Splunk Search

Community Activity

How can i use a field value from lookup file to set my earliest time for search dynamically ? Hi, I have a PriorityEngines.csv lookup file like this - EngineName,TimePeriod Engine1,5 Engine2,10 Engine3,12 I hav... by Upas02 Path Finder in Splunk Search 06-30-2018 0 3	0	3
How to return events from a different time range dependent upon field value? Completely new to Splunk, and hoping to find help with a search I'm using for a dashboard, but cannot get this workin... by ShaunSutton New Member in Splunk Search 06-30-2018 0 4	0	4
adding multiple fields and value for fillnull Following search is working perfectly fine. If field1 is Null it gets substitute by RandomString1 search \| fillnull ... by ataunk Explorer in Splunk Search 06-30-2018 0 8	0	8
Using streamstats to track currently active values Given input like this: id, action, message 1, add, Adding this thing 2, add, Adding this other thing , ... by vbumgarner Contributor in Splunk Search 06-30-2018 3 19	3	19
How do scheduled searches work? General question about how scheduling searching behaves, we have a 3 node SH cluster and couple of indexers, and th... by perfecto25 Path Finder in Splunk Search 06-30-2018 0 6	0	6
OTHER option in timechart doesn't work Hi Splunkers, I have search like this: index="myindex" host="myhost" \| timechart span=1month latest(all_cnt) as "Num... by amresovci New Member in Splunk Search 06-30-2018 0 1	0	1
How to join two searches? Hi, I am trying to join two of my searches in splunk using a common field uniqueID but I am getting a error in Splunk... by Shashank_87 Explorer in Splunk Search 06-30-2018 0 4	0	4
How to access values from event in Splunk I want to access the values of the events that are coming after splunk search . Data is coming in below format on t... by gauravepi Path Finder in Splunk Search 06-30-2018 0 2	0	2
CIM version check How do you check your CIM version info if you are using Splunk Managed Cloud Service? by kevinleeV New Member in Splunk Search 06-30-2018 0 3	0	3
transaction alternative Have data in the following format ; 1:26:[06/28/2018][08:00:00.149][6959][3868982128][s537565/r17][servername1][filen... by jhnworks New Member in Splunk Search 06-30-2018 0 1	0	1
How to use If and Not statement in one pass? Hello all, What's the best way to use a NOT statement in an if statement. I'm trying to accomplish something simila... by splunker1981 Path Finder in Splunk Search 06-29-2018 0 2	0	2
How to search for a keyword2 with in 10 minutes after keyword1 occured in events? I have a events log something like this, 2018-06-29 03:34:23.090 -5 Thread-55 CM 6107 1 Content Manager is ... by SapthagiriAavik Explorer in Splunk Search 06-29-2018 0 1	0	1
map command usage for a adding a new column I have a SEARCH-1 Which Gives results like -time column1 column2 I want to run a secondary search for each value... by joydeep741 Path Finder in Splunk Search 06-29-2018 0 1	0	1
How can I add where statement but only if something matches Hello experts, I have a search that I am trying to add a where statement to which compares fieldvalueA to fieldvalue... by splunker1981 Path Finder in Splunk Search 06-29-2018 0 4	0	4
Extra indexed field in _meta require * in search query Hi, I have an inputs.conf as below in my UniversalForwarder [monitor::///private/var/log/system.log] _meta = serial... by jeanmatthieu Explorer in Splunk Search 06-29-2018 1 4	1	4
Find duplicate events for a pattern that occurred in the same timestamp My requirement is to find duplicate events for a pattern that occurred in the same 'second' of timestamp after stripp... by gbehl New Member in Splunk Search 06-29-2018 0 4	0	4
How to do system wide search concurreny (Adhoc + Scheduled)? Hello Splunkers, I'am trying to understand the concept of Search head concurrency. I have a SHC with three search h... by ankithnageshshe Path Finder in Splunk Search 06-29-2018 0 1	0	1
Issues with OMS Query Filters Use case: I want to pull a specific set of security events from OMS into Splunk. Within OMS log search, querying for:... by blangrill Explorer in Splunk Search 06-29-2018 1 8	1	8
How to use values from one search as 'earliest' and 'latest' values in another? I have sequence of events from a VPN session. The last message in the sequence contains a field for duration of the s... by _smp_ Builder in Splunk Search 06-29-2018 0 5	0	5
Show full x axis labels in chart Hi my x axis labels for a chart are really long. E.g. 2017-19-18 22:33:22:10247392048 ABSSHEUVCBKSOWNMSKWOKSNKJWK Be... by dhruv101 Path Finder in Splunk Search 06-29-2018 0 4	0	4
How to calculate a running average of events by a user? Hi I am trying to write a query where I can monitor transactions/hr/user. I would like an output where I have the... by Log_wrangler Builder in Splunk Search 06-29-2018 0 4	0	4
How to search events that contain a userID from a list? I have a list of userIDs on a text file, called WatchList.txt Splunk can natively parse out a field value pair (user... by Log_wrangler Builder in Splunk Search 06-29-2018 0 7	0	7
How to create a graph to populate for a certain time duration in timechart? I have start time and end time for 5 rows with duration, i need a graph which populates from start_time till the dura... by msaranya Observer in Splunk Search 06-29-2018 0 2	0	2
Role based data masking in splunk 6.0.1? Hi, I need to know is it role based data masking is possible in 6.0.1? If yes then please let me know what are the p... by krish3 Contributor in Splunk Search 06-29-2018 1 9	1	9
untable for multiple aggregate stats Hello, I would like to plot an hour distribution with aggregate stats over time. For instance, I want to see distrib... by sistemistiposta Path Finder in Splunk Search 06-29-2018 0 3	0	3