Hi all, I would like to know if it is possible to deploy a single new app from the Deployer to a Search Head without losing all the apps already installed in the Search Head. Now the shcluster / apps directory is empty and I would like to know if I can just insert the new app and push it with the command "splunk apply shcluster-bundle" with some special arguments that allow me not to delete all the other apps. Thanks, Mauro 

We have AV logs that send the detection and the block separately. I'm trying to create a query where I can take each incident_id (which has a log with a block, and a log with a detection) and have the query verify that both of logs are there. So it would table like incident_id ifDetectionFound ifBlockFound. I can't seem to wrap my mind around how to have it search the logs again for a block. Right now I'm just indexing for action=block OR action=Detection, but it still requires me to compare incident_ids (which are quite long random bits of numbers)

I have the below search results that will consist of 2 different types of log formats or strings. Log 1:  "MESSAGE "(?<JSON>\{.*\})" and Log 2 : "Published Event for txn_id (?<tx_id>\w+)". Both of these formats or logs or messages will be present in the result of the below search_results. I want to filter only those logs with Log 1 format that has the same transactionid as the one in the other Log 2 format. I am trying to run the below query. However its giving zero results even though there are common transactionids between these 2 log formats. Is there any way to achieve this?    {search_results} | rex field=MESSAGE "(?<JSON>\{.*\})" | rex field=MESSAGE "Published Event for txn_id (?<tx_id>\w+)" | spath input=JSON | where transaction_id == tx_id  

Facing issues ingesting required  certificates data using certificate transparency addon. Add-on used : https://splunkbase.splunk.com/app/4006/#/overview Version: 1.3.1 We have added inputs where we see that our certificate logs would be there but it seems the addon is not capturing all the logs from that input. We do not see any errors as well.    Query that we are using to check for our company related certificates is : index=certificate sourcetype=ct:log LogEntryType=0 LeafCertificate.x509_extensions.subjectAltName{}=*company_domain_name* | dedup LeafCertificate.serial | table LeafCertificate.x509_extensions.subjectAltName{}, LeafCertificate.validity.notbefore, LeafCertificate.validity.notafter source| rename LeafCertificate.x509_extensions.subjectAltName{} as LeafCertificate_Name LeafCertificate.validity.notbefore as Valid_From LeafCertificate.validity.notafter as Valid_Till source as Source    

Hello, I have to index a log file in linux server in to one index but need to have two different sourcetype. Is it possible?? I tried but when compare  index = audit_idx sourcetype = linux_audit and index =audit_idx sourcetype = linux_audit_mll , results are not same there are few logs missing in each. Want to know why its happening. