Hi I wanted to break the line from {"id" so that splunk will treat it as a new event from {"id from below event, I have mentioned the props.conf and the event, please find the same and let me know in case of any concerns.   INDEXED_EXTRACTIONS = JSON KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false SEGMENTATION = iso8601 #TIME_FORMAT=%YYYY-%MM-%DDT%H:%M:%SZ TIMESTAMP_FIELDS = started_on TRUNCATE = 0 category = Ver. 1    

I am currently working with DbConnect in order to send logs over to an Oracle db. I have a scheduled output set up on my heavy forwarder but it has not been sending logs to Oracle so I have been trying to debug it with the  dbxoutput command. In the search on the HF, I am running the search successfully and from what I am seeing, it should be sending the logs over. However, when I query the Oracle table on in the SQL Explorer, I do not see any new logs being shown in the table. Does anyone know where I can look on the CLI to see if there are any error logs associated with this output?

Hi Team, We got an requirement to create a report based on the accessed time present in the logs here in the logs the time is present with seconds, milliseconds, microseconds, nanoseconds value. Example: 1s79ms874µs907ns So here in this case how to convert them into a unique value.  So post which we need to check and create a report for the same. In most of the cases the time is getting started with milliseconds and in few cases the time information is getting started with seconds. So how to convert the time (1s79ms874µs907ns) to an unique value either in seconds, milliseconds , microseconds or nanoseconds so then only we can able to create a report for the same. Or do we have any other option to fix this issue while searching the logs during runtime. So kindly help on my request. Sample Logs for Reference: DEBUG 2022-03-10 07:17:26,239 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 145ms227µs975ns ago, IN_USE DEBUG 2022-03-10 07:07:26,239 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 1s79ms874µs907ns ago, IN_USE DEBUG 2022-03-10 07:02:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 7ms215µs946ns ago, IN_USE DEBUG 2022-03-10 06:57:26,237 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 168ms259µs830ns ago, IN_USE DEBUG 2022-03-10 06:57:26,237 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 6s993ms781µs523ns ago, IN_USE DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 2ms593µs888ns ago, IN_USE DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 55ms239µs616ns ago, IN_USE DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 957ms778µs205ns ago, IN_USE DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 45ms536µs884ns ago, IN_USE DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 22ms906µs437ns ago, IN_USE DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 46ms556µs466ns ago, IN_USE DEBUG 2022-03-10 06:42:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 3s286ms410µs997ns ago, IN_USE DEBUG 2022-03-10 06:37:26,239 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 842ms323µs432ns ago, IN_USE DEBUG 2022-03-10 06:27:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 7ms698µs576ns ago, IN_USE DEBUG 2022-03-10 06:27:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 18ms948µs359ns ago, IN_USE DEBUG 2022-03-10 06:17:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 257ms32µs814ns ago, IN_USE  

Dear Splunk community, I have the following query:     index="myIndex" source="*mySource*" nameOfLog* "ExitCode: 0" | stats count by _time     Once a day a event is generated. So either it was generated (count = 1) or it was not (count = 0). I have a line diagram for the last 30 days that looks like this: On February 20th there was one event generated. On 23 February there was one event generated. On 21th and 22th of February, no events were generated. Therefore I expect the line to go down in the line chart like so: ------_------- This is not happening, and I am wondering why. How do I adjust this to show count=0 in the chart aswell? Thanks.

Hi all, I have 2 queries, from one i get a list of files and the other query should use these files as their source to get some results. The output of first queries may have a lot files and i want to use all of them together in the second query. Does anyone have idea of how to do this one?

Hi Splunkers, i'm trying to build a most common search, wich is: track when a WIndows/Active Directory account is changed from disabled to enabled. The starting point, the switching to enable, is not a problem for me; this because I know that tracking the EventCode=4722 help me with this scenario. The "but" here is the following: the customer want to be able to distinguish the legit changes from not legit ones. Here there are two tipical scenario, one admitted and one not: New User When a new user arrives in the company and their user account is created, Active Directory first generates an account creation event and then generates another user account enable event. This case should not be alerted because it is a normal process. User disabled in the company When a user left the company some time ago and his user account changes the status to Enabled it is an Abnormal Event, so it should be alerted. So, my question is: how can I identify the legit situation from the not legit one?  

hello as you can see i stats events following the bin time value But when the bin time value is equal to 0, I have nothing displayed I would like to display the results even if the result is 0 but just for hour corresponding to the current hour or to the previous hour It means that I dont want to display 0 for a bin time which is later than the current hour     index=toto sourcetype=titi | bin span=1h _time | eval time = strftime(_time, "%H:%M") | stats count as Pb by s time | search Pb >= 3 | stats dc(s) as nbs by time | rename time as Heure     I tried like this but it doesnt works     | appendpipe [ stats count as _events | where _events = 0 | eval nbs = 0 ]      could you help please?

I'm getting logs from a dockerized in-house developed application and ingesting them into Splunk. There are 3 types of logs, coming into the log file: 1. Application logs (single line, internal format) 2. UWSGI logs (multiline) 3. ModSecurity serial logging (multiline) The logs are forwarded to remote syslog server, and then ingested into Splunk with universal forwarder. While those logs are in different formats I want to separate them into different indexes for different processing approaches. Is there any good documentation piece/forum post/tutorial/anything that describes effective way to separate different log types from a mixed source? Thank you!