Hey there Splunk community. I'm new here and I would appreciate some help if it is possible. So, I have to create a Splunk app that runs a Python script each day and it should generate random log events and index them into Splunk. I'm not sure what's the best approach for this. I already wrote a custom script and successfully tested it by implementing it in Splunk (Data Inputs > Scripts...) but I don't know how to run it once a day and get x amount of log events. I did use Cron schedule for scheduling it once a day but I only get one log event. Is there a way Splunk can run a script x amount of times at once? Thank you!

Hi, All  Since the last Splunk update I've noticed some unexpected behavior when it comes to tokens with Splunk Dashboard Studio. If you have an input (dropdown or multiselect) with a default value set to None. After loading the dashboard page, then setting the input value, The base searches in the dashboard that use the input token will update,  but any chain searches of that base search do not. It does however update if you either refresh the page with the tokens set in the url, or a change to the input for a second time. (any other action which causes the page to refresh in some way eg: editing page will update the dashboard and the chain search will update) is this behaviour a bug, and is there currently a way to fix this behaviour? Thanks Daniel  Below is a self contained minimal example to demonstrate this. Splunk Dashboard Studio: Absolute/Full control layout   { "visualizations": { "viz_cdPoxmBV": { "type": "splunk.table", "dataSources": { "primary": "ds_CJTH14Fk" }, "title": "Base" }, "viz_t4aAHmKH": { "type": "splunk.table", "title": "Chain", "dataSources": { "primary": "ds_aqLh17e3" } } }, "dataSources": { "ds_CJTH14Fk": { "type": "ds.search", "options": { "query": "| makeresults\n| eval a=\"$input$\"\n| table a ", "queryParameters": { "earliest": "0", "latest": "" } }, "name": "Search_Base" }, "ds_aqLh17e3": { "type": "ds.chain", "options": { "extend": "ds_CJTH14Fk", "query": "| eval a=a+\"_END\"" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_aXQ6s8I2": { "options": { "items": [ { "label": "All", "value": "*" }, { "label": "Item 1", "value": "item001" }, { "label": "Item 2", "value": "item002" } ], "token": "input" }, "title": "Dropdown Input Title", "type": "input.dropdown" } }, "layout": { "type": "absolute", "options": { "display": "auto-scale" }, "structure": [ { "item": "viz_cdPoxmBV", "type": "block", "position": { "x": 10, "y": 10, "w": 410, "h": 140 } }, { "item": "viz_t4aAHmKH", "type": "block", "position": { "x": 430, "y": 10, "w": 400, "h": 140 } } ], "globalInputs": [ "input_aXQ6s8I2" ] }, "description": "", "title": "Test_Token" }  

Hello all, I suspect I am missing something obvious, but where are all the CIM fields for ESXi audit logs?   - I have VMware logs being sent to a syslog port. Have a mix of vmware 7.0 and 6.7 vcenters (Splunk 8.2) # https://docs.splunk.com/Documentation/AddOns/released/VMW/ESXihosts - I am using the latest Splunk Add-on for VMware ESXi Logs (4.2.1) - I have had to modify line breaking rules - I have an index cluster, so I had to update the DATETIME_CONFIG field (from .../apps/... to slave_apps) - I am capturing the hostname via rsyslog and putting into into the directory. I am reading it as my host value (example: /var/log/vmware/hostname/day_hour/log.log) - I am capturing logs as "vmw-syslog," logs are being renamed to things such as "vmware:esxlog:vpxd" by the TA The TA as-is captures application and message fields for most events. But I don't see any configurations that would capture a user or action field, CIM fields or tags for login events, etc. Am I missing something? I am seeing logs that look like this, but no attempt to parse CIM fields: 2022-04-21T17:37:17.686700+00:00 <host> vpxd 3115 - - Event [49110010] [1-1] [2022-04-21T17:37:17.685845Z] [vim.event.UserLogoutSessionEvent] [info] [AD\<user>] [] [49111254] [User AD\<user>@127.0.0.1 logged out (login time: Thursday, 21 April, 2022 05:27:42 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)]   2022-04-21T17:27:42.654618+00:00 <host> vpxd 3115 - - Event [49109228] [1-1] [2022-04-21T17:27:42.654052Z] [vim.event.UserLoginSessionEvent] [info] [AD\<user>] [] [49104519] [User AD\<user>@127.0.0.1 logged in as VMware vim-java 1.0]

