Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
237 results
Sort by:
02-21-2023
04:38 AM
...ut I would like for the attributes of an event that have a json format to be further decomposed into fields.
This is an example of an event:
I would like for the `attributes.data` field to b...
Labels
- Labels:
-
field extraction
Show results in replies (5)
-
| spath output=data path=attributes.data | spath input=data
-
Use the spath command in your search query to extract fields from JSON events.
-
You can use spath in your search SPL to extract fields from JSON data.
-
...tructure. Using this works fine: | spath output=data path=attributes.data But if I w...
-
Oh, nice, this works! Thanks.
03-29-2023
06:47 AM
Hi, can I ask you for helping me with this small problem, please?
If I read the content of the lookUp using any criteria I receive attribute Attr1. This Attr1 is multivalue attribute.
Attr1
7...
09-05-2023
02:39 PM
I need to run a daily ldap search that will grab only the accounts that have change in the last 2 days. I can hard code a data into the whenChanged attribute. &n...
Labels
- Labels:
-
other
07-01-2015
02:21 PM
Hi,
I am trying to create a navigation menu with HTML href attribute as follows:
<nav color="3075AB">
<collection label="My Label">
<a href="/app/myappname/f...
08-29-2022
05:55 PM
12-06-2016
10:36 AM
We have thousands of Universal Forwarders (UF) in a large virtual desktop environment where we need to minimize the footprint and particularly the I/O as much as possible.
Question is for WinEvent...
04-01-2021
09:07 AM
I have basic web logs with username and jsessionid. I want to group (assume a single index, with one set of data). So thousands of events. I want to group by jsessionid and username - creating...
01-04-2024
06:40 PM
Here are the screenshots: In incident review setting, I have already labeled signature: Then in Correlation Search content setting, also I have setting the search query which could result in fi...
- Tags:
- correlation search
Labels
- Labels:
-
fields
Show results in replies (5)
-
...ncident management > Incident Review Settings] in the section Incident Review - Event Attributes. C...
-
Thanks @gcusello. ---to check if this field is displayed in the Notable event (running i...
-
Hi @jaro , if the field is in the Notable index, can be displayed. Did you checked if i...
-
It's OKAY now. In next triggered notable, it displayed. Thank you @gcusello.
-
Hi @jaro , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma...
09-21-2017
02:39 AM
[monitor:///tmp/ABC.txt] is my monitor stanza.
But if i have the file welcomeabcdef.txt that is "abc" (lowercase instead of uppercase) will it be read and indexed by Splunk?
12-02-2022
07:22 AM
...t;/unitData>
Before indexing I would like to create new additional attribute machine which should have value depended of these conditions:
case equipment="W052A-22G0014" machine =machine1
c...
Labels
- Labels:
-
props.conf
-
transforms.conf
-
XML
Show results in replies (5)
-
Hi @spisiakmi, you have to test and find the eval field calculation and then save it as a calculat...
-
Hi @spisiakmi, why create this field before indexing? You can create a calculated field at Search...
-
Hi @spisiakmi, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma ...
-
Hi @gcusello I try calculated field definitely. If you have a time to help me with it, it would be...
-
Hi @gcusello I wanna thank you very much. Your solution with calculated field was brilliant....
