| | I have an input playbook with two output variables. I can retrieve these variables when I call the playbook using the... 0 4 | 0 | 4 | |
| | I have the Splunk App for SOAR Export running. I can open one of the forwarding events, click "Save and Preview' and... 0 1 | 0 | 1 | |
| | I've seen someone use this traffic search function but can't find it myself:How can I access this traffic search func... 0 3 | 0 | 3 | |
| | Hello Splunkers, I started to use splunk uni forwarder in my job and I am kinda new to systems.My dashboard working g... 0 1 | 0 | 1 | |
| | I am testing out the Splunk Operator Helm chart to deploy a C3 architecture Splunk instance. At the moment everything... 0 0 | 0 | 0 | |
| | I understand that maxTotalDataSizeMB takes precedence over frozenTimePeriodInSecs.What happens if frozenTimePeriodInS... 0 5 | 0 | 5 | |
| | This is the search with some anonymization. index=index_1 sourcetype=sourcetype_1 field_1 IN ( [ search index=in... 0 6 | 0 | 6 | |
| | We are having an issue where in order to see correct JSON syntax highlighting it requires setting "max lines" to "all... 0 1 | 0 | 1 | |
| | How do I dedup or filter out data with condition?For example:Below I want to filter out row that contains name="name0... 0 11 | 0 | 11 | |
| | Linux, RHEL 8.9. Splunk 9.2.0.1 Had a forwarder manager running (for years) with 2,000+ clients connecting. Did the u... 0 6 | 0 | 6 | |
| | I am trying to run the Health check on the DMC.Health check dashboard loads fine from the checklist.conf as per the d... 0 6 | 0 | 6 | |
| | Hi,I run splunk 9.0.8 and after an issue with our storage (LUN full). I had to full scan the disk and successfully re... 0 3 | 0 | 3 | |
| | Dears, After upgraded Splunk from 9.1.2 version to 9.2.0 version, the deployment server not showing the clients... 1 20 | 1 | 20 | |
| | First time ingesting JSON logs, so need assistance on figuring out why my JSON log ingestion is not auto extracting.E... 0 1 | 0 | 1 | |
| | I'm trying to create an alert. The alert's query ends with " | stats values(*) as * by actor.displayName | stats coun... 0 2 | 0 | 2 | |
| | Hola, hoy solicito su ayuda, Dado que descargue la VMWARE de Splunt para probarlo y ver el funcionamiento, pero no h... 0 0 | 0 | 0 | |
| | Hello,Is it possible to create HEC Token from the CLI of Linux host? Any recommendations how to create HEC token fro... 0 3 | 0 | 3 | |
| | Hello everyone, I have created a query that list sourectypes : index=_audit action=search info=granted source="*me... 0 1 | 0 | 1 | |
| | Can't hot bucket just roll directly to cold bucket? Or it's not possible? Does it have anything to do with the fact t... 0 8 | 0 | 8 | |
| | We have a small satellite deployment of 40+ servers, that have a dedicated HF doubling as a Deployment Server running... 2 19 | 2 | 19 | |
| | I'm evaluating the Splunk Enterprise product.I'm following the tutorial: Create a custom Splunk view - http://dev.spl... 2 9 | 2 | 9 | |
| | Good day,I have done a join on two indexes before to add more information to one event. example get department for a ... 0 1 | 0 | 1 | |
| | Good day,I am trying to find the latest event for my virtual machines to determine if they are still active or decomm... 0 4 | 0 | 4 | |
| | Hi, i've been banging my head against the wall for a while on this one.I have an HTML dashboard that i would like use... 0 10 | 0 | 10 | |
| | Hi, i'm trying to learn how appendpipe works, to do that i've tried to do this dummy search, and i don't understand w... 0 4 | 0 | 4 | |
