Splunk Search

Community Activity

Using a literal pipe "\|" character in an extracted regex field I'm creating an extracted field using a regex, and I want to use a literal pipe "\|" character in the regex. My unders... by jbrenner Path Finder in Splunk Search 06-14-2018 0 4	0	4
Why is the lookup for CIDR table not working? I have been trying to create a basic lookup within Splunk where we can search an IP and get back some information.The... by ng87 Path Finder in Splunk Search 06-14-2018 0 1	0	1
Using regex, how to exclude any events in the host field and keep the rest? One big syslog file I need to index (monitor) daily. Many hosts log to this syslog file. I want to exclude any even... by some_guy Path Finder in Splunk Search 06-14-2018 0 3	0	3
How to compare search result with a lookup file I have a lookup file with the following fields original_login_name, client_net_address and Datase_Name I have these... by LeandroKopke Explorer in Splunk Search 06-14-2018 0 1	0	1
tstats not working on all index time fields? I have a python script (requests and post) that sends json events to an Indexer using HTTP Event Collector (HEC). I ... by moneybox Explorer in Splunk Search 06-14-2018 0 1	0	1
How to create a regex that removes everything before the second underscore? I'm trying to create a regex that removes everything before the second underscore in a string. The number of charact... by gbwilson Path Finder in Splunk Search 06-14-2018 0 3	0	3
Finding the difference between to separate fields? Good morning everyone, I am trying to find the difference between to fields. I have tried the eval command to subtr... by dreschke Explorer in Splunk Search 06-14-2018 0 7	0	7
conditional rex in splunk I have a field called Number and it has got a value like : \| inputlookup Numbers.csv Number 102 2 45 204 345 100 1... by abhayneilam Contributor in Splunk Search 06-14-2018 0 2	0	2
How to make a table with 3 datas Each day i execute my search This search give me the number of events with status OK or KO by enterprise nameEnterp... by faribole Path Finder in Splunk Search 06-14-2018 0 3	0	3
regex to extract multiple email addresses in splunk search How to list out all the email addresses in a splunk search which displays the following results. Storing shipConfirm... by pavanae Builder in Splunk Search 06-14-2018 0 3	0	3
Can we use wildcard characters in a lookup table? Can I create a lookup table with wildcard character ? I have a lookup like input,output user,USERNAME so anythi... by rakesh_498115 Motivator in Splunk Search 06-14-2018 7 9	7	9
How to create a subsearch which would generate a csv file and use this as input for another search string at same point in time. Hi all, I would like to generate the csv file form one search and use that as lookup file for another query . Here... by Veeruswathi Explorer in Splunk Search 06-14-2018 0 2	0	2
Splunk Query On Selecting The Range Of Vales For dashboard Hi Team, Would like to design the query for the below requirement where we wanted to capture 2 dash boards as below ... by Vigneshprasanna Explorer in Splunk Search 06-14-2018 0 0	0	0
Events count changing on every search HI, I am facing a weird situation. I am executing a query that will give last one day data on hourly basis. base s... by prathapkcsc Explorer in Splunk Search 06-14-2018 0 14	0	14
Regex Query Help: Need to Write a regex query for my log Below given is one section of an event. The event has multiple such sections. I want to write a regex search query so... by mintughosh Path Finder in Splunk Search 06-14-2018 0 6	0	6
input lookup get values for the lookup only Hi, I have a very Basic question. I have an index index1 and sourcetype=ST1 with fields fieldA, fieldB and fieldC. I... by Chandras11 Communicator in Splunk Search 06-14-2018 1 8	1	8
Need help in splunk regex {"runDate":"2018-05-26T02:42:42 BRT","dataDate":"20180524","jobName":"autocompleteIndexerCounters","counterList":[{"c... by pswalia06 Explorer in Splunk Search 06-14-2018 0 2	0	2
How to get only the latest values of a Parameter for each server? I have multiple Parameters and their values lister for each server. I am using the beloq command at last: chart lim... by abhi04 Communicator in Splunk Search 06-14-2018 0 1	0	1
How to convert the values of multiple fields to number? Hi All, Good day! I just want to ask for some help here.  I have multiple fields with the data I'm working on wit... by jvmerilla Path Finder in Splunk Search 06-14-2018 1 5	1	5
Subsearch Not Filtering Results I am trying to pull a list of filtered IPs from one index and then use that list as a reference to see external traff... by jcullins21 New Member in Splunk Search 06-14-2018 0 2	0	2
Line chart does not display the value zero even after setting the code to use one decimal place Hello, Seeking for any assistance on the issue I am encountering. Issue: Line chart does not display the value zer... by marklindo New Member in Splunk Search 06-13-2018 0 8	0	8
How to separate rows as column? I have trouble in manipulating the table Date contains (index, name, date). name ..... date ................ coun... by apple143 Engager in Splunk Search 06-13-2018 0 7	0	7
Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error" \| tstats count(host) as count WHERE index=* earliest=-1d@d latest=@d by host\|search [\|inputlookup mylast\|fields host... by saisrujan28 Explorer in Splunk Search 06-13-2018 0 6	0	6
How to get value of a field corresponding to max value of another field Hi, I have a table with the fields 'loadtime', 'application', and 'user'. First I want to compute the maximum value o... by ggangwar Path Finder in Splunk Search 06-13-2018 0 7	0	7
Average on a value over time Hi, I have this query (yes I know its ugly but it works  ) . What I need to do is present the current RSSI value (t... by dbcase Motivator in Splunk Search 06-13-2018 0 6	0	6