I am running db connect version 3.4.2 on Splunk 8.2.4. I have many splunk db connect output cron jobs scheduled at 6 AM EST but after the day light shifting  the jobs are not running at 6 AM but at 7 AM. The OS date and time already shift to day light saving time. Any one having this issue. 

How many Sybase database servers can be onboarded on a single DB connect server. Is there any limit in the number of stanzas configured in db_inputs.conf for configuration of new Sybase database servers in the DB connect app.

Hi, I send email data to http event collector in JSON format like this : { "sender-domain":"domain.com", "sender":"sender.test@domain.com", "recipient":"Name1 Surname1<name1.surname1@domain.com>, "Name2 Surname2<name2.surname2@domain.com>" } I would like to extract email addresses from recipient field and save it as multivalue field with the same name (field recipient will be used in email data model). Do you have any idea what can i do this?  The only idea which I have is use sedcmd to change name for recipient  to another field name and next use regex to do extraction from this fields email adresses as recipient field. The Regex is:   SOURCE_KEY = changed_recipient_field_name REGEX = (?<recipient>[\w\d\.\-\=\+]+\@[\w\d\.\-]+) FORMAT = recipient::$1 What is the best solution for this? Thank you in advance.  

We are working with several remote datasets that are combined to give our end user a specific result.  Federated Search gives us an LDAP dn, which we are trying to use to pull enhancing information from another remote source via a REST API.  The following search works:   index=federated:remote_dataset userid="cn=" | \ eval dn=lower(userid) | \ dedup dn | \ table dn   The idea is to use a scheduled search to populate a csv with a list of DNs at the top of every hour, then use a cron job to spawn a python script which generates a new CSV that contains the DN and the enhancing data from the REST API source. Our python script is working, however when we add "|outputlookup dn.csv append=true" to the otherwise functional SPL, we get nothing. This fails:   index=federated:remote_dataset userid="cn=" | \ eval dn=lower(userid) | \ dedup dn | \ table dn | \ outputlookup dn.csv append=true   Is this a limitation of Federated Search? Thank you

I am trying to configure controller settings in a C++ application in unix environment. I see these configuration settings in the example - const char APP_NAME[] = "SampleC"; const char TIER_NAME[] = "SampleCTier1"; const char NODE_NAME[] = "SampleCNode1"; const char CONTROLLER_HOST[] = "controller.somehost.com"; const int CONTROLLER_PORT = 8080; const char CONTROLLER_ACCOUNT[] = "customer1"; const char CONTROLLER_ACCESS_KEY[] = "MyAccessKey"; const int CONTROLLER_USE_SSL = 0; Is a node name necessary to have in configuration. And where can i find the controller account and controller access key?

hi dear ,  Am facing a issue while installing splunk enterprise security on my windows10 system it showing error called  "Splunk enterprise Setup Wizard ended Prematurely" plz tell me the solution for this.......!

