All Topics

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Topics

Hello everybody, I am upgrading Splunk Enterprise from 7.3.X to 8.2.5 (Windows). Due to the compatibility, I also need a more recent Windows version on my hosts to support Splunk. Therefore, I'm gon... See more...
Hello everybody, I am upgrading Splunk Enterprise from 7.3.X to 8.2.5 (Windows). Due to the compatibility, I also need a more recent Windows version on my hosts to support Splunk. Therefore, I'm gonna use a new host for each server. The architecture includes: - 1 cluster master - 1 deployment servers - 1 search head - 2 indexers (cluster) - 1 poller (heavy forwarder) - n universal forwarders I've found HERE how to migrate a Splunk Enterprise instance from one physical machine to another, can anybody confirm me the following procedure? - Stop Splunk Enterprise services on the host from which I want to migrate - Roll any hot buckets on the source host from hot to warm - Copy the entire contents of the $SPLUNK_HOME directory and all the directories containing buckets from the old host to the new one - Turn off the old host - Configure the new host in order to have the same IP address and hostname of the old host. This avoid not to redirect forwarders to the new instance - Install Splunk Enterprise 7.3.X on the new host - Verify that the index configuration (indexes.conf) file's volume, sizing, and path settings are still valid on the new host. - Start Splunk Enterprise on the new instance. - Log into Splunk Enterprise and confirm that your data is intact by searching it - Upgrade from 7.3.X to 8.1.X and then to 8.2.5 Should I apply these steps to every host? What about the two indexers? I'm gonna need to migrate data, what's the correct procedure? Also, I'm afraid that the new installation would reingest data from the poller, should I do something to prevent it? Last thing: I'm gonna probably need to change the IP of one indexer, when should I change its configurations?   Thanks in advance for any help.
I can't seem to figure this out. I've read every thread on here as well as Splunk docs relating to this. The spl output looks like I want it to, but on a dashboard everything is blue. I've added fiel... See more...
I can't seem to figure this out. I've read every thread on here as well as Splunk docs relating to this. The spl output looks like I want it to, but on a dashboard everything is blue. I've added fieldColors to my source, but still can't get it to work. What am I missing? Attachment provided.     index=health_checks dev=false | stats avg(eval(round(uptime_minutes*100,0))) as uptime, avg(eval(round(month_minutes*100,0))) as month, by customer | eval score=round(uptime/month*100,0) | eval range=case(score < 75, "severely degraded", score >= 75 AND score < 95, "slightly degraded", score >= 95, "healthy") | stats count(score) as stacks by range           <option name="charting.fieldColors">{"healthy": 0x008000, "slightly degraded": 0xFFFF00, "severely degraded": 0xFF0000, "NULL": 0xC4C4C0}</option>      
OS: RHEL 7 Splunk Version: 8.0.4   Hi, I have a problem that recently popped up after upgrading from Splunk 8.0.4 to 8.2.1. In version 8.0.4, Splunk would generate our report and send out email... See more...
OS: RHEL 7 Splunk Version: 8.0.4   Hi, I have a problem that recently popped up after upgrading from Splunk 8.0.4 to 8.2.1. In version 8.0.4, Splunk would generate our report and send out emails with no problems. Now we are receiving this error message in the Search & Reporting app. The error states: "Error in lookup command: Script execution failed for external search command   '/<Splunk_Home>/etc/apps/TA-user-agents/bin/user_agents.py' I've checked the permissions on the user_agents.py file and it looks to be correct.   Any help or suggestions is greately appreciated.
Hi Guys, I am having a query which would result as below, The above shows count by xyz for the user selected timerange.  I would like to add one more column to this table as LessThanThreshold -... See more...
Hi Guys, I am having a query which would result as below, The above shows count by xyz for the user selected timerange.  I would like to add one more column to this table as LessThanThreshold - which would tell the number of times the count in each day was below the corresponding Threshold value. To be precise for a row, if the value of 01-Mar-22 < Threshold then increment the new column LessThanThreshold by 1, if 28-Feb-22<Threshold, then increment LessThanThreshold by 1.  Using Foreach I am not sure to compare between columns itself. Could someone please help me out here. Thanks
 I am performing theSplunk query on following result, The following field repeats 100 times with different values randomstring=randomstring&firstRex=firstRexValue&anotherradomstring=antotherrandoms... See more...
 I am performing theSplunk query on following result, The following field repeats 100 times with different values randomstring=randomstring&firstRex=firstRexValue&anotherradomstring=antotherrandomstring&secondRex=secondrexvalue&somotherstuff=someotherstuffvalue&yetanotherstuff=yetanotherstuffvalue&thirdRex=thirdrexvalue the Splunk query is as below.       source="source" searchquery | rex "firstRex=(?<value1>[^&]+)" | rex "secondRex=(?<value2>[^&]+)" | rex "thirdRex=(?<value3>[^&]+)" | transaction value1 | table value2 value3         Now when I do table, the value2 and value3 doesn't seems connected.  I mean the column value2 has 5 rows while column value3 has 7 rows for example. Further, I would also like to add date for each event in the table, how can I do it? and I would need your suggestion to perform regex in single rex query instead of three
Good Morning, I am attempting to use a TimeChart that will show me the ratio of my GET/POST HTTP requests within the span of 1 hour. However, the output in my TimeChart only displays the latest re... See more...
