All Posts

PickleRick · ‎02-26-2024

If you just want a regex which you can use with SEDCMD, just match each part separately and substitute with nothing. And you can use the same match several times to match and substitute all matching ...

If you just want a regex which you can use with SEDCMD, just match each part separately and substitute with nothing. And you can use the same match several times to match and substitute all matching strings. Like s/[RP]DPword=[^=]+//g

PickleRick · ‎02-26-2024

You were close. index=whatever [ | inputlookup lookup.csv | eval search=tenant."xxx" | table search ]

PickleRick · ‎02-26-2024

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Timechart You'll want the useother and limit options for the timechart command.

burwell · ‎02-26-2024

Sorry I misread this as wanting a leading space. Ignore my answer.

PickleRick · ‎02-26-2024

burwell · ‎02-26-2024

Try using printf | makeresults | eval test=printf(" %s","this is a test") | table test

deepdive100 · ‎02-26-2024

Lookup file `tenants.csv` tenant, tenant1, tenant2, tenant3, tenant4, Desired query index=index1 (tenant1xxx OR tenant2xxx OR tenant3xxx OR tenant4xxx) I'm having a tough time getting...

Lookup file `tenants.csv` tenant, tenant1, tenant2, tenant3, tenant4, Desired query index=index1 (tenant1xxx OR tenant2xxx OR tenant3xxx OR tenant4xxx) I'm having a tough time getting this work. Trying lookup is not working because I am not searching any existing fields. Subsearching with inputlookup is not working at all, not sure why. So in a nutshell, I'm trying to inject (not just each value from the lookup file but also appending `xxx`), as an OR list of raw strings. Any ideas?

JyPl4wNYu7GV1uL · ‎02-26-2024

I know this is ancient, but I had the same issue with blank results because of this: https://community.splunk.com/t5/Splunk-Search/What-would-intermittently-cause-less-events-to-return-the-raw/m-p/4...

I know this is ancient, but I had the same issue with blank results because of this: https://community.splunk.com/t5/Splunk-Search/What-would-intermittently-cause-less-events-to-return-the-raw/m-p/490525

LearningGuy · ‎02-26-2024

Hello, How to add space on a text on a single value? Thank you for your help Adding spaces did not have any affect. I was trying to align the text to the left | makeresults | eval tes...

Hello, How to add space on a text on a single value? Thank you for your help Adding spaces did not have any affect. I was trying to align the text to the left | makeresults | eval test="this is a test " | table test If I added period, it worked | makeresults | eval test="this is a test..........................." | table test

edgarrity · ‎02-26-2024

We have a dashboard created with the XML Dashboard Classic editor which presents a table of alerts and allows the user to open a second dashboard to see the details. The parent dashboard uses the dr...

We have a dashboard created with the XML Dashboard Classic editor which presents a table of alerts and allows the user to open a second dashboard to see the details. The parent dashboard uses the drill-down feature to link to the child dashboard. The value of a hidden column in the row the user clicked on is passed to the child dashboard in the URL string. We are porting this to Dashboard Studio and need to know how to link using the value from a hidden column? It seems that the column must be visible for the drilldown link to work.

alexa · ‎02-26-2024

Thank you @Richfez - once I substituted my values into the search it works great! And the explanation/example makes it very clear what is happening in the search.

pchanons1 · ‎02-26-2024

Hi , I was wondering what features does Splunk offer in auditing workload in DB2 z/OS. We are looking to audit a bunch of users in DB2 z/OS using SPLUNK. I would like to know what is possible with...

Hi , I was wondering what features does Splunk offer in auditing workload in DB2 z/OS. We are looking to audit a bunch of users in DB2 z/OS using SPLUNK. I would like to know what is possible with Splunk and what is not. Thank You.

abi2023 · ‎02-26-2024

my following regex is matching "RDPword=jsndksjs834u935=PDUserId=jsndksjs834u935=PDPword=jsndksjs834u935" I want to exclude follwing "=PDUserId=jsndksjs834u935=" how do I modify the this rex to n...

my following regex is matching "RDPword=jsndksjs834u935=PDUserId=jsndksjs834u935=PDPword=jsndksjs834u935" I want to exclude follwing "=PDUserId=jsndksjs834u935=" how do I modify the this rex to not match =PDUserId=jsndksjs834u935= RDPword=([^=]+)=PDUserId=([^=]+)=PDPword=([^=]+) RDPword=([^=]+)=PDUserId=([^=]+)=PDPword=([^=]+)

Skeer-Jamf · ‎02-26-2024

Finally got around to reading about SC4S and I'm fairly certain this is the route forward. I got the ok to replace the pair of UF's with a Heavy if needed. But I have a good feeling that the SC4S wil...

