Hi All ,    So i was trying to create an global field for a newly indexed data , so trying out with automatic lookup settings . Ex- in the indexed data - datacenter name is not mentioned , so wanted to populate it using automatic lookup . I am able to do that , but for only 1 sourcetype , i have 100+ sourcetypes , is there any way to define apply to - sourcetype/hosts to multiple one . Please let me know .

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20 After support tickets with Zoom and Splunk here are some experience would like to share. Using signed ssl certificates private or internal CA did not work. It seems that I had to use a certificate signed a commercial CA like Entrust. If you want to chain your ssl certificate with Entrust root and intermediate certificates, please ensure that the certificates are in the order as follows after running the command: openssl crl2pkcs7 -nocrl -certfile yoursslcertificate.entrust.pem | openssl pkcs7 -print_certs -noout Or you could just include the commercially issued ssl certificate without the root and intermediate certificates.       subject=/C=US/ST=STATE/L=CITY/O=ORG, Inc./CN=mycompany.com issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2       If all works after restarting Splunk, running the netstat -nap |grep 9997 will show the following connections from Zoom ip addresses and you would see logs under the sourcetype=zoom:webhook       tcp 0 0 0.0.0.0:4443 0.0.0.0:* LISTEN 25849/python3.7 tcp 0 0 10.#.#.#:4443 3.235.82.171:41101 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:58497 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:54514 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:48513 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:53006 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:55259 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:46028 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:52837 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:7527 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:12934 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.83.101:32088 TIME_WAIT -          

Can we configure input.conf define port with multiple sourcetype? For ex. [tcp://6134] index = top sourcetype = mac_log sourcetype= tac_log disabled = 0 Or  Is there any way to segregate logs coming in one port with different sourcetypes?

Hi All, we are using Netapp cloud secure add on to collect data from cloud secure data and we have configured input but not getting all data below is the configuration please suggest if anything to add in configuration.   [cloud_secure_alerts://******] builtin_system_checkpoint_storage_type = auto entityaccessedtime = 1635795607850 index = main interval = 60 netapp_secure_insight_fqdn = ********.cloudinsights.netapp.com sourcetype = netapp:cloud_secure:alerts        

I am trying to configure NEAP policy action rules  to integrate servicenow incident comments by passing a token, but it looks Splunk doesn't support tokens in NEAP action rules. I heard there is some custom script would pass the tokens, does anybody have idea on this customization part and how we can achieve it ?

We have enabled Bidirectional correlation search for Service now in our ITSI, unfortunately  itsi_notable_event_external_ticket  lookup is not updating proper values. I couldn't find the saved search which is used to update the lookup to troubleshoot further. Can some one tell me how itsi_notable_event_external_ticket lookup is being updated ?

I have borrowed a search from an earlier question to help give kWh information on a given month. How can I modify the search to show only the host_name and the sum total of the avg_kWh column? index=network sourcetype=zabbix metric_name="st4InputCordActivePower" host_name="pdu02.LON5.Contoso.com" | bin _time span=1h | stats count as samples sum(value) as watt_sum by _time | eval kW_Sum=watt_sum/1000 | eval avg_kWh=kW_Sum/samples | addcoltotals   2022-05-30 18:00 12 44335.0 3.69458 44.3350 ....         2022-05-31 23:00 12 43489.0 3.62408 43.4890   7686 27425688.0 2595.96346 27425.6880   

I have to decrease the fields names font size, like subgroup, platforms, bkcname etc.. (all fields present in the table) & make the count bold which is present in table.   But i want change only in one particular table, not all the tables presents in the dashboard. <row> <panel> <title>Platform wise Automation Status Summary</title> <table> <search> <query>index=network_a I want change the above table(Platform wise Automation Status Summary) Any help would be greatly appreciated!!

Hi, I have installed the Splunk forwarder in AIX server and successfully see the server level results(CPU ,DF ,Memory) in the dashboard, But am planning to install the Splunk add on for WebSphere process server 7.0 version, May I know "Splunk Add on WebSphere application server" will for the older version  of WebSphere process server? Your inputs will be appreciated .

Hello Splunk Enjoyers! I have problem Information about routers arrives every minute, so  What I have:  name_of_router and serial_number of client on index = routers What i want: i want to make alert, if serial_number has changed.  How should i do this? @splunk     

Hi, I have a metric with 1 dimension containing an integer value. I need to apply some calculation to the metric based on the dimension value. The formula to apply to each Data Point would be sth like this:     metric_value*100/dimensionA_value   I have seen dimensions extensively used as filters but I was not able to find a way to reference the dimension value so that I can use it in a calculation like the one above.   Any idea, how could I accomplish that?   Thanks in advance Cesar

I am getting  "The search job terminated unexpectedly" in the dashboard. In search, the index is working fine.  And this happens in one dashboard only other dashboards are working fine. Another Dashboard I don't know what the reason for this issue is. Please anyone help me. Thanks in Advance