For Ubuntu: I used the command  [sudo] $SPLUNK_HOME/bin/splunk enable boot-start But when i rebooted the machine, I check the status of splunk forwader by using command ./splunk status. It returned "splunkd is not running".   For Windows: according to Splunk document, Splunk will run automatically after startup. But after restarting the machine, i checked in the Task Manager, the SplunkForwarder was not running.  

Hi @deephi .. Splunk UF is compatible with most of the linux available in the market. Pls check the documentations. if you hvae very old linux versions (or very latest linux with very advanced features.. even 90% of the times, this we can neglect)

You say that you get other events from the suricata box. How are you ingesting them? Do you have  forwarder installed on the suricata box? Yes we have a Universal Forwarder on the suricata box. Currently it is set to monitor syslogs which we see in the search head web app.  2. Did you deploy the addon with the enabled input to the forwarder on the suricata box? Copied the TA to  /opt/splunkforwarder/etc/apps/Ta-suricata on the suricata box.  3.3. Did you verify the inputs on the forwarder? yes btool host= splunk-nat-sec, index= suricata, sourcetype = suricata, [monitor:///var/log/suricata/eve.json] splunk list monitor /var/log/suricata/eve.json, /var/log/syslog splunk list input status /var/log/suricata/eve.json, file position = 6824003470, file size = 143583971149, percent = 4.75, type = reading (batch) splunkd. log has Warn Tailreader [ tailreader0] - Enquueing a very large file=/var/log/suricata/eve.json ..... readinf of other large files could be delayed. Then an INFO about trimming input to first line Then an INFO about shutting down while reading file /var/log/suricata/eve.json Then INfO about Batch file input finished reading the file.  It isn't in a spot I can copy and paste. Maybe this is enough. Thanks for your help.      

Hi @Oliver.Ulfik, One of your posts was flagged for spam, (the one with the larger code snippet). I've decided to leave this post here and archive the other. If you have not yet seen them, here are some Otel Technical Knowledge Base articles we have around Otel. If I find any more specific info, I'll be sure to share it. In the meantime, let's see if the Community can jump in and help out.

Wait a second. Your description is a bit chaotic. 1. You say that you get other events from the suricata box. How are you ingesting them? Do you have  forwarder installed on the suricata box? 2. Did you deploy the addon with the enabled input to the forwarder on the suricata box? 3. Did you verify the inputs on the forwarder? splunk btool inputs list monitor splunk list monitor splunk list inputstatus 4. Did you check splunkd.log from the suricata box for errors regarding eve.json? (Especially permission-related ones)

Hi @atebysandwich  I'm not 100% sure I understand what you are trying to do but does this run anywhere example help... | makeresults | eval _raw="DNS,Identified_Host host1.domain.com,host1.domain.com host1-admin.domain.com,host1.domain.com host1-mgt.domain.com,host1.domain.com host2.domain.com,host2.domain.com host2-admin.com,host2.domain.com host2-mgt.admin.com,host2.domain.com host3.domain.com,host3.domain.com host3-admin.com,host3.domain.com" | multikv forceheader=1 | table DNS Identified_Host ```^^^ dummy events ^^^``` | where DNS!=Identified_Host | stats values(DNS) BY Identified_Host  

With Splunk usually if something looks like a number but doesn't behave like a number it means that it's not a number but a string representation of a number and you have to tonumber() it. But in this case since strptime should give you a number it would be a bit surprising.

Hey you may need to change them to a string. Can  you try this and let me know if it works ( I am new to Splunk lol) MySearchCriteria index=MyIndex source=MySource | stats list(ExtractedFieldStartTime) as MyStartTime, list(ExtractedFieldEndTime) as MyEndTime by AnotherField | eval MyStartUnix=strptime(MyStartTime, "%Y-%m-%dT%H:%M:%S") | eval MyEndUnix=strptime(MyEndTime, "%Y-%m-%dT%H:%M:%S") | eval diff= tostring((MyEndUnix - MyStartUnix),"duration") | table MyStartTime MyEndTime MyStartUnix MyEndUnix diff  

I have regex in description and also url from regex101.com. its not working in Splunk when i used rex with SPL query. index=universe sourcetype=planet | rex field=_raw "<(?<key>[^>]+)> (?<value>[^<]+)<\/\1>" Results i got,    key current encrypted keywordp boriskhan rolename . . value parker true ****** role.customermanager false . . .