All Topics

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Topics

  Hi, I have a situation where I have to exclude certain records from the final result only. I don't want to include in the initial search criteria because it excludes the whole event. For example  ... See more...
  Hi, I have a situation where I have to exclude certain records from the final result only. I don't want to include in the initial search criteria because it excludes the whole event. For example  a single event may contain many tables and if I exclude a certain table  in my initial search I'm getting a wrong count of other tables . I just want those table removed from my final results. Thanks
Hi, Some of my data has 1000+ fields and I want to increase indexed_kv_limit value to 2000 from limits.conf . I know it's a big increase since the default value is only 200. I want to know how this... See more...
Hi, Some of my data has 1000+ fields and I want to increase indexed_kv_limit value to 2000 from limits.conf . I know it's a big increase since the default value is only 200. I want to know how this activity can impact my indexing or search performance? Thanks!
We're running v8.0.7.  We ingest syslog data through a cluster of servers running rsyslog and UFs.  I'm looking to install v2.6.2 of the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.co... See more...
We're running v8.0.7.  We ingest syslog data through a cluster of servers running rsyslog and UFs.  I'm looking to install v2.6.2 of the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467/). Does anyone know if this TA requires the use of the Splunk Connect for Syslog app or can we use rsyslog (or syslog-ng) to accept syslog traffic? Thanks!  
Hello All!  I'm just starting with Phantom and having a hard time creating "reusable code".  To give an example, I have a sequence of 3 actions which will be commonly seen in my playbooks: 1. Format... See more...
Hello All!  I'm just starting with Phantom and having a hard time creating "reusable code".  To give an example, I have a sequence of 3 actions which will be commonly seen in my playbooks: 1. Format a splunk query 2. Run the splunk query 3. Format the output to fit my needs based on an input parameter Since these same 3 steps are commonly seen in playbooks, it would make sense to put them into some reusable format.  My first thought was to take the code for these 3 actions and put it in a custom function, but they don't allow calls to phantom.act, so that doesn't work.  My second thought was a playbook, which could be used as a sub-playbook.  However, sub-playbooks don't have inputs/outputs, so that's not a good option.  If I did go the sub-playbook route, I could use something like "save_object", but that still requires me to do almost as much work within my playbook to give input to and get output of my "sub-playbook", which defeats the purpose.  Did anyone else struggle with this?  Is there something I'm missing that could help me with this use case?
Hello, I've created adaptive response action with Add-on builder 3.0.1. It creates a ticket in ticketing system.  Splunk enterprise security 6.2.0 is running in a cluster. Indexers are also cluster... See more...
Hello, I've created adaptive response action with Add-on builder 3.0.1. It creates a ticket in ticketing system.  Splunk enterprise security 6.2.0 is running in a cluster. Indexers are also clustered, multi-site. Splunk is 8.0.6. When action is triggered from saved alert, it works perfectly. When running ad hoc action from Incident review page the script gets executed twice and creates two same tickets. There is a 5 seconds difference between two actions. Why would it be executed twice? Goran  
I've followed the steps here - https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Admin/WindowsGDI And have set up a deployment server and deployed the universal forwarder onto a windows ser... See more...
I've followed the steps here - https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Admin/WindowsGDI And have set up a deployment server and deployed the universal forwarder onto a windows server to collect application/security logs. This server has checked in and I can see it got my 'outputs' and 'windows server' server classes installed. On Splunk Cloud, I can find my deployment server, lets call it 'datacollector' and see it pushing data into the _internal index but that's it. I can't find my windows server as a host and the only thing tht is returned with the following search index=_internal host!= "*.splunkcloud.com" is my datacolelctor server.  Is that right? Should I be able to see my windows server listed as a host too? I can't find any logs associated to the windows server, only those from the DS.  I've checked and re-checked my steps from that guide and everything is as expected to my knowledge. Thanks
Howdy Trying to figure out a problem. We're using collectd on a Centos el7 box using the default configuration for the cpu plugin. Metrics are making it into Splunk with no problems. When looking at... See more...