Finally got around to reading about SC4S and I'm fairly certain this is the route forward. I got the ok to replace the pair of UF's with a Heavy if needed. But I have a good feeling that the SC4S will be able to handle things very well.

richgalloway · ‎02-26-2024

Regex is very case-sensitive. This matches the sample event. RDPword=([^=]+)=PDUserId=([^=]+)=PDPword=([^=]+)

richgalloway · ‎02-26-2024

Here is one of perhaps many ways to do that. It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values. | rex field=ROW1 "(?<ROW1>.)" | s...

Here is one of perhaps many ways to do that. It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values. | rex field=ROW1 "(?<ROW1>.)" | stats sum(ROWcount) as ROWcount by ROW1

catherinelam · ‎02-26-2024

As the title suggests, our system needs a proxy to hit our SAML2 authentication service, but I don't see an option to provide a proxy, or to provide an attribute to describe a proxy like we can do in...

As the title suggests, our system needs a proxy to hit our SAML2 authentication service, but I don't see an option to provide a proxy, or to provide an attribute to describe a proxy like we can do in the apps. Can someone please suggest documentation? Thank you!

Anud · ‎02-26-2024

Hi Team, how to Sum of the field based on the other field values. Row1 field values will be 0-9 and a-z. Sample one given below: ROW1 ROWcount 11 22 12 54 13 34 a1 56 a2 ...

Hi Team, how to Sum of the field based on the other field values. Row1 field values will be 0-9 and a-z. Sample one given below: ROW1 ROWcount 11 22 12 54 13 34 a1 56 a2 78 d3 67 c4 78 c5 79 Final Output be like: ROW1 ROWcount 1 110 a 134 d 67 c 157 Thanks in Advance!!

iamryan · ‎02-26-2024

@Sathish.Perugu, I found this AppD Docs Page, looks like you might be able to rename them? https://docs.appdynamics.com/appd/24.x/24.2/en/infrastructure-visibility/server-visibility/service-avai...

@Sathish.Perugu, I found this AppD Docs Page, looks like you might be able to rename them? https://docs.appdynamics.com/appd/24.x/24.2/en/infrastructure-visibility/server-visibility/service-availability-monitoring

abi2023 · ‎02-26-2024

I need to mask data before it being index. my sample his log structure. "2023-11-02 06:53:00 xx.xxx.xxx.xx GET /Security/Security/Logon 123 - xx.xxx.x.xxx Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)...

I need to mask data before it being index. my sample his log structure. "2023-11-02 06:53:00 xx.xxx.xxx.xx GET /Security/Security/Logon 123 - xx.xxx.x.xxx Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.198+Safari/537.36=RDPword=jsndksjs834u935=PDUserId=jsndksjs834u935=PDPword=jsndksjs834u935=RFuser=&securityToken=xxxxxxxx 200 0 0 14" I need to match highlights in green "RDPword=jsndksjs834u935", and "PDPword=jsndksjs834u935" I am using regex this matching the following which I don't want it match "PDUserId=jsndksjs834u935=" RDPWord=([^=]+)=PDUUserId=([^=]+)=PDPWord=([^=]+) Can someone help me Thanks

All Posts

All Posts

Re: help with regex for masking?

Re: Passing lookup file contents as individual search strings

Re: Splunk Alerts

Re: How to add space on a text on a single value?

Re: How to add space on a text on a single value?

Re: How to add space on a text on a single value?

Passing lookup file contents as individual search strings

Re: Events return blank results

How to add space on a text on a single value panel?

How to drilldown in Dashboard Studio using the value of a hidden table column

Re: How to derive percentage of expected and actual count from two searches with different count strategies

DB2 z/OS Auditing using Splunk ...

Re: help with regex for masking?

Re: Load balancing Splunk UF hosts that are also rsyslog receivers

Re: help with regex for masking?

Re: Sum of the field based on the other field values

How to Set Proxy for SAML2 Authentication Method

Sum of the field based on the other field values

Re: AppDynamics metric browser - Service Availability

help with regex for masking?

All Posts

Are you a member of the Splunk Community?

All Posts