Splunk Search

Community Activity

	Lookup with Splunk REST API Is it possible to use Splunk REST API to lookup external data from Search Head and show some statistics? I have gone ... by siva_cg Path Finder in Splunk Search 08-09-2018 0 0	0	0
	Test Search So I've been tasked to run a mock search as if one of our users breached a database just to see if we are collecting ... by dhaertel Path Finder in Splunk Search 08-09-2018 0 7	0	7
	Extract data from within only double quotes "*" in a _raw log How can you only extract data from a _raw log where the data I want is separated with double quotes? So it's "this is... by chrisschum Path Finder in Splunk Search 08-09-2018 0 4	0	4
	How to add missing values to stats command result? I have a search query index=abc sourcetype=xyz \| stats count by created_date I get results like CREATED_DATE ... by joydeep741 Path Finder in Splunk Search 08-09-2018 0 7	0	7
	Why is the field extraction only extracting one value? Hi all, this is one sample I'm trying to extract in order to visualize them in table. But when I select a sample fiel... by dannili Communicator in Splunk Search 08-09-2018 0 7	0	7
	How to merge several fields from a log to one field? Hi guys, i am pretty new to Splunk and i have the following Task. I have four Systems with logs. I want to merge s... by ljxdennis New Member in Splunk Search 08-09-2018 0 2	0	2
	data validation Lookups Hi Team, I am new to splunk. and need help in validating data in a lookup I have lookup and the data is like below ... by kumar88 New Member in Splunk Search 08-09-2018 0 0	0	0
	How to mask the bank balance to be shown in splunk logs? Hi, How can I mask the bank balance in splunk? it is showing something like this: mybal=2426.88,availableBal=2426.88... by LBG_Ankit New Member in Splunk Search 08-09-2018 0 5	0	5
	How to match search query results with lookup fields and replace the query result with lookup field value? I have a query which gives results like COLUMN_1 COLUMN_2 1 a 2 ... by joydeep741 Path Finder in Splunk Search 08-08-2018 0 2	0	2
	How to add colors to the columns based on conditions? Hi everyone, I wanted to highlight the row values based on condition. I am new to CSS and JS . Can you please guide ... by swetar New Member in Splunk Search 08-08-2018 0 2	0	2
	Alert: set trigger condition on 1st search query and show the stats from 2nd query in the alert email Hello Splunkers, This is my 1st post on this forum, I need some help here. I have to set up a alert which has 2 searc... by afulamba Explorer in Splunk Search 08-08-2018 0 4	0	4
	How to match the last occurance of the regex? I have got a splunk query that searches for the string 'PS1234_IVR_DM' and once found, perform a rex on the field cal... by mmdacutanan Explorer in Splunk Search 08-08-2018 0 8	0	8
	How can I display these rows of data in a line chart? There are 5 rows of data in the table. I want to display these 5 rows of data a line chart. There are 4 fields, field... by flzhang132 Explorer in Splunk Search 08-08-2018 0 4	0	4
	Create a evaluation in each end of month based in one field that is not _time field Hi. I am indexing data from a ticketing tool. I need to see what tickets were opened at end of each month. I've done... by nsanchezfernand Path Finder in Splunk Search 08-08-2018 0 3	0	3
	How to extract field value from JSON and add the total of the value? I have the following JSON format . Content : {<!-- --> "purchaseId":12345, "items":[ { } ], "total":1100... by jitin_ratra New Member in Splunk Search 08-08-2018 0 7	0	7
	define constant value time \| a1\| a2\| a3 \| a4 \| today \| 1 \| 4 \| 8 \| 5 \| today-1\| 1 \| 3 \| 6 \| 5 \| today-2\| 1 \| 2 \| 5 \| 5 \| today-3\| 1 ... by meenaoleti New Member in Splunk Search 08-08-2018 0 4	0	4
	Is there a way to nest the last event inside the eval statement? I'm attempting to use stats to process some data before further calculations are performed. I have too many events fo... by ErikaE Communicator in Splunk Search 08-08-2018 0 2	0	2
	How to pass parameters to report ? Hi, I have made this in Splunk 6.5.2 and now I'm wondering how to pass the two tokens (host and nt_username) to the ... by LordOfAfford New Member in Splunk Search 08-08-2018 0 0	0	0
	Java SDK send data directly to Splunk (web) Hi, I'm attempting to implement a direct connection to Splunk in my Java application so I can send data straight to S... by tomspring5000 New Member in Splunk Search 08-08-2018 0 0	0	0
	How to query and extract value fra Json array Having the json data/array below, how do I create a new (single value) field with only the TargetVersion that has IsP... by thoj New Member in Splunk Search 08-08-2018 0 1	0	1
	I have two field values(a,b) in one field name(c). How can i show those two values(a,b) as two fields on Sankey visualization in a sequential way in two different nodes(one after another node) I have two field values a, b, those are encapsulated in one field name called "c". I would like to show those two val... by saicool Engager in Splunk Search 08-07-2018 0 0	0	0
	Need help in create a search to detect malicious activity from a terminated employee employee was terminated and we would like to fire an event when we see the user log on to any systems. by Ghanayem1974 Path Finder in Splunk Search 08-07-2018 0 2	0	2
	How to filter out the account name ending with "$"? I have data looks like below AccountName account1-abc$ account2-abc$ account3-xyz$ account4 I ... by samlinsongguo Communicator in Splunk Search 08-07-2018 0 2	0	2
	Hello, We are trying to ingest TIBCO logs in to the splunk. Here is the environment type. One appliction server where the TIBCO application is hosted and the application server... by splunkaspirant New Member in Splunk Search 08-07-2018 0 0	0	0
	Removing empty bins in timechart Hello, I am unable to eliminate empty buckets using the timechart command since moving to Splunk 7.0. For example i... by dtow1 Path Finder in Splunk Search 08-07-2018 0 11	0	11