All Posts

stamatoc · ‎01-25-2024

Hello everyone , I need to onboard a huge amount of logs which the 90% of them is unnecessary . My goal is to ingest only some keywords like "Login Failed", "User Login " etc . I have seen other ...

Hello everyone , I need to onboard a huge amount of logs which the 90% of them is unnecessary . My goal is to ingest only some keywords like "Login Failed", "User Login " etc . I have seen other articles explaining how you can filter events by exclusion using NullQueue . But that doesn't fit in my case because I only know which event I want to ingest using particular keywords. I am looking forward for a hint on how can I procced on that if it's possible . Thank you all

vall · ‎01-24-2024

As mentioned in the subject, help me with the keyboard shortcut to format html and xml code in dashboard source code editor. For example, I want below code to be formatted to the code as shown in "T...

As mentioned in the subject, help me with the keyboard shortcut to format html and xml code in dashboard source code editor. For example, I want below code to be formatted to the code as shown in "To" section: <dashboard version="1.1"> <label>Test Dashboard</label> <row> <panel> <html> <h1> <b>Some bold text</b> </h1> </html> </panel> </row> </dashboard> To: <dashboard version="1.1"> <label>Test Dashboard</label> <row> <panel> <html> <h1> <b>Some bold text</b> </h1> </html> </panel> </row> </dashboard> I tried using Ctrl+Shift+F but it is only formatting the XML code in the dashboard source code editor and html code in the dashboard source code editor is not getting formatted and remaining as is.

jwalthour · ‎01-24-2024

In your search, you need to escape your quotes, like this: search="search index=list-service source=\"eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;\" \"kub...

In your search, you need to escape your quotes, like this: search="search index=list-service source=\"eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;\" \"kubernetes.namespace_name\"=\"list-service\" | stats dc(kubernetes.pod_name) as pod_count" or use single quotes around the search contents: search=‘search index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name”="list-service" | stats dc(kubernetes.pod_name) as pod_count’

Gk7 · ‎01-24-2024

Hey @kelstahl8705 , thanks...Much appreciated.

Gk7 · ‎01-24-2024

Hey @alobuono , could you please brief here, how you are started installation. 1) what file you are using 2) VM details 3) installation steps and the eror you are facing. We are happy to assi...

Hey @alobuono , could you please brief here, how you are started installation. 1) what file you are using 2) VM details 3) installation steps and the eror you are facing. We are happy to assist you..! Regards, GKBoss

PickleRick · ‎01-24-2024

Are you sure your events are properly reaching your HF and are received by the HF?

TheExpert · ‎01-24-2024

Thank you. I can confirm that an unistallation of Universal Forwarder 9.1.2 and an installation of Uinversal Forwarder 9.1.3 works without issues.

PickleRick · ‎01-24-2024

If the lookup is explicitly generated with the outputlookup command, you can try something like | rest /servicesNS/-/-/saved/searches | regex search="outputlookup[^|]+<your_lookup_name>" | table t...

If the lookup is explicitly generated with the outputlookup command, you can try something like | rest /servicesNS/-/-/saved/searches | regex search="outputlookup[^|]+<your_lookup_name>" | table title eai:acl.app search

Siddharthnegi · ‎01-24-2024

I want to know which saved search is generating a particular lookup , How do I do that?

yuanliu · ‎01-24-2024

Drop spath. Splunk is already giving you field values. Adding spath as illustrated in your example will only give each field a duplicate value. When your log source is JSON, spath can be used to e...

Drop spath. Splunk is already giving you field values. Adding spath as illustrated in your example will only give each field a duplicate value. When your log source is JSON, spath can be used to extract from a specific field that embeds an escaped JSON, or to extract value of a specific path. | spath input=_raw does neither.

Unnamed16 · ‎01-24-2024

Hi Splunkers, i already done configuration of HF and install uf credentials. but i can't see the logs of palo alto in Splunk Cloud for HF Inputs.conf [udp://5000] index = xxxxx_pan di...

Hi Splunkers, i already done configuration of HF and install uf credentials. but i can't see the logs of palo alto in Splunk Cloud for HF Inputs.conf [udp://5000] index = xxxxx_pan disabled = false sourcetype = pan_log but HF and Splunk Cloud instance have communicating. please help me

spodda01da · ‎01-24-2024

Hi All, I've been exploring various documentation and tutorials, but I'd love to hear from those who have hands-on experience. What are the best practices and recommended steps for configuring Kuber...

Hi All, I've been exploring various documentation and tutorials, but I'd love to hear from those who have hands-on experience. What are the best practices and recommended steps for configuring Kubernetes logs to seamlessly integrate with Splunk Enterprise? Are there any specific considerations or challenges I should be aware of during the setup process? Thanks in advance for sharing your expertise!

Jana42855 · ‎01-24-2024

Hi Mentors, I have searched in youtube, external sources to check for usecase creation. i could see by using splunk essential we could create the usecase but i am new to the splunk and know about ...

Hi Mentors, I have searched in youtube, external sources to check for usecase creation. i could see by using splunk essential we could create the usecase but i am new to the splunk and know about only the basics of splunk like fields and commands etc. i have asked even literally everyone treated me in a bad way when i ask them to teach me how to create the usecase even my team leader is also not ready to teach me but he got learned in the institution 5 years back. i dont have any friends who has knowledge in splunk. I beg u please any one please teach me how to create the usecase in splunk and what is the basic of creating the usecase. i need this ......i am a first graduate from my family and i cannot afford huge amount of fees to learn splunk. Any mentors please help me i want to learn splunk and i want to teach the same to my team members in a simple in which way they could understand....... Please help me Mentors....

