I have a csv file that that I am using for a lookup which has multiple values in a particular field. I am trying to do a lookup which matches any one of the field values. example: lookup table file - room,color livingroom,purple|green|yellow (the pipe symbol delineates the different values in the color field) Then my search - <base search>  | lookup paint_colors room OUTPUTNEW color | search color=purple | fields room,color | stats list by room My desired result would be to see livingroom in the results. Is it possible to search for any one value in a field with multiple values? Thanks in advance!    

Hi Splunkers, I have some HF configured to send data over SSL to one indexer; As I am about to configure a second indexer, I was wondering if it is possible to load-balance data from HF to: IDX1 over SSL IDX2 without SSL And have outputs.conf configured such as: [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = idx1:1234,idx2:5678   where 1234 is the SSL port, and 5678 the standard one, without SSL. and on indexer side, we would have for inputs.conf IDX1 [splunktcp-ssl://1234] connection_host = dns IDX2 [splunktcp://5678] connection_host = dns   Do you think this could work? Thanks !

We aren't supposed to see the same results from both sites. For a given event we should only see it coming from one site (whichever had the searchable copy). It almost appears that Splunk is giving a result from each site. What might be the issue here and how to resolve

Hello, I need some help where to look in order to diagnostic the issue I am facing. I am using v8.0.9 in a multisite search head cluster and indexer cluster. After more than 30 days of normal operation, the search heads are not parsing bluecoat logs. While I try the same search from the cluster master the parsing is done properly but from any of the search heads.... There has not done any change in the cluster but suddenly the parsing stopped working. Any ideas on where to focus my troubleshooting?

HI Team, I need to add my company email address to my SplunK profile. I want to update it with my professional email ID so that the new certifications I do through my company ID can be reflected in my own Profile along existing certifications.

Hi community I created an Addon based on the Addon Builder 3.01, in order to maintain this Addon, Splunk asked me to export the project and import it into the new version of Addon builder 4.0. I tried to export the project from the old Add-on builder but i cannot see my Add-on :   I can see it under « Other apps and add-ons section :   Any idea what's the problem and how can i open it from the Addon builder page to avoid creating the Addon from scratch using the new version of the addon builder.   Thanks

After the installation of IT Essential Works, I started to received the following alert   Received event for unconfigured/disabled/deleted index=firedalerts with source="source::fired_alerts" host="host::XXXXXXXXXX" sourcetype="sourcetype::stash". So far received events from 1 missing index(es).   I decided to created the index manually and after a day I saw a few events coming in and digging a bit I found out that they seem to come from the saved search called fired_alerts that is part of the App DA-ITSI-CP-unix-dashboards, which I don't have it enabled. (!). I only enabled the Exchange content. which query is   | rest /services/search/jobs | search [search index=_audit action=alert_fired | fields sid] | collect index=firedalerts   is this normal? why the index was not created automatically by ITSI?

how to get this two stats result in one query (earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv"))) | stats latest(first) as first latest(last) as last latest(index) as index by dev_id dq (this dq field is not present in ho_sum) | stats latest(first) as first_vu latest(last) as last_vu latest(index) as index_1 by dev_id sourcetype

Hi Splunker, I'm installed splunk database connect app 3.5.1 on splunk server as heavy forwader. I configured forwarding data to index=AAA but it always forward to index=main, i dont know why, someone help me plz. Thanks!      

Hi, How do I get APIs for measuring Units that is SVC(Splunk Virtual Compute Unit) and vCPU (Virtual CPU) in splunk? also need to find API for pricing plans (work load pricing, Entity Pricing and ingest pricing). Please guide me where can I get these APIs? Thanks

index="*" | stats count by clientip, productId | stats list(productId) AS productId list(count) AS count by clientip   I want to get information that has been released more than 10 times in an hour from the time the log was detected, not the current time standard in the command.

Hi  We would like to create a splunk alert for long running requests. If the request exceeds 5000ms then we should get an alert. Search Query : sourcetype="access:log" host=hostname* USERID "search" The out put that we get is: 8/20/21 12:07:07.000 AM 30.X.X.X 7x4697381x3 USERID[20/Aug/2021:00:07:07 -0400] "POST /rest/api/2/search HTTP/1.1" 200 63 243 "-" "APP.Api/10.98.3.17993 APP/10.98.3.17993 (Microsoft Windows NT 6.2.9200.0)" "1duei1d";52.14.54.126, 30.x.x.x, 30.x.x.x https-jsse-nio-8443-exec-142 host = hostnamesource = /access_log.2021-08-20sourcetype = access   Is there a way we can accomplish this?

Getting Following error after Installing & Configuring the Microsoft 365 Defender Add-on HF with Splunk version 8.0.6. Need suuport to fix this below error Error:- 08-20-2021 01:00:04.803 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" ERROR'access_token' 08-20-2021 01:00:04.766 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" KeyError: 'access_token' 08-20-2021 01:00:04.766 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" return response['access_token'] 08-20-2021 01:00:04.766 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" File "/opt/splunk/etc/apps/TA-MS_Defender/bin/azure_util/auth.py", line 18, in get_access_token 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" raise e 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" File "/opt/splunk/etc/apps/TA-MS_Defender/bin/azure_util/auth.py", line 21, in get_access_token 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" access_token = azauth.get_access_token(client_id, client_secret, authorization_server_url, resource, helper) 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" File "/opt/splunk/etc/apps/TA-MS_Defender/bin/input_module_microsoft_defender_atp_alerts.py", line 53, in collect_events 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" input_module.collect_events(self, ew) 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" File "/opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py", line 76, in collect_events 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" self.collect_events(ew) 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" File "/opt/splunk/etc/apps/TA-MS_Defender/bin/ta_ms_defender/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events 08-20-2021 01:00:04.765 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py" Traceback (most recent call last): ... 2 lines omitted ... File "/opt/splunk/etc/apps/TA-MS_Defender/bin/ta_ms_defender/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events ... 1 line omitted ... File "/opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_defender_atp_alerts.py", line 76, in collect_events ... 1 line omitted ... File "/opt/splunk/etc/apps/TA-MS_Defender/bin/input_module_microsoft_defender_atp_alerts.py", line 53, in collect_events ... 1 line omitted ... File "/opt/splunk/etc/apps/TA-MS_Defender/bin/azure_util/auth.py", line 21, in get_access_token ... 1 line omitted ... File "/opt/splunk/etc/apps/TA-MS_Defender/bin/azure_util/auth.py", line 18, in get_access_token Show all 13 lines 08-20-2021 01:00:04.302 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_365_defender_incidents.py" ERROR'access_token' 08-20-2021 01:00:04.263 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_365_defender_incidents.py" KeyError: 'access_token' 08-20-2021 01:00:04.263 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_365_defender_incidents.py" return response['access_token'] 08-20-2021 01:00:04.263 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_365_defender_incidents.py" File "/opt/splunk/etc/apps/TA-MS_Defender/bin/azure_util/auth.py", line 18, in get_access_token 08-20-2021 01:00:04.263 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_365_defender_incidents.py" raise e 08-20-2021 01:00:04.263 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-MS_Defender/bin/microsoft_365_defender_incidents.py" File "/opt/splunk/etc/apps/TA-MS_Defender/bin/azure_util/auth.py", line 21, in get_access_token