Hi, I am facing the next problem. When having the next _raw:   process="\"C:\\Windows\\regedit.exe\" /s \"C:\\Program Files (x86)\\SAP\\RPW.reg\""   The value of the process field that I expect is:   "C:\Windows\regedit.exe" /s "C:\Program Files (x86)\etc\etc.etc"   But what the automatic extraction gets is the same but without the initial and ending quotation marks:   C:\Windows\regedit.exe" /s "C:\Program Files (x86)\etc\etc.etc     Any ideas of how to get the expected value? It seems it doesn't respect the escaped characters.

We have a heavy forwarder running some Add-ons, and one of them (SNow) is eating up all the memory. We have workload management enabled on our search head clusters for cpu/memory management, but wanted to see if it's possible to restrict mem/cpu usage for ingest on the HF using WM. If that's a possibility, where would I edit settings to update the configurations accordingly? 

Is there a way of checking if the latest csv updates were successful and if they were the most up to date versions (as I have csv files updated daily) - also if they were successful when they were run via scheduled tasks?

Hi, I have csv file containing emailID and domain  and I would like to search the email exchanges between these two(emaild and domain) Csv file looks like below  emailID                                           domain test1@company.com             abc.com test2@company.com             xyz.com test3@company.com             some.com so on .......... based on the above I need to check how many time the emails exchanged between emailID and domain, I tried with below query but unable to get the result my search.... [| inputlookup test.csv | eval emailID = mvjoin(emailID ,",") | eval domain= "*@.".domain | eval condition1 = "Sender IN (".domain.") AND Rcpt IN (".emailID .") " | return $condition1 ] | table Sender Rcpt  

In my events, there is a field called "is_interactive"  which has value of either 0 or 1. Now the thing is, not all of my events has the field "is_interactive" in them. How to do I know, how much of of my events have this field in them ?

Please help with an SPL or use MC to see if / when a HF stops sending data or there is a big drop in the amount of data it usually sends like 10% of the normal data sent. How do I tell if a HF is sick & not functioning? I appreciate your time in advance. Thc

Hello all, Looking for a way to modify the Splunk Health Check for small buckets. Specifically, I would like the healthcheck to exclude certain indexes. For example, I like knowing if I am getting too many small buckets... but not if it is for my test index.  Buckets Root Cause(s): The percentage of small buckets (100%) created over the last hour is high and exceeded the red thresholds (50%) for index=test, and possibly more indexes, on this indexer. At the time this alert fired, total buckets created=6, small buckets=6 The percentage of small buckets (100%) created over the last hour is high and exceeded the red thresholds (50%) for index=test, and possibly more indexes, on this indexer. At the time this alert fired, total buckets created=5, small buckets=5

I am unable to make the Threat Intelligence input for hailataxii work using on-prem Splunk Enterprise. Splunk Enterprise version 8.2.4 and Enterprise Security version 7.0.0.   The Threat Intelligence Audit dashboard shows "TAXII feed polling starting" The Intelligence Audit events below show an error message   2022-01-10 20:11:51,120+0000 ERROR pid=3116 tid=MainThread file=threatlist.py:download_taxii:476 | <urlopen error [Errno 111] Connection refused> Traceback (most recent call last): File "/opt/splunk/lib/python3.7/urllib/request.py", line 1350, in do_open encode_chunked=req.has_header('Transfer-encoding')) File "/opt/splunk/lib/python3.7/http/client.py", line 1281, in request self._send_request(method, url, body, headers, encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1327, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1276, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1036, in _send_output self.send(msg) File "/opt/splunk/lib/python3.7/http/client.py", line 976, in send self.connect() File "/opt/splunk/etc/apps/SA-ThreatIntelligence/contrib/libtaxii/clients.py", line 478, in connect (self.host, self.port), self.timeout, self.source_address) File "/opt/splunk/lib/python3.7/socket.py", line 728, in create_connection raise err File "/opt/splunk/lib/python3.7/socket.py", line 716, in create_connection sock.connect(sa) ConnectionRefusedError: [Errno 111] Connection refused During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/splunk/etc/apps/SA-ThreatIntelligence/bin/threatlist.py", line 439, in download_taxii taxii_message = handler.run(args, handler_args) File "/opt/splunk/etc/apps/SA-ThreatIntelligence/bin/taxii_client/__init__.py", line 173, in run return self._poll_taxii_11(parsed_args) File "/opt/splunk/etc/apps/SA-ThreatIntelligence/bin/taxii_client/__init__.py", line 81, in _poll_taxii_11 http_resp = client.call_taxii_service2(args.get('url'), args.get('service'), tm11.VID_TAXII_XML_11, poll_xml, port=args.get('port'), timeout=args['timeout']) File "/opt/splunk/etc/apps/SA-ThreatIntelligence/contrib/libtaxii/clients.py", line 344, in call_taxii_service2 response = urllib.request.urlopen(req, timeout=timeout) File "/opt/splunk/lib/python3.7/urllib/request.py", line 222, in urlopen return opener.open(url, data, timeout) File "/opt/splunk/lib/python3.7/urllib/request.py", line 525, in open response = self._open(req, data) File "/opt/splunk/lib/python3.7/urllib/request.py", line 543, in _open '_open', req) File "/opt/splunk/lib/python3.7/urllib/request.py", line 503, in _call_chain result = func(*args) File "/opt/splunk/etc/apps/SA-ThreatIntelligence/contrib/libtaxii/clients.py", line 374, in https_open return self.do_open(self.get_connection, req) File "/opt/splunk/lib/python3.7/urllib/request.py", line 1352, in do_open raise URLError(err) urllib.error.URLError: <urlopen error [Errno 111] Connection refused>   Any ideas???