I have been avoiding RegEx for quite sometime in Splunk but I now I really need to deal with it and understand it. I really need help with this three cases; First Case: I have events that usually start with things like 57A,53A and followed by other strings. I want to match 57A but the field value will be FMDKNTLA :57A:3232324646 FMDKNTLA Second Case: Another extraction example will be extracting  field 31A but the value will be "NKN" :32A:200117NKN200000000,00 Third Case: extracting field 31A but the value will be "200000000,00" :31A:200117NKN200000000,00   Any help will be appreciated

Hello I have installed and setup RADIUS Authentication radius_auth 1.4.1, all autentiction is correct and radius user are comming up with the admin role. The problem is that when searching a index splunk is taking a long time to fetch the data, when looking through logs I found the logs below in splunkd.log, these lines appear when running a search, alot of them. Only when using radius, not when using a local user. Seems like this is the reason for search being slow, but not sure what is going on. Can anyone help ?. Thnx    4-25-2022 11:45:24.154 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~55.19 milliseconds to execute. elapsed_msec=56 04-25-2022 11:45:24.204 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~49.04 milliseconds to execute. elapsed_msec=50 04-25-2022 11:45:24.248 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.72 milliseconds to execute. elapsed_msec=44 04-25-2022 11:45:24.293 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~44.53 milliseconds to execute. elapsed_msec=45 04-25-2022 11:45:24.342 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~49.53 milliseconds to execute. elapsed_msec=50 04-25-2022 11:45:24.397 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.63 milliseconds to execute. elapsed_msec=55 04-25-2022 11:45:24.453 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.95 milliseconds to execute. elapsed_msec=55 04-25-2022 11:45:24.496 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.16 milliseconds to execute. elapsed_msec=44 04-25-2022 11:45:24.558 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~61.56 milliseconds to execute. elapsed_msec=62 04-25-2022 11:45:24.609 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~50.98 milliseconds to execute. elapsed_msec=51 04-25-2022 11:45:24.652 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~41.98 milliseconds to execute. elapsed_msec=42 04-25-2022 11:45:24.704 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.82 milliseconds to execute. elapsed_msec=52 04-25-2022 11:45:24.756 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.36 milliseconds to execute. elapsed_msec=52 04-25-2022 11:45:24.798 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~42.03 milliseconds to execute. elapsed_msec=43 04-25-2022 11:45:24.851 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.72 milliseconds to execute. elapsed_msec=53 04-25-2022 11:45:24.898 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~47.39 milliseconds to execute. elapsed_msec=48 04-25-2022 11:45:24.954 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.91 milliseconds to execute. elapsed_msec=55 04-25-2022 11:45:24.996 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~41.97 milliseconds to execute. elapsed_msec=42 04-25-2022 11:45:25.041 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~44.70 milliseconds to execute. elapsed_msec=45 04-25-2022 11:45:25.085 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.48 milliseconds to execute. elapsed_msec=44 04-25-2022 11:45:25.135 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~50.13 milliseconds to execute. elapsed_msec=51 04-25-2022 11:45:25.183 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~47.50 milliseconds to execute. elapsed_msec=48 04-25-2022 11:45:25.237 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.03 milliseconds to execute. elapsed_msec=55 04-25-2022 11:45:25.290 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.35 milliseconds to execute. elapsed_msec=53 04-25-2022 11:45:25.334 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.71 milliseconds to execute. elapsed_msec=44 04-25-2022 11:45:25.388 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.50 milliseconds to execute. elapsed_msec=54 04-25-2022 11:45:25.439 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.03 milliseconds to execute. elapsed_msec=52 04-25-2022 11:45:25.490 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.24 milliseconds to execute. elapsed_msec=52 04-25-2022 11:45:25.534 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~42.78 milliseconds to execute. elapsed_msec=43 04-25-2022 11:45:25.587 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.18 milliseconds to execute. elapsed_msec=54 04-25-2022 11:45:25.641 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.47 milliseconds to execute. elapsed_msec=54 04-25-2022 11:45:25.686 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~44.53 milliseconds to execute. elapsed_msec=45 04-25-2022 11:45:25.729 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.21 milliseconds to execute. elapsed_msec=44 04-25-2022 11:45:25.775 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~45.34 milliseconds to execute. elapsed_msec=46 04-25-2022 11:45:25.829 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.74 milliseconds to execute. elapsed_msec=54 04-25-2022 11:45:25.882 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.27 milliseconds to execute. elapsed_msec=53 04-25-2022 11:45:25.924 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~41.69 milliseconds to execute. elapsed_msec=42 04-25-2022 11:45:25.976 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.32 milliseconds to execute. elapsed_msec=53 04-25-2022 11:45:26.032 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~55.64 milliseconds to execute. elapsed_msec=56 04-25-2022 11:45:26.084 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.54 milliseconds to execute. elapsed_msec=52 04-25-2022 11:45:26.136 +0200 INFO ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.70 milliseconds to execute. elapsed_msec=52    

