Splunk Query Reference guide
Posted on June 21, 2021 in Splunk
Simple Search with various AND index=index_name sourcetype=source_type host=host_nam source=source
Count of search criteria "LifecycleException" per day index=index_name sourcetype=exception_source_typs host=host_name LifecycleException | bucket _time span=day |stats count by _time
Count of search criteria "LifecycleException" by app index=index_name sourcetype=exception_source_typs host=host_name LifecycleException | stats count by originApplication
Dedup : Remove duplicates by Time index=index_name sourcetype=exception_source_typs host=host_name "java.lang.OutOfMemoryError" | sort - _time desc |table host,_time,source | bin _time span=300sec | dedup _time
Display Detailed Information on All Fields Available Within a Search
your_search_criteria | fieldsummary
Time Stamp
| eval Date=strftime(_time, "%Y-%m-%d")`
Convert _time to a date in the needed forma
search | convert timeformat="%Y-%m-%d" ctime(_time) AS date | stats count by date
OutOfMemory Search index=INDEX_NAME host=HOST_NAME "java.lang.OutOfMemoryError" | sort - _time desc |table host,_time | bin _time span=300sec | dedup _time
Extract MultiValue field from a File
search inv_sync_file=FILE_NAME.XML | eval Date=strftime(_time, "%+") , File = inv_sync_file|
rex max_match=0 field=_raw "VendorPartNumber\": \"(?
Condition
search your_search_with Valid as a field|| eval var=if(Valid > 10, "false", "true")
Add the column and show as report Ex: |table Date , _time, File, Valid, Invalid|addcoltotals | sort - _time desc
Adds all the columns in a search results and displays another column
addtotals fieldname=sum Ex: |table Date , _time, File, Valid, Invalid|addtotals fieldname=sum
Dashboards
How to add labels to Dashboard
<html>
<h5>…text</h5>
</html>
Splunk regex by default searches single line , to make regex for multiline (?m) and to match all the results matching regex
your_search_criteria | rex max_match=0 field=_raw "(?m)\n(?
Search for a Word using regular expression and retrieving fields on your_search_criteria | eval responseXML=replace(_raw,"^([\S\s\r\n]*)WORD_TOBE_SEARCHED","")| spath input=responseXML path=XXXX{}.YYY output=filed_output | table filed_output
Charts OverLay
your_search_criteria ConcurrentModificationException| timechart count as Exceptions_Count span=1h useother=f |appendcols [search another_search_criteria | timechart count as sub_count span=1h]
SPAPTH with XML namespace
your_search_criteria |eval xmessagePayload = messagePayload | spath input=xmessagePayload output=xorderID path=ord:AddOrderV2.ord:order.ff:AltOrderID |stats count(xorderID)
Get list of dest_ip which are not common between Yesterday and Today
your_search_criteria| set diff [search sourcetype=nessus source=Host_Enumeration earliest=-3d@d latest=-2d@d | stats count by dest_ip |table dest_ip] [search sourcetype=nessus source=Host_Enumeration earliest=-1d@d latest=now | stats count by dest_ip |table dest_ip]