Hi, I have difficulty to break a json into multiple events. Here is my log : (appear in one event, instead of 2)   { "InstanceInformationList": [ { "Version": false, "PlatformName": "Amazon Linux", "ComputerName": "ip-10-170-216-17.eu-east-1.compute.internal" }, { "PlatformType": "Linux", "IPAddress": "10.170.216.18", "AssociationOverview": { "DetailedStatus": "Failed", "InstanceAssociationStatusAggregatedCount": { "Failed": 1, "Success": 1 } }, "AssociationStatus": "Failed", "PlatformVersion": "2", "ComputerName": "ip-10-170-216-18.eu-east-1.compute.internal", "InstanceId": "i-00000000001", "PlatformName": "Amazon Linux" } ] }      And you can find my props.conf below :   [my_test] SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = json DATETIME_CONFIG = CURRENT TRUNCATE = 999999 JSON_TRIM_BRACES_IN_ARRAY_NAMES = true BREAK_ONLY_BEFORE = (\[\s+\{) MUST_BREAK_AFTER = (\},|\}\s+\]) SEDCMD-remove_header = s/(\{\s+.+?\[)//g SEDCMD-remove_footer = s/\]\s+\}//g       Can you help me to find the write parsing please ? Thank you.

I'm trying to exclude specific src_ip addresses from the results of a firewall query (example below). The query completes, however the src_ip addresses are not excluded and the following error is returned: [subsearch]: The lookup table 'dns_serves.csv' requires a .csv or KV store lookup definition.  Example: index=firewall | search NOT [|inputlookup dns_serves.csv | fields src_ip] | table src_ip dest_ip signature When running |inputlookup dns_servers.csv by itself the contents of the lookup are returned so I know the lookup is good. I've checked the lookup permissions, CSV encoding, and searches forum threads for a solution.   

Hi There Experts ,  In our current environment we have Splunk Integration with CA UIM monitoring tools to send Splunk alerts to CA UIM for Monitoring . While upgrading the splunk version we got to know that Client have customized app for this integration which was on python 2 and as we are upgrading from 7 .3. to 8.1, there is issue with python compatibility .As new splunk versions supports only python 3 .  Any one has any idea on the workaround app or addon we can use from splunk base for integrating Splunk with CA UIM .  Please help   

Hi, After the migration of our McAfee ePO server, I want to change the SQL query to reflect the changes made in the ePO database. But when I want to clic on "next" on the DataLab, the step 4 is faulty. The query is OK (in the DataLab, it return values), the "rising" parameters seems to be good, so I don't see what's going wrong. Thank's in advance for your help. Below the query :  SELECT [EPOEvents].[ReceivedUTC] as [timestamp], [EPOEvents].[AutoID], [EPOEvents].[ThreatName] as [signature], [EPOEvents].[ThreatType] as [threat_type], [EPOEvents].[ThreatEventID] as [signature_id], [EPOEvents].[ThreatCategory] as [category], [EPOEvents].[ThreatSeverity] as [severity_id], [EPOEventFilterDesc].[Name] as [event_description], [EPOEvents].[DetectedUTC] as [detected_timestamp], [EPOEvents].[TargetFileName] as [file_name], [EPOEvents].[AnalyzerDetectionMethod] as [detection_method], [EPOEvents].[ThreatActionTaken] as [vendor_action], CAST([EPOEvents].[ThreatHandled] as int) as [threat_handled], [EPOEvents].[TargetUserName] as [logon_user], [EPOComputerPropertiesMT].[UserName] as [user], [EPOComputerPropertiesMT].[DomainName] as [dest_nt_domain], [EPOEvents].[TargetHostName] as [dest_dns], [EPOEvents].[TargetHostName] as [dest_nt_host], [EPOComputerPropertiesMT].[IPHostName] as [fqdn], [dest_ip] = ( convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerPropertiesMT].[IPV4x] + 2147483648))),1,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerPropertiesMT].[IPV4x] + 2147483648))),2,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerPropertiesMT].[IPV4x] + 2147483648))),3,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerPropertiesMT].[IPV4x] + 2147483648))),4,1))) ), [EPOComputerPropertiesMT].[SubnetMask] as [dest_netmask], [EPOComputerPropertiesMT].[NetAddress] as [dest_mac], [EPOComputerPropertiesMT].[OSType] as [os], [EPOComputerPropertiesMT].[OSBuildNum] as [sp], [EPOComputerPropertiesMT].[OSVersion] as [os_version], [EPOComputerPropertiesMT].[OSBuildNum] as [os_build], [EPOComputerPropertiesMT].[TimeZone] as [timezone], [EPOEvents].[SourceHostName] as [src_dns], [src_ip] = ( convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),1,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),2,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),3,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),4,1))) ), [EPOEvents].[SourceMAC] as [src_mac], [EPOEvents].[SourceProcessName] as [process], [EPOEvents].[SourceURL] as [url], [EPOEvents].[SourceUserName] as [source_logon_user], [EPOComputerPropertiesMT].[IsPortable] as [is_laptop], [EPOEvents].[AnalyzerName] as [product], [EPOEvents].[AnalyzerVersion] as [product_version], [EPOEvents].[AnalyzerEngineVersion] as [engine_version], [EPOEvents].[AnalyzerDATVersion] as [dat_version], [EPOProdPropsView_VIRUSCAN].[datver] as [vse_dat_version], [EPOProdPropsView_VIRUSCAN].[enginever64] as [vse_engine64_version], [EPOProdPropsView_VIRUSCAN].[enginever] as [vse_engine_version], [EPOProdPropsView_VIRUSCAN].[hotfix] as [vse_hotfix], [EPOProdPropsView_VIRUSCAN].[productversion] as [vse_product_version], [EPOProdPropsView_VIRUSCAN].[servicepack] as [vse_sp] FROM [EPOEvents] LEFT JOIN [EPOLeafNodeMT] ON [EPOEvents].[AgentGUID] = [EPOLeafNodeMT].[AgentGUID] LEFT JOIN [EPOProdPropsView_VIRUSCAN] ON [EPOLeafNodeMT].[AutoID] = [EPOProdPropsView_VIRUSCAN].[LeafNodeID] LEFT JOIN [EPOComputerPropertiesMT] ON [EPOLeafNodeMT].[AutoID] = [EPOComputerPropertiesMT].[ParentID] LEFT JOIN [EPOEventFilterDesc] ON [EPOEvents].[ThreatEventID] = [EPOEventFilterDesc].[EventId] WHERE [EPOEvents].[AutoID] > ? AND ([EPOEventFilterDesc].[Language]='0409') ORDER BY [EPOEvents].[AutoID] ASC