I have " threatInfo.updatedAt" information in my logs. I want to get an alert if the time difference between "threatInfo.updatedAt" & "_time" is more than 4 hours.   My Search Query index=test "file_name"=* "threatInfo.incidentStatus"=unresolved |transaction threatInfo.updatedAt | table _time threatInfo.updatedAt file_name file_path category    

index=xt DONT_MATCH | spath input=log path=message.extra.dj output=dj | spath input=log output=fname path=message.msg.fname| search dj=* NOT [search EXTERNAL_API OR EXTERNAL_STATUS | spath input=log output=url path=url | dedup url | rex field=url "^(\/\w+){6}\/(?<variable>\d+)" | table url variable | stats list(variable) as variable] | stats count by fname The task here is to show the dj which is there in this event DONT_MATCH and it should not show those dj if it occurs in these 2 events EXTERNAL_API OR EXTERNAL_STATUS. So basically I want to show all the DJ which is there in DONT_MATCH and NOT IN EXTERNAL_API OR EXTERNAL_STATUS  

Hi, Anyone is using this app and is able to troubleshoot the app for me? https://splunkbase.splunk.com/app/3530/ I installed it but there was no result found, can't find any errors. @markhill1 wondering if you could help on this?  Thank you!

I am working in Hxc capture program and currently I am facing an issue in Signalfx. So I am reaching out for help/guidance. I have created an Alert in signalFx using terraform. The condition for the alert is that if the signal is less than 1 for a certain time( 2 for warning and 5 for critical),then alert will be triggered. The code in Signalflow is : signal = data('HealthCheckStatus', filter=filter('stat', 'upper') and filter('aws_account_id', '823990414917') and filter('aws_tag_Name', 'hxc-staging-health-check')).publish(label='A') detect(when(signal < 1, '2m')).publish('WARNING[staging]: Route53 health down for 2m') detect(when(signal < 1, '5m')).publish('CRITICAL[staging]: Route53 health down for 5m')   After that we created a condition when the signal came below 1 ( it came to 0).In the Alert graph we can see the same .But instead of actually triggering the alert,it is giving us a preview. (Attached screenshot)   The exact Alert message is "Estimated alert count: 1 in 1 hour. Alerts that would have triggered  shown in chart below." So the bottom line is that Signalfx is not triggering the alert. The code that I am using for this is : https://github.com/HylandSoftware/tf-cfg-hxc-signalfx-alerts/blob/main/terraform/alerts-route53-health.tf   Alert Link:https://hyland.signalfx.com/#/detector/v2/FQo6JaWA0AI/edit?detectorSignalFlowEditor=1