Splunk Search

Community Activity

Event timestamp parsing incorrectly, pls help! Hi, While loading data, the timestamp that is being loaded is incorrect. For 2nd row in below records, the timestamp... by payalc New Member in Splunk Search 05-23-2018 0 0	0	0
How to change a value at index time Hiya, simple question here. I want to change the way a value is represented to me after I index, see the following: ... by JPrictoe Loves-to-Learn in Splunk Search 05-22-2018 0 4	0	4
User defined inputs for a field in splunk Hi, I have a situation, where user/admin need to verify if the event should be taken into consideration or not. In ... by Chandras11 Communicator in Splunk Search 05-22-2018 0 3	0	3
How to sort the dashboard title on navigation dynamic list? Hi Guys, I added a dynamic list on an app but the dashboard titles are not in order. How can I make it alphabeticall... by auaave Communicator in Splunk Search 05-22-2018 0 2	0	2
How to remove extra characters from an indexed event? Good afternoon Is there a way to remove extra characters (\xAF) from already indexed events such as this one: 20182... by Bellamar10 New Member in Splunk Search 05-22-2018 0 5	0	5
how to feed search result into "custom search command" and get output from custom search command? Hi, I have written a custom search command to send whois queries for ip addresses that are resulted from search head... by muratogul New Member in Splunk Search 05-22-2018 0 5	0	5
How to handle gracefully "No Results Found" Hello, I've the below query. I wanted to know when there're no errors, instead of showing "No Results Found", how can... by splunking1t New Member in Splunk Search 05-22-2018 0 3	0	3
Finding difference and percentage from 2 events withe same fields but difference index I have this query that returns this: Sample event in index=idx_A: year=2018 month=04 day=10 hour=09 event_count=100... by liondancer Explorer in Splunk Search 05-22-2018 0 10	0	10
need help with showing eval in stats so I have this query (host=pnr-proxy-prod* OR host=master.menlosecurity.com OR host=pnr-webui-prod) (source= s... by kiamco Path Finder in Splunk Search 05-22-2018 0 2	0	2
Is the "type" field removed from Splunk metrics in 6.6? So we have this query: index=_internal type=Usage st!=splunk_metrics earliest=-1d@d latest=-0d@d \| bucket _time sp... by EricLloyd79 Builder in Splunk Search 05-22-2018 0 5	0	5
How to create an alert if there are more than 5 login_id(s) associated to any unique sourceIP I have an app behind a WAF, and I am looking at the WAF logs to see how many unique login IDs are coming from a singl... by Log_wrangler Builder in Splunk Search 05-22-2018 0 2	0	2
Lookup and powershell command hi i want to use the powershell code below in order to know if the computer ping or not PS C:> Test-Connection -Comp... by jip31 Motivator in Splunk Search 05-22-2018 0 1	0	1
how can test my search query to make sure splunk is giving correct output I want to test the data retrieved by Splunk query. How can I validate the results. by anandbharti New Member in Splunk Search 05-22-2018 0 2	0	2
How to find peak time and the low time of the requests with the span of every hour? Hi Team, I like to find the peak time of the success requests (http_status=200) and also the least time of the reques... by balamv Engager in Splunk Search 05-22-2018 0 3	0	3
How to create a case statement with NOT LIKE option? \| eval usage=case(like(_raw,"%FirstClass%"),"A_Grade",like(_raw,"%SecondClass%"),"B_Grade",like(_raw,"%ThirdClass%"),... by zacksoft Contributor in Splunk Search 05-22-2018 0 7	0	7
Multiple average time calculations in a single search for Trellis Display This is my log format. { servicename: ServiceOne end.timestamp: 20000 start.timestamp: 19920 } { s... by angersleek Path Finder in Splunk Search 05-22-2018 0 1	0	1
How to use Collect to push the Host, Source and Sourcetype from the Original index ? I want to use the collect command and want to push the Host, source and source-type coming from the Original index. ... by sagrl Explorer in Splunk Search 05-22-2018 0 1	0	1
How can I use lookup as a filter? Hello When the value of lookup equal to result of event = do not show that event. How to create kinda search? by test_qweqwe Builder in Splunk Search 05-22-2018 1 1	1	1
How can I snap to the last second of the month? I'm looking through time specifiers in Splunk doc. I don't see how I can snap towards the end of month. If I do this:... by brdr Contributor in Splunk Search 05-22-2018 0 2	0	2
Why is the Drilldown not working? When I use the below drilldown query without eval its working fine and I'm getting the result as expected. But when I... by Shan Builder in Splunk Search 05-22-2018 0 4	0	4
Efficient way of extracting data from different log files Hi I have three log files which provide information for file transmission. The File transmission information is in ... by Mubarish Path Finder in Splunk Search 05-22-2018 0 8	0	8
How can I convert column value to column? I have the following output from my query: Search Query \| eval DateHour=year."-".month."-".day."-".hour \| chart ... by liondancer Explorer in Splunk Search 05-22-2018 0 3	0	3
Most efficient way to exclude two fields from a lookup Hi, Whats the most efficient way to use a lookup table within a query to exclude results where 2 fields exist, i.e. ... by jacqu3sy Path Finder in Splunk Search 05-21-2018 0 7	0	7
Search query taking ages to finish in Splunk 7.0.1 Hello, I have upgraded Splunk Enterprise to 7.0.1. One of the search query is taking ages to finish it. Same query f... by AKG1_old1 Builder in Splunk Search 05-21-2018 1 13	1	13
Extracting the data from Table Hi All, I am new to SPLUNK and building dashboards and I have requirement to count the records from the table No of... by varunapj New Member in Splunk Search 05-21-2018 0 1	0	1