Good Morning, I am attempting to use a TimeChart that will show me the ratio of my GET/POST HTTP requests within the span of 1 hour. However, the output in my TimeChart only displays the latest result, regardless of what time (I.E if the current ratio output is .75 as of 9:00pm, it will display as .75 for 8:00pm, even though it was .50 at 8:00pm). Here is current search query: index=nsm source="/nsm/zeek/logs/current/*http*" | eventstats count(eval(method="GET")) as GET, count(eval(method="POST")) as POST | eval Ratio=round(GET/POST, 2) | timechart span=1h values(Ratio) I've attempted many different things, including Time Modifiers, but so far no luck. This is the closest to get it to where I want, but it will not accurately display the Ratio of the previous time. Is here anyway around this?
I have created a table that looks as follows: The colums are variable as they depend on the selected time frame. I want to apply a conditional format on each cell in the table based on the first... See more...
I have created a table that looks as follows: The colums are variable as they depend on the selected time frame. I want to apply a conditional format on each cell in the table based on the first numeric value in each cell. The cell should be colored red if the numeric value is lower than 400. Applying the following colorPalette expression doesn't seems to work: <format type="color"> <colorPalette type="expression">if(tonumber(mvindex(split(value," "),0)) &lt; 400,"#FF5733",null)</colorPalette> </format>  While the following does: <format type="color"> <colorPalette type="expression">if((substr(value,1,1)="1" OR substr(value,1,1)="2" OR substr(value,1,1)="3" OR substr(value,1,1)="0") AND substr(value,4,1)=" ","#FF5733",if(substr(value,3,1)=" ","#FF5733", null))</colorPalette> </format> However, the latter expression doesn't color cells with a numeric value of 0. In addition, it looks sloppy and is difficult to understand for my colleagues. Can someone explain why the first expression doesn't work and/or provide a solution? Thank you.
Background In my system, every visit consist of one or more transactions and every has its global serial number, which is unique(gsn for short). A transaction may produce many rows of logs but it ha... See more...
Background In my system, every visit consist of one or more transactions and every has its global serial number, which is unique(gsn for short). A transaction may produce many rows of logs but it has the same gsn. A transaction always ends with "trans end transName", while the "transName" means the name of the transaction, a transaction named Test ends with "trans end Test", for example. Every transaction's name is unique. Questions Now I have a transaction named A, which in some case will do something specially and log "special". But other transactions will log "special" too. And most 1 "special" and 1 "trans end A" per gsn. How can I get the rate of transaction A that goes this way by just one command or, some fast ways than subsearch? Tried Below is what I've tried. The subsearch runs very slowly, which takes 5 min at least. If there's no one-command way, I want to get a  way faster than subsearch.     //get the count of transaction A "trans end A" | stats count //get the count of transaction A that runs specially join type=inner gsn [search "trans end A"] | regex "special" | stats count      
I'm new with splunk, I installed app ms windows ad object but in order to fix the shared points: First: Add an automatic lookup for source XMLWinEventLog:Security using the AD_Audit_Change_EventCode... See more...
I'm new with splunk, I installed app ms windows ad object but in order to fix the shared points: First: Add an automatic lookup for source XMLWinEventLog:Security using the AD_Audit_Change_EventCodes lookup. In the MS Windows AD Objects app, navigate to Settings - - > Lookups - - > Automatic Lookups. Click New Automatic Lookup Enter the following: Name: ms_ad_obj_wrkaround_msad_action Source: XmlWinEventLog:Security Lookup Input Fields: EventCode = EventCode obj_type = obj_type Lookup output Fields: change_action = change_action Click Save Set the permissions to the app and role permissions   I did what is asked but I still get the message: Could not load lookup=LOOKUP-ms_ad_obj_wrkaround_msad_action with a failure for some functionalities of the application
Je suis nouveau avec splunk, j’ai installé l’application ms windows ad object mais afin de corriger les points partagés: Tout d’abord: Ajouter une recherche automatique pour la source XMLWinEventLog... See more...
Je suis nouveau avec splunk, j’ai installé l’application ms windows ad object mais afin de corriger les points partagés: Tout d’abord: Ajouter une recherche automatique pour la source XMLWinEventLog:Security en utilisant la recherche AD_Audit_Change_EventCodes. Dans l’application Objets MS Windows AD, accédez à Paramètres - - > Recherches - - > Recherches automatiques. Cliquez sur Nouvelle recherche automatiqueEntrez ce qui suit :   Nom : ms_ad_obj_wrkaround_msad_action Source : XmlWinEventLog:SecurityLookup Input Fields: EventCode = EventCode obj_type = obj_type Champs de sortie de recherche : change_action = change_action Cliquez sur EnregistrerRégez   les autorisations sur l’application et les autorisations de rôle J’ai fait ce qui est demandé mais je reçois toujours le message: Impossible de charger la recherche=LOOKUP-ms_ad_obj_wrkaround_msad_action avec un échec pour certaines fonctionnalités de l’application
Hi There, I am trying to get the an hourly stats for each status code and get the percentage for each hour per status. Not sure how to get it. my search | | bucket _time span=1h | stats count by... See more...