Good afternoon! I have a XPRT_002_SYSAT-41777_202110020712.csv file. After some time, exactly the same XPRT_002_SYSAT-41777_202110020712.csv file appears in my directory, with exactly the same content, but with a different modification time. In this case, the system indexes all events from this file twice and I have duplicates. I know that they can be filtered by means of dedup _raw, but it is not my way because it very strongly worsens search performance. Are there any other ways to configure indexing based on file changes rather than name and size, and if they match, do not index again? Tried: crcSalt = <SOURCE> CHECK_METHOD = modtime

Citry contains 12 names. in result i am able to see only city name with product if product is zero it is not showing the Citry name base search |stats count(product) AS Total BY City |fillnull value=0 City Citry Total citry1 1 citry5 50 citry10 15 expectation  Citry Total citry1 1 citry2 0 citry3 0 citry4 0 citry5 50 citry6 0 citry7 0 citry8 0 citry9 0 citry10 15 citry11 0 citry12 0

Hi All, I am trying to merge  the rows of a column into one row for the below table: App_Name Country Last_Deployed Temp_Version com.citiao.cimainproject China 2021-09-24 13:30:04.39 1.0.12.20210907193849359 com.citiao.cimainproject HongKong 2021-09-24 11:48:15.176 1.0.12.20210907193849359 com.citiao.cimainproject Indonesia 2021-09-10 13:17:38.254 1.0.12.20210907193849359 com.citiao.cimainproject Malaysia 2021-09-10 14:54:54.098 1.0.12.20210907193849359 com.citiao.cimainproject Philippines 2021-09-24 11:58:44.034 1.0.12.20210907193849359 com.citiao.cimainproject Singapore 2021-09-10 12:53:25.539 1.0.12.20210907193849359 com.citiao.cimainproject Thailand 2021-09-24 14:01:09.682 1.0.12.20210907193849359 com.citiao.cimainproject Vietnam 2021-09-10 15:00:06.598 1.0.12.20210907193849359   I used the query as below: my query | stats values(App_Temp_Name) as App_Name latest(LAST_DEPLOYED) as Last_Deployed latest(APP_TEMP_VER) as Temp_Version by Country | table App_Name,Country,Last_Deployed,Temp_Version But I need to merge the rows of the column App_Name as one row keeping others as it is like: App_Name Country Last_Deployed Temp_Version com.citiao.cimainproject China 2021-09-24 13:30:04.39 1.0.12.20210907193849359   HongKong 2021-09-24 11:48:15.176 1.0.12.20210907193849359   Indonesia 2021-09-10 13:17:38.254 1.0.12.20210907193849359   Malaysia 2021-09-10 14:54:54.098 1.0.12.20210907193849359   Philippines 2021-09-24 11:58:44.034 1.0.12.20210907193849359   Singapore 2021-09-10 12:53:25.539 1.0.12.20210907193849359   Thailand 2021-09-24 14:01:09.682 1.0.12.20210907193849359   Vietnam 2021-09-10 15:00:06.598 1.0.12.20210907193849359 Please help me modify the query to get the desired output.   Thank you very much..!!

Hi ,  I am trying to get the day wise error count by data message only if the yesterdays error count is more than 50 . index="eshop" NOT(index=k8*dev OR index=k8*test) tag=error | eval time=strftime(_time,"%Y-%m-%d") |table time,data.message <condition if the previous day data message count is less than 50 then it should be ignored from the stats> | stats count by time,data.message

Hi i'm looking to use a heavy forwarder to append a string to specific log messages. Im following the guide here https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Anonymizedata (specifically the "Anonymize data with a regular expression transform" part)which only seems to mask data, i dont want to alter the log entry as such but rather add something like "<Review Required>" to the end of the log that matches a specific regex. Can this be done using the heavy forwarder and transforms.conf?