Howdy Trying to figure out a problem. We're using collectd on a Centos el7 box using the default configuration for the cpu plugin. Metrics are making it into Splunk with no problems. When looking at an entity, it shows no data on the graphs. Looking at the query for cpu, I see the fields like cpu.system and cpu.user. Looking at the metrics, I see cpu.system.value and cpu.user.value. Changing the query to use those fields with .value generates results and pretty graphs. Splunk docs specifically mention support collectd so I must be missing something? Do I need to further tweak collectd conf? Or do I need to tweak all the queries to use <metrics name>.value? Thanks!
I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday For example.  _time Count 2020-11-28 164 ... See more...
I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday For example.  _time Count 2020-11-28 164 2020-12-05 488 2020-12-12 516 2020-12-26 5755 2021-01-02 482 2021-01-09 450 2021-01-16 1274 2021-01-23 33684   Expected Output is : With two weeks time span I want to display the counts as below   Four weeks before  (164+488+516+5755) Two weeks before  (450+482) Latest two weeks    34958  ( which is count of 2021-01-16 and 2021-01-23  1274 + 33684)  
We are moving to a new storage array for our frozen data. Our old array is setup where our indexers have separate nfs mounts for the frozen data. Would there be an issue of having 5 indexers pointing... See more...
We are moving to a new storage array for our frozen data. Our old array is setup where our indexers have separate nfs mounts for the frozen data. Would there be an issue of having 5 indexers pointing to separate folders on one NFS mount or would it be best for each indexer to have separate NFS mounts for their frozen storage?
Hello Team, I have an application which produces traces and metrics. I wish to send traces and metrics to AppDynamics for testing.  I have following questions -  1) What APIs I can use to ingest t... See more...
Hello Team, I have an application which produces traces and metrics. I wish to send traces and metrics to AppDynamics for testing.  I have following questions -  1) What APIs I can use to ingest traces/metrics to AppDynamics? Please point me to the exact documentation and examples if any. I dont want to use AppDynamics agent for scraping. 2) Does AppDynamics support Opentelemetry collector?  I could not locate any documentation. I found AppDynamics exporter here "https://github.com/Appdynamics/opentelemetry-collector-contrib" . However I dont know if it is ready for prime time. The last commit was done 5 months back.  thanks, Machhindra
Hi everyone,  I have a problem with identifying if a point is within a polygon or not. For the same latitude and longitude, sometimes I get right results, but sometimes not. I get wrong results if ... See more...
Hi everyone,  I have a problem with identifying if a point is within a polygon or not. For the same latitude and longitude, sometimes I get right results, but sometimes not. I get wrong results if I search for more IDs (so there are more events) or I change the time range (not necessarily bigger). The line which causes the issue: | lookup some_lookup_name latitude longitude right results wrong results Thanks in advance  
Hello members,   Can you help me out to find out , what will be exact timeformat for this time below and timeprefix as well.  [2021-01-29T08:05:10-05:00]   Thanks in advance.
Hello all, if anybody had luck running a blocking search using the C# SDK, would appreciate your help. I am trying to run a blocking search from a C# application. This is my code: ServicePoi... See more...
Hello all, if anybody had luck running a blocking search using the C# SDK, would appreciate your help. I am trying to run a blocking search from a C# application. This is my code: ServicePointManager.ServerCertificateValidationCallback = delegate { return true; }; var service = new Service(new Uri("mySplunkURL:8089")); await service.LogOnAsync("username", "password"); SearchResultStream searchResultStream; Job job; job = await service.Jobs.CreateAsync( "search index=_internal | head 10" ,new JobArgs() { ExecutionMode = ExecutionMode.Blocking }); At this point, I get an error that says JobArgs does not contain a definition for 'ExecutionMode'  I am following the documentation on the Splunk site, and doing exactly same  https://dev.splunk.com/enterprise/docs/devtools/csharp/sdk-csharp/howdoicsharp2x/howtorunsearches I don't know what am I missing here? Any help is greatly appreciated !!  Vinay
Hi All, I have field called stepName which will have below three values. TextResource.getFirstLine TextResource.getSecondLine TextResource.getLastLine How can write a rex with mode=sed to replac... See more...