CheongKing · ‎01-24-2024

I am also encountering issue when I'm doing a upgrade from 9.1.2. Coming to the end it will roll back and fail.. A fresh install works fine... Kindly advise.

yoshilog · ‎01-24-2024

We are looking into Splunk Cloud as a solution, instead of our regular Splunk Enterprise (On Premise) Setup. To be able to test the feasibility of sending data from external sources (Jira Cloud, Red...

We are looking into Splunk Cloud as a solution, instead of our regular Splunk Enterprise (On Premise) Setup. To be able to test the feasibility of sending data from external sources (Jira Cloud, Redmine) , I wanted to install our own Custom App for testing. Unfortunately, there is no current way for us to do that in the Free Trial I have. We simply want to test if we can index data from Jira Cloud to Splunk Cloud, without having to use a Heavy Forwarder or Universal Forwarder. Ways to replicate: Splunk Cloud Login > Manage Apps > No button for uploading a custom app / add-on. Questions: 1. Is there a way to directly install Custom Apps / Add-ons (that are originally built for Splunk Enterprise), in Splunk Cloud? We were thinking about compatibility issues, and if the apps would work the same way. 2. Is there a way to gauge whether or not the quantity of data that we want to send from external sources, would require us to install a Heavy / Universal Forwarder? (We are trying to avoid additional costs by taking Splunk Cloud, so we were wondering if we could do without them)

yh · ‎01-24-2024

Hi all, I have read through the splunk documentation for session timeout here, but these seems to be for splunk overall. Configure user session timeouts - Splunk Documentation However I am not a...

Hi all, I have read through the splunk documentation for session timeout here, but these seems to be for splunk overall. Configure user session timeouts - Splunk Documentation However I am not able to make the user timeout to be user or role specific. Is there any solution for that? I read in one of the posts previously that someone is able to perform such role-specific wise which also works for me if it can be done: Session timeout for a Single username (not group) ... - Splunk Community However there wasn't much information on how he/she was able to do so. The main intent for me is to set admin users / normal users the usual timeout eg 1 hour, and dashboard accounts to not be logged out on the other hand. Any possible advice, as it seems to be doable.

wcolgate_splunk · ‎01-24-2024

Use msiexec /i .... /l*vx logfile.txt and look for "value 3" in that file. Just above that will show more information about the installation failure.

richgalloway · ‎01-24-2024

Run both queries then combine the results using stats. | dbxquery query="select * from employee where companyID in (A,B,C)" | append [search index=company] | stats values(*) as * by Company ID

LearningGuy · ‎01-24-2024

How to correlate index with dbxquery with condition or interation? See the sample below. Thank you for your help. index=company CompanyID CompanyName Revenue A CompanyA 3,000,000 ...

How to correlate index with dbxquery with condition or interation? See the sample below. Thank you for your help. index=company CompanyID CompanyName Revenue A CompanyA 3,000,000 B CompanyB 2,000,000 C CompanyC 1,000,000 | dbxquery query="select * from employee where companyID in (A,B,C)" OR Iteration: | dbxquery query="select * from employee where companyID ='A' | dbxquery query="select * from employee where companyID ='B' | dbxquery query="select * from employee where companyID ='B' CompanyID EmployeeName EmployeeEmail A EmployeeA1 empA1@email.com A EmployeeA2 empA2@email.com A EmployeeA3 empA2@email.com B EmployeeB1 empB1@email.com B EmployeeB2 empB2@email.com B EmployeeB3 empB3@email.com C EmployeeC1 empC1@email.com C EmployeeC2 empC2@email.com C EmployeeC3 empC3@email.com Expected result: CompanyID CompanyName Revenue EmployeeName EmployeeEmail A CompanyA 3,000,000 EmployeeA1 empA1@email.com A CompanyA 3,000,000 EmployeeA2 empA2@email.com A CompanyA 3,000,000 EmployeeA3 empA2@email.com B CompanyB 2,000,000 EmployeeB1 empB1@email.com B CompanyB 2,000,000 EmployeeB2 empB2@email.com B CompanyB 2,000,000 EmployeeB3 empB3@email.com C CompanyC 1,000,000 EmployeeC1 empC1@email.com C CompanyC 1,000,000 EmployeeC2 empC2@email.com C CompanyC 1,000,000 EmployeeC3 empC3@email.com OR CompanyID CompanyName Revenue EmployeeName EmployeeEmail A CompanyA 3,000,000 EmployeeA1, EmployeeA2, EmployeeA3 empA1@email.com, empA2@email.com, empA2@email.com B CompanyB 2,000,000 EmployeeB1, EmployeeB2, EmployeeB3 empB1@email.com, empB2@email.com, empB3@email.com C CompanyC 1,000,000 EmployeeC1, EmployeeC2, EmployeeC3 empC1@email.com, empC2@email.com, empC3@email.com

DanAlexander · ‎01-24-2024

Thanks very much for the solution @yuanliu Much appreciated!

All Posts

All Posts

Filter which events to be ingested

Keyboard shortcut to format html and xml code in dashboard source code editor

Re: How to use the REST API to just run a search and stream the results back?

Re: Trend Micro Cloud once integration with Splunk

Re: Problem With Installing .Ova Phantom

Re: HF not send the logs to Splunk Cloud instance

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

Re: Finding source of a lookup

Finding source of a lookup

Re: how to see the data in table command which is showing empty cells

HF not send the logs to Splunk Cloud instance

Seeking Guidance on Configuring Kubernetes Logs with Splunk Enterprise

How to start to create new usecase

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

Unable to Upload Custom App for Jira in Splunk Cloud

Role or User Specific Web Session Timeout

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

Re: How to correlate index with dbxquery with condition or interation?

How to correlate index with dbxquery with condition or interation?

Re: trying to compare two sources and extract these ones that do not have SysMon

All Posts

Are you a member of the Splunk Community?

All Posts