Splunk Search

Ask a Question

Discussions

Thread Info

How to extract URI following rex command?

How to extract URI following rex command? My field URI=/v4/cp/members/summary?hcid= AN5635356 &firstnm...

by Builder in

Error parsing dashboard XML: Duplicate search type primary is not allowed. Go to "Edit Source" to fix.

Hi, I have an entire Dashboard which works with Splunk 6.5.x. very well. Unfortunately, since I upgraded to Splunk...

by Path Finder in

Why is the search for my alert returning 0 results?

I currently have some alerts being triggered when they shouldn't be. The search is performing a host alive check, whe...

by New Member in

On the limit of delimiter in field extracter

I indexed some logs that have values are separated by commas, and I attempted to extract fields using delimiter, but ...

by Builder in

How to display the entire source under each event in the search results Events tab without clicking on "Show Source"?

Hi, Currently, If I search for any event in the search tab, I am getting only that particular event details from t...

by Explorer in

stats count issue

Hello, I hit a problem in the query below. I believed I'm not allow to form the stat count 2 times in the query. T...

by Path Finder in

How to write a query to get the result clusterwise

So my base Query to check sell is below:- index=myapp sourcetype=my_sourcetype host="*myhost*" "Logger*" AND "sold...

by Path Finder in

Convert time 15/Apr/2018:15:08:19.974 +0000 to epoch

Hi any help would be nice. Convert time 15/Apr/2018:15:08:19.974 +0000 to epoch

by Path Finder in

Why am I unable to pass values across to multivalue fields?

Hi, I am trying to build a dashboard with 4 MultiValue Input fields. MV_field1 with Values MVF1_A, MVF1_B,........

by Splunk Employee in

How to create an alert based on a field value regex pattern?

Hi I am looking for the best way to alert when a field value is not within a normal input range? For example, ...

by Builder in

Can you make append not start on a new line?

LIke if I run this query: index=myindex | stats count AS Total1 BY host | append [ search index=myindex | stats co...

by Communicator in

tstats summariesonly=t

as admin i can see results running a tstats summariesonly=t search. Same search run as a user returns no results. As ...

by Path Finder in

Regular Expression if then else

Hello everyone. I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename....

by New Member in

Rex expression multi line with line break

I copied the log from splunk to regex101.com. I am searching against Windows Event Viewer logs. Event Code 4722 and 4...

by Path Finder in

How to correlate two fields across the same index on two different logs with one field in common?

Hello, I have a device that sends its logs in multiple lines. It's an authentication device, and for one authentic...

by New Member in

Sum of values and max (or last) value in the same query

Hello I have to build up a query on Splunk, on wich I am a real newbie. I have a sheet in wich every record contains ...

by New Member in

Need help on search parallelization ? How and where to turn on this search parallelization mode?

Hi All, I need to turn on the search parallelization "Batch mode search parallelization" but not sure where I need to...

by Motivator in

Route and Filter Data from syslog (and syslog-ng is NOT an immediate option) Part 2

My override index confs are breaking and I cannot find the cause... Currently I have logs from two sources (A and ...

by Builder in

How can I append all lookup files with uncertain names (like(name,"record*%"))?

Hi Splunkers, I have lookup with WiFi authentication data (IP-Addr, mac-addr, username) . Let's say name=wifiauth_...

by Contributor in

How do I extract the time from Operating System events?

I am trying to extract the time from event from the AV system. The output is set up to be sent to Splunk over UDP eve...

by Contributor in

how to extract fields using regex

I have the below values in a field , Sadf123.dfd.com er-md-kt-mgmt.com feb-fe345@tbm.com I need to extract the ...

by Path Finder in

Regex Help

Hi community, Can you please help me create a regular expression that allows me to exclude the leading zeros of a ...

by Path Finder in

How do I extract this field from my sample Meraki Flow syslog events to use in search?

I am having trouble using a field that is in my log entries, but Splunk doesn't "auto-discover" it when I started ind...

by Explorer in

Can you shift one line of a multiline chart?

I have a need to track 2 related events. An object gets tagged if it fails a check. If the failure does not get fixed...

by Path Finder in

How to display only column(s) that has value greater than 0

Hi all, I have table looks like this Column1,Column2,Column3,....,ColumnX 1,2,0,....5 1,0,5,....3 2,3,0,....0 S...

by Path Finder in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How to extract URI following rex command?

Error parsing dashboard XML: Duplicate search type primary is not allowed. Go to "Edit Source" to fix.

Why is the search for my alert returning 0 results?

On the limit of delimiter in field extracter

How to display the entire source under each event in the search results Events tab without clicking on "Show Source"?

stats count issue

How to write a query to get the result clusterwise

Convert time 15/Apr/2018:15:08:19.974 +0000 to epoch

Why am I unable to pass values across to multivalue fields?

How to create an alert based on a field value regex pattern?

Can you make append not start on a new line?

tstats summariesonly=t

Regular Expression if then else

Rex expression multi line with line break

How to correlate two fields across the same index on two different logs with one field in common?

Sum of values and max (or last) value in the same query

Need help on search parallelization ? How and where to turn on this search parallelization mode?

Route and Filter Data from syslog (and syslog-ng is NOT an immediate option) Part 2

How can I append all lookup files with uncertain names (like(name,"record*%"))?

How do I extract the time from Operating System events?

how to extract fields using regex

Regex Help

How do I extract this field from my sample Meraki Flow syslog events to use in search?

Can you shift one line of a multiline chart?

How to display only column(s) that has value greater than 0

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

Preparing your Splunk Environment for OpenSSL3

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Using Machine Learning Toolkit to detect auth abus...

How to check MQ reconnects after a connection is d...

I cloned HTTP traffic collection from Splunk Strea...

Proactively stream data to different index after C...

Write Splunk log with Laminas