Splunk Search

Community Activity

How to count a field that contains special values and display it with others using Piechart? I have a column named Target that contains several values where some ends with @myemail.com, but when I just used sta... by dannili Communicator in Splunk Search 07-25-2018 0 2	0	2
sourcetype=WinEventLog:ForwardedEvents missing details I've an WEC server which is forwarding logs to Splunk. I can see forwarded events coming in with sourcetype=WinEventL... by euroccp Engager in Splunk Search 07-25-2018 1 0	1	0
Question about subsearch Hi all, I have below query and the results like below table, is there a way that only search and display total count... by Min1025 Explorer in Splunk Search 07-24-2018 0 3	0	3
Search getting cancelled remotely or expired HI Splunkers, When running a search with inputlookup command, I suddenly see the following error messages. This is ... by renjujacob88 Path Finder in Splunk Search 07-24-2018 0 3	0	3
Detect Start-of-Week & Weekly aggregations Hello splunkers, We have to calculate some KPIs, on time-series data, aggregated by multiple factors, with time bei... by anirbandasdeb Path Finder in Splunk Search 07-24-2018 0 1	0	1
Splunk : Logs read after deleting using \| delete command Hello Splunkers, Lately I had to delete specific source type logs from the index and used the command \|delete from t... by ankithnageshshe Path Finder in Splunk Search 07-24-2018 0 1	0	1
creating a custom search command but i keep getting this error. Anything i am doing wrong? Traceback (most recent call last): File "wordcloudcb.py", line 2, in from splunklib.searchcommands import disp... by Bentash Explorer in Splunk Search 07-24-2018 0 0	0	0
How to compare search results to a list? I have waf logs for an application that provides userID and srcIP which I pipe to geoinfo to get the city state count... by Log_wrangler Builder in Splunk Search 07-24-2018 0 3	0	3
How to search for Top 2-way communicators using top src_ip,dest_ip to find top dest_ip,src_ip? Hello all, I have some IDS alerts "top src_ip,dest_ip" in which I want to see if the dest_ip is contacting the src_i... by jcrochon Explorer in Splunk Search 07-24-2018 0 8	0	8
How can I select the maximum X values in a field based on another field? I have a data set that looks like this: X Y 1 5 1 4 1 3 1 2 1 1 2 10 2 9 2 8 2... by paulkrier Engager in Splunk Search 07-24-2018 0 10	0	10
Why does latest Splunk still ship unsigned Mach-O binaries for macOS? The installer package (.pkg) is signed by Developer ID Installer: Splunk, Inc (CKEJB3F324). However, neither the DMG ... by droe Explorer in Splunk Search 07-24-2018 1 0	1	0
Reuse field extraction in another field extraction/transformation? I am looking for a solution to extract certain types of UIDs and therefore defined a basic UID field extraction: (?<U... by jmartens Path Finder in Splunk Search 07-24-2018 0 3	0	3
Remove first four lines of field I want to display each event's raw text in a table column, but I need to remove the first four lines of the field (te... by calarie001 Explorer in Splunk Search 07-24-2018 0 3	0	3
Count of consecutive like events. Hi all, Is there a way to produce a count of consecutive like events in Splunk? Example Logs bookingEvent booking... by topleyg New Member in Splunk Search 07-24-2018 0 9	0	9
export the search results directly into Amazon S3 I have a requirement where I need to export the search results directly into Amazon S3. I need to export a daily repo... by jarapally Explorer in Splunk Search 07-24-2018 1 0	1	0
Indexing updatable data from a relational database Dear all, I am wondering what is the best strategy regarding indexing data coming from a relational database which c... by ecoquelin Explorer in Splunk Search 07-24-2018 0 1	0	1
Is there a way to customize delimiter based field extractions via the UI? Is there a way to customize delimiter based field extractions via the UI? Looks like you can do it for regular expres... by ytenenbaum_splu Splunk Employee in Splunk Search 07-24-2018 0 1	0	1
JOIN how to save as an eventtype ? Hello Splunkers, I'm using JOIN expression to classify a type of errors. I want to have all errors classified like ... by jermi001 Engager in Splunk Search 07-24-2018 0 2	0	2
Splunk Search content for a particular string Hi Team, I have search in search head which gives output like in snapshot. Now i want to assign a new field to clien... by kaushal21rajput New Member in Splunk Search 07-24-2018 0 5	0	5
How to extract many fields with a single regular expression ? Hi, I have a sample log file as shown in the attached screenshot. I have many such tags in the log file. I want to ... by Allampally Path Finder in Splunk Search 07-24-2018 0 2	0	2
How to create a rex string with "#" sign? I have data 2018-07-23 21:00:54##7049015762##358479078622895##2##4000######N##ABS##\|##USER_NUMBER##QUERY##1##90864 ... by jianyu75074 New Member in Splunk Search 07-23-2018 0 1	0	1
need line breaking for the following data generated as CSV Good day All, My skill in regex is very limited. Can anyone help me with the props.conf for the following data? ITs b... by ranjitbrhm1 Communicator in Splunk Search 07-23-2018 0 6	0	6
best practices vs my code hello all i use this code but he has not good performances following splunk best practices, is it possible to give m... by jip31 Motivator in Splunk Search 07-23-2018 0 7	0	7
Modular Input - interval Hi, i've noticed that when the time required to execute a modular input's streamEvents method is greater than the con... by dluyk New Member in Splunk Search 07-23-2018 0 0	0	0
Accessing results from search after timecharting Hi all, I'm trying to write a query that pulls up some data, time charts it, then calculates a percentage based on h... by marrette Path Finder in Splunk Search 07-23-2018 0 2	0	2