Hi All, I have field called stepName which will have below three values. TextResource.getFirstLine TextResource.getSecondLine TextResource.getLastLine How can write a rex with mode=sed to replace only the words First,Second and Last from the stepName field to "Which", so that my output will have only one stepName field value as "TextResource.getWhichLine".  
I want to collect chrome browser logs, for example history how can I configure it via Splunk?
I followed this article https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Advancedsourcetypeoverrides basically I took sourcetype ABC and am doing some regex and searching for 123, if I find t... See more...
I followed this article https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Advancedsourcetypeoverrides basically I took sourcetype ABC and am doing some regex and searching for 123, if I find that in the event I change the sourcetype to ABC:123. Now for this new sourcetype there is some wonky event breaking. Can I then create a new props entry [ABC:123] and perform all my line breaking and time extracting like I would for any normal event? As of right now it doesn't seem to be working.  I have:     2021-01-26 00:00:44.2885 [INFO] [NT AUTHORITY\SYSTEM] SIXPACService.SplunkForwarder.SplunkWriter Attempting to Splunk Message from SITA: <?xml version="1.0" encoding="utf-8"?> <DCNSMessage>   and with the following props for testing: [ABC:123] LINE_BREAKER = SIXPACService.(.*)   and nothing happened when I tried that props. any ideas?
Hi Everyone,    How can I create a multipage dashboard with a clickable card like layout. Please look at the images below for a clearer idea Page 1: On loading the dashboard the user gets this pa... See more...
Hi Everyone,    How can I create a multipage dashboard with a clickable card like layout. Please look at the images below for a clearer idea Page 1: On loading the dashboard the user gets this page: Page 2: Next, depending on what the user clicks, either car or buses, they get the following page Page 3: Finally on clicking the model a table is loaded with data   One way I can do this is by using the single value visualization to generate the cards and then making four different dashboards and then connect them to each other via the url option in the drilldown of the single value drilldown. Is there a better way to do this ?   Thanks.
Good morning fellow Splunkers, This might be a bit more of a Barracuda WAF question than a Splunk question but perhaps someone on here has overcome it already. We're writing our Barracuda Access Lo... See more...
Good morning fellow Splunkers, This might be a bit more of a Barracuda WAF question than a Splunk question but perhaps someone on here has overcome it already. We're writing our Barracuda Access Logs into Splunk and noticed that the query string is coming through truncated. In the context of the WAF passing request through to appropriate location and functioning correctly that's absolutely fine. The writing to access log and in turn into Splunk is where we observe the truncation. Any thoughts or ideas here?  We use a custom format string to submit to Splunk as follows: %t %un %lt %ai %ap %ci %cp %id %cu %m %p %h %v %s %bs %br %rtf %pmf %pf %wmf %u %px %pp %tt %uid %q %r %c Appreciate all tips/help here. Instructions are found in the waf_export_logs.pdf and query string is specified by %q above. See attached pics below.
Hi all,    I have install splunk forwarder in 1 centos device, sending to indexer.  From the search head, i can see data from this host but the the index is put as Main.  On the app, we have alre... See more...
Hi all,    I have install splunk forwarder in 1 centos device, sending to indexer.  From the search head, i can see data from this host but the the index is put as Main.  On the app, we have already specify to another index and we verified that the index is created.  Anybody know what am i missing? Already restart splunk services for both host and searchhead.   
Hi All, I have 2 different searches for a dashboard. i want to run one search when the time range is Last seven days and the 2nd search when the time is any other value. Any leads would be appreci... See more...
Hi All, I have 2 different searches for a dashboard. i want to run one search when the time range is Last seven days and the 2nd search when the time is any other value. Any leads would be appreciated. thanks in advance.