09-2018 0 3	0	3
sort coliumns row wise Hi , I have a rsult set like this : status eSIMEntitlement selfcare oauth2 account customer catalog moat ... by Mohsin123 Path Finder in Splunk Search 10-08-2018 0 2	0	2
How come frozenTimePeriodInSecs is not working as expected? HI Friends, I have more than 50 Indexes in my Splunk cluster. For a few of the Indexes, the earliest event is show... by pkumar9610 Explorer in Splunk Search 10-08-2018 0 7	0	7
Why is the Search and Reporting default overwritten during start up? The default folder under SPLUNK_HOME/etc/apps/search has been overwritten and all my changes are now in a default.old... by sarahafrin Explorer in Splunk Search 10-08-2018 0 2	0	2
Is there a good book for learning Splunk queries? Hi, Can someone suggest a good way (or a real good book) on how to learn splunk queries. any suggestions would be ap... by cosmo360 New Member in Splunk Search 10-08-2018 0 4	0	4
How do I get top values based on eval? I have a relatively simple query with which I am evaluating a new field. I'd like to get the top values of this new ... by jackpal Path Finder in Splunk Search 10-08-2018 0 2	0	2
How do I map a field from a lookup to a Splunk index? Hello Splunkers, I have a requirement to match a field from an index to a field in a lookup and then extract the res... by Sidharda Path Finder in Splunk Search 10-08-2018 0 1	0	1

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...

Splunk Search

How do I group events based on contiguous runs of field value?

Trying to manually Create Regex for search

Can you help me with a query involving the eval command?

Can you help me compare two searches and then print the difference?

How do you use the arules command to identify the association between purchased items?

Chart examples

Eval division of two results of the same field

How do you create a link in a table that directs to a form on the same page?

How to make rows value into columns.

Compare historical hourly average with today's hourly data

regex multivalue grouping

Is anyone having issues with base searches in 7.2?

How do I bind values from different indexes with different fields?

How do I get top 10 values of output based on "count(_raw)' values displayed in descending order?

How do I remove a string between the first occurrence of two strings in a query?

How do I create a drilldown for a specific cell location (not cell value) in a table?

How do I compare results from 2 indexes on a common field?

How do I create a custom key indicator search on a normal Splunk dashboard?

How do I modify ID results in a table to display a URL or filepath?

sort coliumns row wise

How come frozenTimePeriodInSecs is not working as expected?

Why is the Search and Reporting default overwritten during start up?

Is there a good book for learning Splunk queries?

How do I get top values based on eval?

How do I map a field from a lookup to a Splunk index?

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

Splunk Technical Support Is Moving to Cisco Support Tools

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation