Hi, Access control page is throwing 404 error on search head.I am not able to access it.Whereas it is working fine on HF so version 8.0.5 is not the problem. How do i access the code of this page through back end.? How do i fix this error?

Hi,  We are using Splunk RPM package for installing splunk but before installing it we want to add some file to that package and  repack it as RPM and then use it to install on other machines.  Anybody please help me on that .. Thanks In Advance

Hi,  I have 2 multivalue fields I want to make a simple line chart out of them.  Each event looks like this  x: [0.1,0.2,0.3,0.4,0.5] , y: [1.7, 1.4, 2.4, 5.5 ,4.7]  Where x and y are multivalue fields in the event.  The line chart should be an average graph of those values in the selected time range. I tried using mvexpand and it didn't work.

Hi All, One of the user account has been changed by someone and it got reflected in our Active Directory as well so we want to know who has changed it.  Consider an example i.e. I am Anandh Alagarasan and my Firstname would be Anandh and Lastname would be Alagarasan. So recently someone has updated my Firstname to Venkat. So in Active Directory when we checked the account i could see that my account is reflecting as Venkat Alagarasan.  So we want to know who had changed the FirstName of the user. Hence we want to know will it be captured in Wineventlogs ? If yes, We want to find out who is the user who had changed the First name of the user account Anandh Alagarasan?   So kindly help to know how to pull the information using Search query.  

I've got a search head cluster with servers in two time zones.   Users are geolocated load balanced, but if one site's servers is unreachable, they are routed to the other site's servers.  I know users can set their timezone in preferences; however, I'm looking for a solution that would allow me to update their default timezone information in their user account through a query/rest api.

I am trying to set up an alert in Splunk that will email a user whenever their Windows session is X days old. It would be across multiple hosts/users and use the security event log to determine if there hasn't been a 4647 or 1074 event since their 4624 logon event.  Has anyone set up something similar? Thanks in advance!

Hello sir, i just installed the add on "Alien vault check OTX" in my splunk enterprise. i have integrated my api key, but when i use the command | checkotx <ip-add> it shows nothing there  is there any configuration missing, can you provide me documentation?? @larmesto kindly please update me.

I want to make a presentation in a dashboard where I can see a line per service with the duration of each call of that service.  I have made a table in splunk and would create a linechart wiht multiple lines (per service a line) with duration in y-as en time in x-as. How can i do that? Or is there another way to get that done? my search: index=test sourcetype=test-performance duration>0 | convert timeformat="%Y-%m-%dT%H:%M:%S%:z" ctime(_time) AS date | table date, metric, duration | sort by date some events from the table.  date                                                     metric        duration 2021-08-25T08:55:28+02:00 service1    93 2021-08-25T08:55:28+02:00 service1    4 2021-08-25T08:55:28+02:00 service3    3 2021-08-25T08:55:28+02:00 service4    1 2021-08-25T08:55:23+02:00 service5    84 2021-08-25T08:55:20+02:00 service5    88 2021-08-25T08:50:55+02:00 service1    91 2021-08-25T08:50:55+02:00 service1   18 2021-08-25T08:50:55+02:00 service3   14 2021-08-25T08:50:55+02:00 service6   2 2021-08-25T08:50:55+02:00 service7   4 2021-08-25T08:50:55+02:00 service4   5 2021-08-25T08:50:54+02:00 service8   46 2021-08-25T08:50:54+02:00 service9   43 2021-08-25T08:49:58+02:00 service1   88 2021-08-25T08:49:58+02:00 service1   17 2021-08-25T08:49:58+02:00 service3   16 2021-08-25T08:49:58+02:00 service10 10 2021-08-25T08:49:58+02:00 service11 10 2021-08-25T08:49:58+02:00 service6    2

Hi, We have a multisite cluster with 1 indexer on each site with 1 SH on primary site. Currently, when search affinity is enabled and we run a search for index "crowdstrike" , we can see past 30 days data. But when search affinity is disabled on the search head, the same search displays recent data and not the past 30 days. Question: Is there something missing configuration wise?