Splunk search query examples
Jan 12, 2018 · I am new to splunk and was wondering if anyone has a document they don't mind sharing detailing "example search queries" as a starting point? any help would be appreciated. …
Solved: How to use 2 different query in dashboard and hide.
Apr 5, 2025 · Hi All, I have created one query and it is working fine in search. I am sharing part of code from dashboard. In first part of call if you see I have hardcoded by earliest and latest time …
Solved: Splunk query - lookup utilization - Splunk Community
Jul 25, 2025 · Solved: Hello all, I am working on an Splunk query which suppose to filter some logs by utilizing data from lookup. Consider a field called host. I
Nested query - Splunk Community
Jan 26, 2024 · Hi, So my task is to extract a field from a query and search for that field. That query will give an object value as a string and want to extract data from there. In summary, I need 3 …
How do YOU use splunk! (Search/Query Examples)
Jun 13, 2013 · Our company just started using Splunk, and after experimenting with some basic commands it certainly proves to be a powerful yet simple to use search processor. Since our …
Query for Users, Roles, AD Groups and Indexes. - Splunk Community
Sep 19, 2019 · Hi, I'm trying to get the query to pull out the following, but struggling a bit with all the joins. I need to get a list of the following in a report. List of users The Roles each user is …
How to Comment a Single Line in SPL Query? - Splunk Community
Hi Splunkers, I need to know how to comment out a single line in an SPL query when working in search and reporting. Could someone please provide an example? Thanks,
Specify specific time range in query - Splunk Community
Aug 25, 2020 · Hello Splunkers I have an IIS log that I am testing against and I have a need to test for a specified range The _time field in the log is formatted like this 2020-08 …
Solved: Query to check the indexer is down, up or in unkno.
Mar 12, 2025 · Is there is any Query to check whether the indexers status is down, up or in unknown state . I can check in monitoring console but need a query to see for all indexer.
How to display the contents of a lookup file? - Splunk Community
Sep 10, 2011 · I would like to see the rows of my csv lookup file through a splunk query. Is there any option which reads the lookup file and prints all the rows of lookup file.