Splunk Search

Community Activity

Trouble with UTC time I have some search results that return values in the format %Y-%m-%d %H:%M:%S. For example: ...some search... \| tab... by BearMormont Path Finder in Splunk Search 08-21-2018 0 1	0	1
In real-time alert, if I use lookup command, too many alerts triggered. Splunk ver 7.1.1 I'm using real-time alert that trigger when there is event which has src_ip match black_list.csv li... by yutaka1005 Builder in Splunk Search 08-21-2018 0 2	0	2
how to know the search history by user, but only the searches you type Sorry for the inconvenience, but I'm looking for a query that only shows the searches typed by users, because when I ... by efaundez Path Finder in Splunk Search 08-21-2018 0 3	0	3
Replace a column with diagonal value in a table host time timediff a 12:00 END a 11:55 1 a 11:50 ... by khavildar Explorer in Splunk Search 08-21-2018 0 5	0	5
Adding a date to a string Message I am trying to create an error message based on a time frame, the last 15 min. and now. So the error message would sa... by griffinpair Path Finder in Splunk Search 08-21-2018 0 6	0	6
count(var) by "a list of values within a field" First of all, sorry, if I am missing something really obvious here but after hours of googling I am still stuck with ... by ndey New Member in Splunk Search 08-21-2018 0 3	0	3
How to write a regex for string followed by number? Below are my 3 logs, i want to write a query, to get all the below 3 logs: *EXT_CODE[0-9]** with 1/2/3 digit follo... by arjun_krishna Explorer in Splunk Search 08-21-2018 0 8	0	8
How to find the RequestPerSec by Country using ClientIP adddress ? Hi I have a query which would list me avg, max & P95 requestpersec for the selected time range index=test client... by sangs8788 Communicator in Splunk Search 08-21-2018 0 2	0	2
How to use a lookup table to identify new open ports based on source IP I have NMAP data in Splunk that reports on open ports associated with a list of IP addresses. I'd like to create a lo... by khansonveracode New Member in Splunk Search 08-20-2018 0 1	0	1
Need to create a Dashboard which can select multiple fields based on user selection of checkbox/ radio button. Hi all, I Need to create a Dashboard which can select multiple extracted fields based on user selection of checkbox/... by jithinmathew Explorer in Splunk Search 08-20-2018 0 4	0	4
How do I combine storage statistics of indexes with the index, sourcetype, and host? I can use a rest search from the services/data/indexesendpoint to calculate storage statistics, like the index size i... by alanzchan Path Finder in Splunk Search 08-20-2018 0 1	0	1
Advanced documentation for field extraction/transformation? I'm trying to make sense of the default access-extractions transform so that I can modify it a bit. I've been nosing... by AHinMaine Engager in Splunk Search 08-20-2018 9 4	9	4
Need help understanding how Transform "access-extractions" works Hi to all that read this, Hoping one of you might be able to provide some assistance. We have an app that is produci... by Kozanic Path Finder in Splunk Search 08-20-2018 0 1	0	1
After upgrading to 7.0.x searches, using NOT host= filters gives no results After upgrade to 7.0.x searches using NOT host= filters are giving no results with the warning in the job inspector a... by pradeepkumarg Influencer in Splunk Search 08-20-2018 0 3	0	3
How can I visualize "table _raw" in the same format as the search result for the raw events in default Splunk search screen ? When I search for my events by giving index=myindex, I get my data in the proper format. But when i try to print it o... by Upas02 Path Finder in Splunk Search 08-20-2018 0 2	0	2
Failed to reap - because of directory not empty We have a lot of theese errors in splunked.log, I have searched a lot to find an solution but to no success. ERROR D... by thbrix New Member in Splunk Search 08-20-2018 0 1	0	1
Is it possible to do a conditional stats values command A common usecase I run into is I want to join two sources of data together only if fields meet certain criteria. The ... by twhite_splunk Splunk Employee in Splunk Search 08-20-2018 0 7	0	7
check if stringa in stingb how can i make a case condition to check if StingA is in StringB? for example StingA is "xxx.com." StingB is: "a.xxx... by mcohen13 Loves-to-Learn in Splunk Search 08-20-2018 0 3	0	3
Back end query to pull the active searches running in Search Head I want to check what are the searches which are running currently or which are finalizing or which is done via our ba... by anandhalagarasa Path Finder in Splunk Search 08-20-2018 0 5	0	5
Help on complex request in order to improve the performances Hello I need help on a complex request with different indexes and with a "primary key" (host which is the name of th... by jip31 Motivator in Splunk Search 08-19-2018 0 15	0	15
Hide a column based on search criteria I want to hide a column based on some search. I have three columns. Host, Value , Unit If(host=abc) then hide the ... by sahil237888 Path Finder in Splunk Search 08-19-2018 0 8	0	8
Can someone help me with regex to remove HTML tags from fields? Hello, Could someone please help me with removing the HTML tags from fields. The data is a few sentences, such as r... by ndsouza25 New Member in Splunk Search 08-19-2018 0 12	0	12
how to calculate Throughput Hello everyone. Want to display the output only for the time which crosses 18 months (earliest time) by rajhemant26 New Member in Splunk Search 08-18-2018 0 2	0	2
How to export a Splunk search and display it in Grafana without requiring to use their own data source? Hello I would like to export the Splunk's search and to also display it in Grafana without requiring to use their ow... by bernardchew New Member in Splunk Search 08-18-2018 0 2	0	2
How to return full count of field1, and a TRUE/FALSE field if 1 or more of the results in field1 matches a specific criteria? eventtype=X \| iplocation ClientIP \| where Country!="United States" \| eval bad=if(match(Country,"Brazil\|China\|Vietnam... by Earenhart Path Finder in Splunk Search 08-18-2018 0 3	0	3