Splunk Search

Community Activity

Best query to check who modified an AD group smtp address for the AD group was changed by an admin.Would like to check who made the changes in AD by renaming the ... by sebasu New Member in Splunk Search 07-26-2018 0 1	0	1
Search for regimented connections Hey Guys, So i'm looking at multiple methods for detecting command and control connections, obviously 1 method alone... by AaronMoorcroft Communicator in Splunk Search 07-26-2018 0 2	0	2
How to construct columns with the same data, and then use these pseudo columns to calculate I want to get data ,as following How to construct columns with the same data, and then use these pseudo columns to... by flzhang132 Explorer in Splunk Search 07-26-2018 0 3	0	3
How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row? test host1 host2 host3 temp test1 x1 x1 x1 Match test2 y1 y2 y1 No match test3 z1 z1 z3 No ma... by samiksha86 New Member in Splunk Search 07-26-2018 0 2	0	2
How to exclude fields from LinearRegression command/use subsearch to generate fields for LinearRergession ? Consider fit LinearRegression \| fit LinearRegression "name2predict" from "f1" "f2" into "test_model" Question 0 W... by achervov Engager in Splunk Search 07-25-2018 0 2	0	2
Extract string from text based on character position Hi, I’m looking to extract a numerical value from a string, however struggling as there is nothing to use as a delimi... by kharlow New Member in Splunk Search 07-25-2018 0 1	0	1
Splunk support telecom protocols We have requirement to setup monitoring for telecom customer , Does Splunk below listed Protocols • IuPS Ranap - DTAP... by SagarSplunk Engager in Splunk Search 07-25-2018 0 0	0	0
filtering search to exclude all instances of field 1 for when certain results in field 2 I have a search that brakes down some router alarms . my fields are Host_IP & Alarm What I'm trying to do is filter... by shouldntdothat Explorer in Splunk Search 07-25-2018 0 3	0	3
I am using the code for date but this is the time the event was created, not when it really happened. See Details \| convert ctime(_time) AS Time timeformat="%m/%d/%y". Can "event.InventoryEventCarpet.InventoryEventCreateDateTime" ... by tcupp New Member in Splunk Search 07-25-2018 0 1	0	1
"Exception - com.splunk.mr.JobStartException: Failed to start MapReduce job." I just moved my whole dashboard to production environment but when I tried to test using a search string, following e... by dannili Communicator in Splunk Search 07-25-2018 0 2	0	2
I need help joining two cvs (customers and purchases) that shows what was purchased and if certain products were not purchased The two csv files I have are customers (fields= customerName,customerID,region,IsActive) with one row per customer an... by cromm Explorer in Splunk Search 07-25-2018 0 2	0	2
Why is stats count by fieldname not working? In search getting list of events and stats giving count of events but when extend the search by field name, throwing... by pchava New Member in Splunk Search 07-25-2018 0 3	0	3
create table based on end time and time limit Hi, i need to create a table with the following conditions: This is my log: proceso,start,end,diferencia,tiempo PR... by Carolina Engager in Splunk Search 07-25-2018 0 4	0	4
Coalesce Fields With Values Excluding Nulls I know you can coalesce multiple columns to merge them into one. However, I am currently coalescing around 8 fields, ... by ixixix_spl Explorer in Splunk Search 07-25-2018 0 5	0	5
Sendemail (Splunk CLI) always sends email whether results are available or not... I'm running the following search from Splunk CLI: ./splunk search 'index=test \| search _raw!="scoobydoo" \| sendemail... by the_wolverine Champion in Splunk Search 07-25-2018 1 3	1	3
How to create a regex to extract data? I am new to Regex and hopefully someone can help me. I am trying to extract data between "[" and "SFP". It doesn't m... by donemery Explorer in Splunk Search 07-25-2018 0 8	0	8
How to combine multiple complex searches into 1 output table? I think I didn't describe my question properly because I don't really have a good grasp of Splunk Jargons but here ar... by jonglim New Member in Splunk Search 07-25-2018 0 3	0	3
I want to match multiple fields from different indexes whether these are matching to other index or not? I want to match multiple fields from different indexes whether these are matching to other index or not. I was thin... by nasrinmulani New Member in Splunk Search 07-25-2018 0 5	0	5
Lookup Table and Regex Hi, I need some help with lookup table combined with regular expressions. I have the an apache log file which looks... by aksampat81 New Member in Splunk Search 07-25-2018 0 2	0	2
How to combine two Splunk queries and extract the matching values of one of the fields? I have two splunk queries and both have one common field with different values in each query. I need to combine both ... by arrangineni Path Finder in Splunk Search 07-25-2018 0 2	0	2
Unable to search for the first 10,000 event only Hello, i'm trying to run a query but I would like it to stop at the first 10,000 events and I don't mean to display t... by gferreira New Member in Splunk Search 07-25-2018 0 2	0	2
Ask about splunk cookie modulation vulnerability and session fixing vulnerability Hi Does the splunk have the following security vulnerabilities? ( in Splumk 7.1.2 ) ㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡㅡ Threat... by khyoung7410 Communicator in Splunk Search 07-25-2018 0 0	0	0
is it possible to send splunk stored data on some filter condition outside of splunk to some external rest service I have an application which has a rest service. Now I want to send some data FROM splunk to that application rest ser... by baruamonojit New Member in Splunk Search 07-25-2018 0 0	0	0
splunk search produces different results when the same query is run several times - why? I run the query index=* tag=xyz customertype=abc action=failure sourcetype=abc123_winlog \| dedup _time, user, src, de... by vincenp2 New Member in Splunk Search 07-25-2018 0 1	0	1
is there a rest query I can use to identify all logfiles being monitored in an index, or all indexes? If I use the query index=* source=* \| dedup source \| table index source this appears to provide me with a list of all... by vincenp2 New Member in Splunk Search 07-25-2018 0 3	0	3

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Splunk Search

Best query to check who modified an AD group

Search for regimented connections

How to construct columns with the same data, and then use these pseudo columns to calculate

How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row?

How to exclude fields from LinearRegression command/use subsearch to generate fields for LinearRergession ?

Extract string from text based on character position

Splunk support telecom protocols

filtering search to exclude all instances of field 1 for when certain results in field 2

I am using the code for date but this is the time the event was created, not when it really happened. See Details

"Exception - com.splunk.mr.JobStartException: Failed to start MapReduce job."

I need help joining two cvs (customers and purchases) that shows what was purchased and if certain products were not purchased

Why is stats count by fieldname not working?

create table based on end time and time limit

Coalesce Fields With Values Excluding Nulls

Sendemail (Splunk CLI) always sends email whether results are available or not...

How to create a regex to extract data?

How to combine multiple complex searches into 1 output table?

I want to match multiple fields from different indexes whether these are matching to other index or not?

Lookup Table and Regex

How to combine two Splunk queries and extract the matching values of one of the fields?

Unable to search for the first 10,000 event only

Ask about splunk cookie modulation vulnerability and session fixing vulnerability

is it possible to send splunk stored data on some filter condition outside of splunk to some external rest service

splunk search produces different results when the same query is run several times - why?

is there a rest query I can use to identify all logfiles being monitored in an index, or all indexes?

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation