Hi, I have created an app in Azure given the permissions to the Office 365 management activity API and also created the Microsoft Office 365 Reporting Add-on in Splunk. The results when searching is not covering the fields i want. I want to get the subject of the email which Defender for O365 has triggered an alert on. Is the API sending the data? If yes, where is the fields stuck? Br, Robar

Hi! We deployed 2 new servers on Linux and cteated from them SHcluster. Captain: dynamic_captain : 1 elected_captain : Wed Feb 2 12:03:47 2022 id : 4F8CBE82-6302-4582-9FB7-48AC452AA43D initialized_flag : 1 label : sphome5 mgmt_uri : https://%%%%%%%%% min_peers_joined_flag : 1 rolling_restart_flag : 0 service_ready_flag : 1 Members: sphome5 label : sphome5 mgmt_uri : https://%%%%%%%%% mgmt_uri_alias : https://%%%%%%%%% status : Up sphome6 label : sphome6 last_conf_replication : Wed Feb 2 12:07:49 2022 mgmt_uri : https://%%%%%%%%% mgmt_uri_alias : https://%%%%%%%%% status : Up After creating the SHcluster, it is assigned a long ID (4F8CBE82-6302-4582-9FB7-48AC452AA43D). At now we need add older indexers via Search peers=>new search peers etc. Older indexers deployed on Windows Servers 2016 and 2019 When I try add new search peer after create i see that replication status is Failed. In file splunkd.log on indexer i see following error: BundleDataProcessor - File length is greater than 260, File creation may fail for C:\Program Files\Splunk\var\run\searchpeers\4F8CBE82-6302-4582-9FB7-48AC452AA43D-1643781827.82278d5fd22b73a1.tmp\apps\TA-alfa-telegram--connector\bin\ta_alfa_telegram_connector\aob_py2\cloudconnectlib\splunktacollectorlib\data_collection\ta_checkpoint_manager.py How we can change ID SHcluster (6302-4582-9FB7-48AC452AA43D) to shorter? And additional if is it inposable Could you please give any recomendation how we can solution this problem?

Hello,   I would like to summary index some data from heaving searches. The savedsearch is     [Summary - servizi BIND by Clients] action.email.useNSSubject = 1 action.summary_index = 1 action.summary_index._name = summary_ldap action.summary_index.instance = servizi action.summary_index.type = client alert.track = 0 cron_schedule = 0 2 * * * description = BIND by clients on servizi dispatch.earliest_time = -1d@d dispatch.latest_time = @d display.general.timeRangePicker.show = 0 enableSched = 1 schedule_window = 60 search = index=ldap sourcetype=ldap:syslog instance=servizi\ [search index=ldap sourcetype=ldap:syslog instance=servizi op_type=BIND\ | where dn!="cn=replication manager,cn=config"\ | fields conn host instance]\ | where in(op_type,"connection","closed","BIND")\ | transaction maxopenevents=-1 maxopentxn=-1 maxevents=-1 mvlist=t startswith=client_ip=* conn host instance\ | lookup dnslookup clientip as client_ip OUTPUT clienthost as client\ | eval client_ip=mvindex(client_ip,mvfind(client_ip, "^\d+")), client=if(isnull(client),client_ip,client), dn=lower(dn)\ | mvexpand dn\ | where dn!="null"\ | sichart count(dn) over dn by client       The subsearch returns million of results, so I have already increased maxout (and maxresultrows in [searchresults]. The problem is that this search never ends. In the "Job Manager" the search is always in parsing mode.  This search is still running and is approximately 0% complete. (SID: scheduler__nobody__DS389__RMD58ebfeb8123af6f21_at_1643763600_45904)  The search log terminated with: 02-02-2022 02:02:24.087 INFO SearchOperator:kv [182237 searchOrchestrator] - Extractor stats: name=dnexplicitanom, probes=225, total_time_ms=5, max_time_ms=1 02-02-2022 02:02:24.091 INFO ISearchOperator [182237 searchOrchestrator] - 0x7f3315be3400 PREAD_HISTOGRAM: usec_1_8=6754 usec_8_64=7150 usec_64_512=76 usec_512_4096=25 usec_4096_32768=28 usec_32768_262144=1 usec_262144_INF=0 02-02-2022 02:02:24.092 INFO SearchStatusEnforcer [182237 searchOrchestrator] - SearchStatusEnforcer is already terminated   It's all INFO rows, no WARN, no ERROR. Looking at the log I see that the subsearch terminated well:   audit.log:02-02-2022 02:02:50.993 +0100 INFO AuditLogger - Audit:[timestamp=02-02-2022 02:02:50.993, user=splunk-system-user, action=search, info=completed, search_id='subsearch_scheduler__nobody__DS389__RMD58ebfeb8123af6f21_at_1643763600_45904_1643763603.1', has_error_warn=false, fully_completed_search=true, total_run_time=140.00, event_count=3337731, result_count=3337731, available_count=3337731, scan_count=3340592, drop_count=0, exec_time=1643763603, api_et=1643670000.000000000, api_lt=1643756400.000000000, api_index_et=N/A, api_index_lt=N/A, search_et=1643670000.000000000, search_lt=1643756400.000000000, is_realtime=0, savedsearch_name="", search_startup_time="740", is_prjob=false, acceleration_id="A3473993-F504-40E9-8902-DDB9B00D2B1B_DS389_nobody_d9f7ec6dda7fbf4b", app="DS389", provenance="N/A", mode="historical", is_proxied=false, searched_buckets=13, eliminated_buckets=0, considered_events=3341037, total_slices=139625, decompressed_slices=125689, duration.command.search.index=4522, invocations.command.search.index.bucketcache.hit=0, duration.command.search.index.bucketcache.hit=0, invocations.command.search.index.bucketcache.miss=0, duration.command.search.index.bucketcache.miss=0, invocations.command.search.index.bucketcache.error=0, duration.command.search.rawdata=40772, invocations.command.search.rawdata.bucketcache.hit=0, duration.command.search.rawdata.bucketcache.hit=0, invocations.command.search.rawdata.bucketcache.miss=0, duration.command.search.rawdata.bucketcache.miss=0, invocations.command.search.rawdata.bucketcache.error=0, sourcetype_count__ldap:syslog=3337731, roles='admin+power+splunk-system-role+user', search='search index=ldap sourcetype=ldap:syslog instance=servizi op_type=BIND | where dn!="cn=replication manager,cn=config" | fields conn host instance']       Height hours have been passed, and no others logs have been written. The Job Manager still shows the process as "parsing". I see no errors, but in the system I see no process running about this scheduled search. So I suspect that it's not in progress. I don't know how to debug this issue. Do you have any hints?   The Splunk Enterprise version is 8.2.4. Thank you very much Kind Regards Marco