Hi There, I am trying to get the an hourly stats for each status code and get the percentage for each hour per status. Not sure how to get it. my search | | bucket _time span=1h | stats count by _time http_status_code | eventstats sum(count) as totalCount | eval percentage=round((count/totalCount),3)*100 please suggest which command could be helpful here.  thanks
hi     | table "Start connexion" "End connexion"     The result of my search display a table with a suite of 2 dates  Instead a table, I need to display this results in a line chart H... See more...
hi     | table "Start connexion" "End connexion"     The result of my search display a table with a suite of 2 dates  Instead a table, I need to display this results in a line chart How to do please?
| lookup update=true SpamIntel_by_email_subject subject OUTPUT | lookup update=true SpamIntel_by_email_subject_wildcard subject OUTPUTNEW What is update=true ? What field it is comparing to upda... See more...
| lookup update=true SpamIntel_by_email_subject subject OUTPUT | lookup update=true SpamIntel_by_email_subject_wildcard subject OUTPUTNEW What is update=true ? What field it is comparing to update what ? Whats the difference between between Output and Outputnew I didn't understand from the splunk's documentation well.
In the classic Dashboard environment we can specify a 'valuePrefix' for an input. In the Dashboard Studio GUI editor there does not seem to be such an option. Is there a way to do this the using ... See more...
In the classic Dashboard environment we can specify a 'valuePrefix' for an input. In the Dashboard Studio GUI editor there does not seem to be such an option. Is there a way to do this the using code editor?   Thanks
Where can i get the splunk Universal Forwarder 7.1.0. In the splunk portal they have removed all the older releases. please help me in this.
Hi All, I have created a newly created field/field alias/field extraction with GLOBAL Permissions. Example | eval test="MyApp" This works fine when I use it in search but when I save it as ca... See more...
Hi All, I have created a newly created field/field alias/field extraction with GLOBAL Permissions. Example | eval test="MyApp" This works fine when I use it in search but when I save it as calculated field it doesn't show up.  I refreshed 10 times even cleared browser cache and logged back in. Still same issue. We don't see newly created KO in the logs but can run those in searches. Any inputs or help  @woodcock @Splunkers 2022 
Hi, I am trying to create a alert for cpu usage by using below query, index=os host=cbtsv | stats latest(*) as * by host | table _time cpu_load_percent cpu_user_percent | eval CPU=cpu_load_per... See more...
Hi, I am trying to create a alert for cpu usage by using below query, index=os host=cbtsv | stats latest(*) as * by host | table _time cpu_load_percent cpu_user_percent | eval CPU=cpu_load_percent+cpu_user_percent|stats avg(CPU) as percent by host here Ii am trying to add 2 fields (CPU=CPU load + cpu user) but it is not giving results as expected I want an alert to be triggered when Avg value of CPU=(cpu_load + cpu user) exceeds 90%. How do I set the alert to meet the conditions above? Final output like Timestamp Hostname CPU Status 28/02/2022 21:58:00 cbtsv 90% Critical  
Hi, I need to filter my query for a specific field_value. The working query is as follow: index=_index (field_value="value1" OR field_value="value4" OR field_value="value14") | ..... Now, I wo... See more...
Hi, I need to filter my query for a specific field_value. The working query is as follow: index=_index (field_value="value1" OR field_value="value4" OR field_value="value14") | ..... Now, I would like to retrieve those field values from a remote json file and pass it to search condition this way: index=_index (field_value in listOfFieldValuesFromRemoteJson) | ..... Could you please help me make it work? The json file : [{"field_value": "value1"},{"field_value": "value4"},{"field_value": "value14"}] Best regards, Dhiaeddine
Hi,  i am trying to create an add on that runs a powershell script to perform some actions. Since i dont want to hardcode a path i would like to access $SPLUNK_HOME within my powershell script. afa... See more...
Hi,  i am trying to create an add on that runs a powershell script to perform some actions. Since i dont want to hardcode a path i would like to access $SPLUNK_HOME within my powershell script. afaik $SPLUNK_HOME gets set as environment variable upon script start. so im using (get-item env:\SPLUNK_HOME).value  Is there a way to "test run" my scripts with a splunk environment set?
Hi All,  can anyone recommend a feed or app that can fetch the reputation score /threat score of an IP and save it in a field ?   The APP for VirusTotal does not fetch the score of IP.  Have already ... See more...
Hi All,  can anyone recommend a feed or app that can fetch the reputation score /threat score of an IP and save it in a field ?   The APP for VirusTotal does not fetch the score of IP.  Have already tried it.