Splunk Search

Community Activity

Tricky behavior of escaping backslash in regex Hey folks, I am doing some regex stuff by rex command and find some tricky behavior. Error: I tried to use \ to e... by ypeng_splunk Splunk Employee in Splunk Search 05-24-2018 1 2	1	2
Rex Field Question I have a message field in an event id that isn't extracting properly. The part I've having an issue with is when ther... by johnblakley Explorer in Splunk Search 05-24-2018 0 20	0	20
Why splunk is not comparing all values from 2 different fileds? Hi, I want to compare two fields in a certain timerange. I am working on 2 fields, those are process_ip and transfe... by chandana204 Communicator in Splunk Search 05-24-2018 0 1	0	1
eventcount - spanning over time I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetyp... by brdr Contributor in Splunk Search 05-24-2018 1 2	1	2
How to search for firewall data showing source ip, source port, destination ip, and destination port in tabular form? Hello, I am new to Splunk and I need to get a report showing Firewall transactions with source IP and source port, d... by abassydo2018 Explorer in Splunk Search 05-24-2018 0 3	0	3
Splitting a multivalue field on carreige return good morning, I am in the process of breaking out data from a data source that in one field contains a list of simil... by jeffsegal Explorer in Splunk Search 05-24-2018 0 1	0	1
eval parsing issue? index=xyz CurrentAgentSnapshot.Contacts{}.State=ENDED \| table CurrentAgentSnapshot.Contacts{}.StartTime There is ... by mwibowo1 New Member in Splunk Search 05-24-2018 0 7	0	7
Need a help in creating a dashboard to get information on the IP address? Hi, I got a request to create a dashboard to get the information on the ipaddress, with multiple panels and one input... by Hemnaath Motivator in Splunk Search 05-24-2018 0 3	0	3
How to get only second field=value from all events? Hi. I have 500 events where only second line of event have value for me. How to get that information from all events? by test_qweqwe Builder in Splunk Search 05-24-2018 1 1	1	1
Why is the iplocation command not showing city/region for all ip? I have an index "index_A" that contains IP address of client. But when I execute the following query, it does not sho... by kapilbk1996 Explorer in Splunk Search 05-24-2018 0 3	0	3
How to retrieve the last occurrence of an event right before another event I have a log4j log as source on Splunk 6.2.2 As in the title, I would like to get the first event that matches a sear... by lbentin New Member in Splunk Search 05-24-2018 0 1	0	1
How to send mail to the user in one mail if the values are combined? Hi There, I'd like to send mails to the people from my search table, the table looks like below: No. username Si... by garujoey Engager in Splunk Search 05-24-2018 0 10	0	10
How to perform stats count on all three indexes, and combine them to show as a Timechart? I have log file say A,B,C and their corresponding index is say index_A,index_B,index_C. I want to perform stats coun... by kapilbk1996 Explorer in Splunk Search 05-23-2018 0 2	0	2
what are the possibilities of getting different results for same search what are the possibilities of getting different results for same search ( there is no change in query and time) ? by raghu0463 Explorer in Splunk Search 05-23-2018 0 2	0	2
remove column name from \|table result I have a search that provides a table result: host="host1" index="main" \| head 1 \| table index host Is it possible... by Chubbybunny Splunk Employee in Splunk Search 05-23-2018 4 5	4	5
How to remove a column if only one column exists from a search? I have a timechart that shows the timechart of errors in a timeframe. index=......\| eval error=if(apiHttpStatus!=20... by brajaram Communicator in Splunk Search 05-23-2018 0 1	0	1
How do I count users that have logged in at least once a month for the last 3 months? Hi everyone, I want to do a distinct count of users that have: 1) Logged in at least once a month AND 2) They've ... by sharonmok Path Finder in Splunk Search 05-23-2018 0 8	0	8
How to Extract Named Capture Groups Using a Single Line in Props.conf Trying to extract named capture groups in a txt file, with the stipulation that it must be done from a single line in... by Kcrowley55 New Member in Splunk Search 05-23-2018 0 1	0	1
splunk functions process list Hi Splunkers i am traying to execute the next search using the function process "list" search \| stats list(FullName... by evinasco Communicator in Splunk Search 05-23-2018 0 1	0	1
Return only events where field value is in lookup table Hi all, I am running a search that returns many events. Some of these events contain a field value that is also in ... by bcarr12 Path Finder in Splunk Search 05-23-2018 2 1	2	1
Why am I getting error "No module named splunklib.searchcommands" trying to run a custom search command? Hey Everyone, Been struggling with this for hours now, when trying to run a custom search command I get: 'import s... by joseph_caraccio Engager in Splunk Search 05-23-2018 3 8	3	8
Use lookup file to match IP address from SPL query field to IP range in CSV file and return pertinent information for the range I have a CSV file ip_ranges that contains a list of ip_ranges along with the appropriate tag for that ip range. The C... by luigilombardi New Member in Splunk Search 05-23-2018 0 1	0	1
How to create custom relative time periods? I'm wondering if there isn't some way to use custom relative times in Splunk. I suspect not, but I thought I'd ask. ... by mfrost8 Builder in Splunk Search 05-23-2018 0 15	0	15
timechart for multiple, but similar, itemnames I am attempting to grab data from a set of Items that all have relatively similar names, i.e.: ItemName = LocX_VarY.... by splunk_question Explorer in Splunk Search 05-23-2018 0 5	0	5
How to use "set diff" and "diff" commands to list out new values in a file comparing different days/weeks/months/years? I have data which add new files every day. I want to compare today's data with previous day/week/month/year data and ... by chandana204 Communicator in Splunk Search 05-23-2018 0 3	0	3