Hi all, I am planning on integrating o365 and Azure cloud services to my Splunk on-prem environment. Now there are several Add-Ons to choose from in Splunkase Microsoft Azure Add on for Splunk Splunk Add-on for Microsoft Office 365 Splunk Add-on for Microsoft Cloud Services What is the main difference between these Add-Ons and which should i use? The documentation did not really help. "The Splunk Add-on for Microsoft Office 365 replaces the modular input for the Office 365 Management API within the Splunk Add-on for Microsoft Cloud Services." Is it still possible to collect the o365 logs with the Cloud Services add-on which collects via so called event hubs?   Thank you, O.

Hi I have two result like this how can I create sankey diagram for it?   SOURCE                                       count Server1.Mainserver               629 Server2.Mainserver              2539 Server3.Mainserver             29668 Server_Name4.Mainserver 6470 Server5.Mainserver             114547 Server6.Mainserver             2 Server7.Mainserver             18 Server8.Mainserver             11 Server9.Mainserver             27 Server10.Mainserver             20375 Server11.Mainserver             698 Server12.Mainserver             61 Server13.Mainserver             10014 Server14.Mainserver             160672 Server15.Mainserver             16 Server16.Mainserver             6643 Server17.Mainserver             4780   TARGET                                          count Mainserver.Server1             624 Mainserver.Server2             2611 Mainserver.Server3             29962 Mainserver.Server_Name4 6503 Mainserver.Server5             115897 Mainserver.Server7             25 Mainserver.Server8             15 Mainserver.Server9             22 Mainserver.Server10             20586 Mainserver.Server11             640 Mainserver.Server12             61 Mainserver.Server13             9899 Mainserver.Server14             158477 Mainserver.Server15             7 Mainserver.Server16             6615 Mainserver.Server17             4777   something like this, Mainserver show in center   Any Idea? Thanks,  

Hi,   I'd like the users to not be able to create any new dashboards either from the search bar or the "Create New Dashboard" button on the dashboard's page. Only the admin users should be allowed access to create dashboards. However, the users should be able to run searches on the search bar.  Can anyone help me with this?   Thanks, Megha

Let's say I have a CSV input with the following columns:  _raw,user,src_ip The _raw event is:  "Accepted public key for user $user$ from $src_ip$" Is there a way to replace $user$ and $src_ip$ in _raw with the values of the corresponding fields? I tried using "foreach" and "rex" in sedcmd mode, but it doesn't look like rex understands <<FIELD>> and '<<FIELD>>'.   Is there another way to do this?

Hello, We are excited to announce the preview of Splunk Incident Intelligence. What is Splunk Incident Intelligence?  Splunk Incident Intelligence is an effort to develop a solution that will provide an optimal user-experience for enterprises to manage their incident response process for applications and  infrastructure as they navigate their digital transformation and cloud migration initiatives. Want to request more features? Add your ideas and vote on other ideas at   Splunk Incident Intelligence Ideas Portal  Please reply to this thread for any questions or get extra help!