I want to calculate the error count from the logs . But the error are of two times which can be distinguish only from the flow end event. i.e [ flow ended put :sync\C2V] So what condition I can put so that I can get this information from the above given log.    index=us_whcrm source=MuleUSAppLogs sourcetype= "bmw-crm-wh-xl-retail-amer-prd-api" ((severity=ERROR "Transatcion") OR (severity=INFO "Received Payload")) I am using this query to get below logs. Now I want a condition that when it is severity=error then I can get the severity= info event of received payload to get the details of the correlationId and also end flow event so that I can determine the error type.    

Hello to everyone! I have an UF installed on a MS file server Our Unified Communications Manager sends CDR and CMR files to this file server via SFTP Often enough, I see error messages, as you see in the screenshot (UF cannot read the file) The most strange thing is that all information from such files is successfully read What is wrong with my UF settings? Or maybe this is not UF? props.conf [ucm_file_cdr] SHOULD_LINEMERGE = False INDEXED_EXTRACTIONS = csv TIMESTAMP_FIELDS = dateTimeOrigination BREAK_ONLY_BEFORE_DATE = False MAX_TIMESTAMP_LOOKAHEAD = 60 initCrcLength = 1500 ANNOTATE_PUNCT = false TRANSFORMS-no_column_headers = no_column_headers [ucm_file_cmr] SHOULD_LINEMERGE = False INDEXED_EXTRACTIONS=csv TIMESTAMP_FIELDS = dateTimeOrigination BREAK_ONLY_BEFORE_DATE = False MAX_TIMESTAMP_LOOKAHEAD = 13 initCrcLength = 1000 ANNOTATE_PUNCT = false TRANSFORMS-no_column_headers = no_column_headers   transforms.conf [no_column_headers] REGEX = ^INTEGER\,INTEGER\,INTEGER.*$ DEST_KEY = queue FORMAT = nullQueue  

I have a Splunk alert where I specify the fields using "| fields ErrorType host UserAgent Country IP_Addr" and I want to receive this column order in SOAR platform. When I look at the JSON results and UI from SOAR, the column order has changed to host, Country, IP_Addr, ErrorType and UserAgent (not the expected results).  I think this has to do with the REST call and Json data, but I would like to check if there is any quick fix we could do from splunk or SOAR side to show the proper order of columns.  Any help on this will be much appreciated. 

I have a question about security advisory SVD-2023-0805. It states only Splunk Web is affected, but the description clearly mentions the issue is caused by how OpenSSL is built, which is a very generic library. For this reason I would like to check if indeed only Splunk Web is affected, or that Splunk installations on Windows in general are affected. I can imagine that OpenSSL is also used when a SSL/TLS connection is made from a forwarder to an indexer. This leads to the question: are universal forwarders on Windows also affected by this security advisory, even when Splunk Web is disabled?