Hi All,  I have the below query which gives the columns : Name.    Count.    Percentage.    ControlID   | spath evaluation_results | search gear_name | spath input=evaluation_results | foreach *.compliant [| eval Compliance=if('<<FIELD>>'="Compliant",if(isnull(Compliance),"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlVersion',mvappend(Compliance,"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlVersion')),Compliance) | eval NonCompliance=if('<<FIELD>>'="Compliant",NonCompliance,if(isnull(NonCompliance),"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlID',mvappend(NonCompliance,"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlVersion')))] | top 50 NonCompliance | eval controlVersion=mvindex(split(NonCompliance,":"),1) | eval NonCompliance=mvindex(split(NonCompliance,":"),0) | rename NonCompliance as "Name"   I have modified the above query to add a new column which shows RiskRating.    | spath evaluation_results | search gear_name | spath input=evaluation_results | foreach *.compliant [| eval Compliance=if('<<FIELD>>'="Compliant",if(isnull(Compliance),"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlVersion',"<<MATCHSEG2>>".":".'<<MATCHSEG2>>.riskRating',mvappend(Compliance,"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlVersion',mvappend(Compliance,"<<MATCHSEG2>>".":".'<<MATCHSEG2>>.riskRating')),Compliance) | eval NonCompliance=if('<<FIELD>>'="Compliant",NonCompliance,if(isnull(NonCompliance),"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlID',"<<MATCHSEG2>>".":".'<<MATCHSEG2>>.riskRating',mvappend(NonCompliance,"<<MATCHSEG1>>".":".'<<MATCHSEG1>>.controlVersion',"<<MATCHSEG2>>".":".'<<MATCHSEG2>>.riskRating')))] | top 50 NonCompliance | eval controlVersion=mvindex(split(NonCompliance,":"),1) | eval riskRating=mvindex(split(NonCompliance,":"),2) | eval NonCompliance=mvindex(split(NonCompliance,":"),0) | rename NonCompliance as "Name"   Unfortunately the query doesn't execute. Can someone please help with where I got it wrong and what needs to be modified? The output columns should show as below: Name.    Count.    Percentage.    ControlID.    Risk Rating. Below is my raw source   | makeresults | eval _raw="{\"job_id\": \"abc123\", \"gear_event_id\": \"aaaa\", \"event_id\": \"7cf6-4ff0\", \"execution_start\": \"2021-10-06 13:29:31.143\", \"execution_end\": \"2021-10-06 13:29:50.104\", \"gear_version\": \"3.0.16\",\"gear_name\": \"sns\", \"resource_type\": [\"sns_topic\"], \"event_status\": \"SUCCESS\", \"compliance_result\": \"Compliant\", \"evaluation_results\": {\"Tags\": {\"compliant\": \"Compliant\", \"controlVersion\": \"1.0\", \"evaluationDetails\": \"\", \"riskRating\": \"Low\"}, \"Tags\": {\"compliant\": \"Compliant\", \"controlVersion\": \"1.0\", \"evaluationDetails\": \"not approved\", \"riskRating\": \"Low\"}, \"correlation_id\": \"4362-47fb\", \"service\": \"biosevent\", \"timestamp\": \"2021-10-06 13:29:31.143\", \"version\": \"3.0.16\", \"duration\": 18.961}}"  

Hello. I have some KVStore collections in our cloud environment.  In some of those collections, there are boolean fields that I want to use with search logic.  Examples are called "curbside.disabled" and "curbside.offered".  I want to be able to say if curbside.offered is true, add 1 to a totalOffered field so I can get a count of all offered items offered and all items disabled.  Then I can do some math on those.  Each time I try to use one of those fields, the search failed.  When I assign a temp field to typeof(curbside.disabled), etc. it returns "invalid".  The kvstores were created in Lookup Editor and lookup definitions are created.  I can see the fields and table them.  I can't use the data in them.  What am I doing wrong?

Hi All, Is there any account lockout policy after multiple failed attempts in Splunk SOAR (on premise), i.e: The user's account get locked for 30mins after 3 continuous failed/incorrect password attempts to login.  

Hi, I need to set up an alert with the query like below. index=abc sourcetype=bcd “abc” File_name=maple.txt earliest=2h@h latest=now In the above query,the File_name,earliest & latest time has to be picked up from the lookup file. Condition - if the current time matches with latest time in the lookup file,then the query has to be run for the respective File_name for that timerange(earliest and latest time mentioned in the lookup) The lookup table to be like below: File_name earliest latest Dfg.txt 2 4 Dft.txt 5 6 Ser.txt 5 7

I have an alert table with certain values: Time (alert occurrence) | Alert Name | Severity.... Would it be possible to create a time entry the first time an alert is accessed? This would help me to create a first response SLA. Time Alert Name Severity First reponse SLA 03/16/2022 05:20 PM Failed Login Medium 03/16/2022 05:25 PM 00:05 03/16/2022 05:30 PM Acces invalid High    

Hello, I add an CSV data into my splunk without any timestamp and SPLUNK add automatiquely an timestamp with the format "3/16/22 4:33:55.000 PM" I would like change the date on the format "3/16/22" how can I do that ?    Regards,    

Hello, Is the IT essentials work app able to provide all the functionalities that the now deprecated splunk app for windows infraestructure did? In detail, we use the former to alert when a user has group membership changes in Active Directory for specific groups. The data we use for this comes from the WinEventLog:Security source. Thanks.