Splunk Search

Community Activity

is it possible to send splunk stored data on some filter condition outside of splunk to some external rest service I have an application which has a rest service. Now I want to send some data FROM splunk to that application rest ser... by baruamonojit New Member in Splunk Search 07-25-2018 0 0	0	0
splunk search produces different results when the same query is run several times - why? I run the query index=* tag=xyz customertype=abc action=failure sourcetype=abc123_winlog \| dedup _time, user, src, de... by vincenp2 New Member in Splunk Search 07-25-2018 0 1	0	1
is there a rest query I can use to identify all logfiles being monitored in an index, or all indexes? If I use the query index=* source=* \| dedup source \| table index source this appears to provide me with a list of all... by vincenp2 New Member in Splunk Search 07-25-2018 0 3	0	3
Transpose and aggregate Hello, i need help to obtain the below results. From: num has_breached sla_name 100 false ... by lvbrunello New Member in Splunk Search 07-25-2018 0 5	0	5
Field Extraction from html tags align="left"> Accepted <td align="right" class="mailViewRowReadEven"> 64399 <td align="right" class="ma... by Nadhiyaa Path Finder in Splunk Search 07-25-2018 0 2	0	2
How to count a field that contains special values and display it with others using Piechart? I have a column named Target that contains several values where some ends with @myemail.com, but when I just used sta... by dannili Communicator in Splunk Search 07-25-2018 0 2	0	2
sourcetype=WinEventLog:ForwardedEvents missing details I've an WEC server which is forwarding logs to Splunk. I can see forwarded events coming in with sourcetype=WinEventL... by euroccp Engager in Splunk Search 07-25-2018 1 0	1	0
Question about subsearch Hi all, I have below query and the results like below table, is there a way that only search and display total count... by Min1025 Explorer in Splunk Search 07-24-2018 0 3	0	3
Search getting cancelled remotely or expired HI Splunkers, When running a search with inputlookup command, I suddenly see the following error messages. This is ... by renjujacob88 Path Finder in Splunk Search 07-24-2018 0 3	0	3
Detect Start-of-Week & Weekly aggregations Hello splunkers, We have to calculate some KPIs, on time-series data, aggregated by multiple factors, with time bei... by anirbandasdeb Path Finder in Splunk Search 07-24-2018 0 1	0	1
Splunk : Logs read after deleting using \| delete command Hello Splunkers, Lately I had to delete specific source type logs from the index and used the command \|delete from t... by ankithnageshshe Path Finder in Splunk Search 07-24-2018 0 1	0	1
creating a custom search command but i keep getting this error. Anything i am doing wrong? Traceback (most recent call last): File "wordcloudcb.py", line 2, in from splunklib.searchcommands import disp... by Bentash Explorer in Splunk Search 07-24-2018 0 0	0	0
How to compare search results to a list? I have waf logs for an application that provides userID and srcIP which I pipe to geoinfo to get the city state count... by Log_wrangler Builder in Splunk Search 07-24-2018 0 3	0	3
How to search for Top 2-way communicators using top src_ip,dest_ip to find top dest_ip,src_ip? Hello all, I have some IDS alerts "top src_ip,dest_ip" in which I want to see if the dest_ip is contacting the src_i... by jcrochon Explorer in Splunk Search 07-24-2018 0 8	0	8
How can I select the maximum X values in a field based on another field? I have a data set that looks like this: X Y 1 5 1 4 1 3 1 2 1 1 2 10 2 9 2 8 2... by paulkrier Engager in Splunk Search 07-24-2018 0 10	0	10
Why does latest Splunk still ship unsigned Mach-O binaries for macOS? The installer package (.pkg) is signed by Developer ID Installer: Splunk, Inc (CKEJB3F324). However, neither the DMG ... by droe Explorer in Splunk Search 07-24-2018 1 0	1	0
Reuse field extraction in another field extraction/transformation? I am looking for a solution to extract certain types of UIDs and therefore defined a basic UID field extraction: (?<U... by jmartens Path Finder in Splunk Search 07-24-2018 0 3	0	3
Remove first four lines of field I want to display each event's raw text in a table column, but I need to remove the first four lines of the field (te... by calarie001 Explorer in Splunk Search 07-24-2018 0 3	0	3
Count of consecutive like events. Hi all, Is there a way to produce a count of consecutive like events in Splunk? Example Logs bookingEvent booking... by topleyg New Member in Splunk Search 07-24-2018 0 9	0	9
export the search results directly into Amazon S3 I have a requirement where I need to export the search results directly into Amazon S3. I need to export a daily repo... by jarapally Explorer in Splunk Search 07-24-2018 1 0	1	0
Indexing updatable data from a relational database Dear all, I am wondering what is the best strategy regarding indexing data coming from a relational database which c... by ecoquelin Explorer in Splunk Search 07-24-2018 0 1	0	1
Is there a way to customize delimiter based field extractions via the UI? Is there a way to customize delimiter based field extractions via the UI? Looks like you can do it for regular expres... by ytenenbaum_splu Splunk Employee in Splunk Search 07-24-2018 0 1	0	1
JOIN how to save as an eventtype ? Hello Splunkers, I'm using JOIN expression to classify a type of errors. I want to have all errors classified like ... by jermi001 Engager in Splunk Search 07-24-2018 0 2	0	2
Splunk Search content for a particular string Hi Team, I have search in search head which gives output like in snapshot. Now i want to assign a new field to clien... by kaushal21rajput New Member in Splunk Search 07-24-2018 0 5	0	5
How to extract many fields with a single regular expression ? Hi, I have a sample log file as shown in the attached screenshot. I have many such tags in the log file. I want to ... by Allampally Path Finder in Splunk Search 07-24-2018 0 2	0	2