Splunk Search

Community Activity

Unable to extract the Time stamp value from the message in splunk events. Please help me on this Hi Team,I am unable to extract the Timestamp value from the below message in splunk events using rex command and add ... by Renunaren Loves-to-Learn Everything in Splunk Search 03-06-2024 0 4	0	4
checking if all values from lookup exists Hey, im trying to do something relative easy and for some reason can't make it..i have a lookup named tableq_lookyp w... by dorHerbesman Path Finder in Splunk Search 03-05-2024 0 7	0	7
Use eval command to extract from message LogName=Application EventCode=1004 EventType=4 ComputerName=Test.local User=NOT_TRANSLATED Sid=S-1-5-21-2704069758-30... by jeradb Explorer in Splunk Search 03-05-2024 0 2	0	2
Splunk Search to list local User accounts Hi Splunk Community, I'm trying to list all splunk local users (authentication system = splunk) . The below search li... by iamsplunker Communicator in Splunk Search 03-05-2024 0 1	0	1
Macros not fetching data I have a lookup which has fields like account_name, account_owner, environment etc. this lookup has more than 1000+ d... by sinhashubham014 Engager in Splunk Search 03-05-2024 0 1	0	1
Retrieve data from website HOw to retrieve NPA and NXX from CNAC.ca using splunk query. by splunk6 Path Finder in Splunk Search 03-05-2024 0 1	0	1
Curl with dynamic url not working I am trying to make a curl request to a direct json link and fetch the result. When i hardcode the URL it works fine ... by palak_247 Observer in Splunk Search 03-05-2024 0 3	0	3
Split up multiline values I am trying to run the following search:index=tripwire LogCategory="Audit Event" AND "/etc/pki/rpm-gpg/RPM-GPG-KEY-sh... by secphilomath1 Explorer in Splunk Search 03-05-2024 0 3	0	3
Best way to simulating or obtain an commonly data source into Splunk Enterprise for POCs. Hi All,I don't have many resource to build an ideal network environment to forward logs to Splunk. So, I'm seeking a ... by thanh_on Path Finder in Splunk Search 03-05-2024 0 5	0	5
difference between pipe summaryindex and collect Hello,1) What is the difference between using "\| summaryindex" and "\| collect"?Thank you for your help.Summaryindex i... by LearningGuy Motivator in Splunk Search 03-05-2024 0 9	0	9
Help me with the SPL Hi,Could some one pls help me the lateral movement which look for a user with remote NTLM (type 3) logins on an abno... by Akhanda Engager in Splunk Search 03-05-2024 0 4	0	4
Join fields with different field names and stats value? So, I have one source (transactions) with userNumber and another source (users) with number. I want to join both of t... by sumarri Path Finder in Splunk Search 03-05-2024 0 3	0	3
Time range panel issue Hi, I have created the dashboard with multiple panels. I have created the time range panel to be reflected as last 4 ... by Nagalakshmi Path Finder in Splunk Search 03-05-2024 0 2	0	2
Retrieving duration between two events with multiple end events Hello all,I'm trying to get a duration between the first "started" event, and the first "connected" event following s... by handosplunk2 Observer in Splunk Search 03-05-2024 0 4	0	4
Regex to extract a word after word and comma i have 2 requirements 1) From different events in need to extract the word after Interface and Comma. After Interfac... by dtccsundar Path Finder in Splunk Search 03-05-2024 0 1	0	1
REST Command for a list of Indexer apps I'm looking to run a \|rest command to return a list of apps, and app versions sent from the management node (i.e. ma... by Taylor323 New Member in Splunk Search 03-05-2024 0 0	0	0
TERM and PREFIX cannot find string with two dashes any ideas on TERM and PREFIX limitations with double dashes? cat /tmp/test.txt abc//xyz abc::xyz abc==xyz abc@@xyz a... by PavelP Motivator in Splunk Search 03-04-2024 1 17	1	17
Hidden Characters in a .csv datasource I am having a random issue where it seems characters are present in a field which cannot be seen.If you look in the r... by raysonjoberts Path Finder in Splunk Search 03-04-2024 0 2	0	2
How to extract Json object as field? Hi ,How to extract the fields from below json logs.Here we have fields like content.jobname and content.region .But i... by karthi2809 Builder in Splunk Search 03-04-2024 0 4	0	4
To extract string value using regex Hi Team,I want to extract the below field value, here the challenge is the error code 403 sometimes it will change."p... by parthiban Path Finder in Splunk Search 03-04-2024 0 3	0	3
Simple subtraction between two searches I have two very simple searches and I need to be able to get the difference. This is insanely hard for something that... by Fo Engager in Splunk Search 03-04-2024 0 3	0	3
SPL for adding /32 to all addresses returned in a search Hello,I am running a search that is returning IP addresses that are being sent to a waf (web access firewall). The w... by ptrsnk Explorer in Splunk Search 03-03-2024 0 4	0	4
Find variance between current hour value and avg value of same hour over last 2 weeks Hi,I have an search that is used on a dashboard that I would like tweaked.Currently this search/panel displays the va... by bryhoffman Explorer in Splunk Search 03-03-2024 1 6	1	6
join two indexes based on the date and the hour and try to match inside of minute We have logs in two different indexes. There is no common field other than the _time . The timestamp of the events i... by Jay2024 New Member in Splunk Search 03-03-2024 0 2	0	2
Comparing two different sources Hi Experts, I need to compare server lists from two different csv lookups and create a flag based on the comparison r... by Muthu_Vinith Path Finder in Splunk Search 03-03-2024 0 1	0	1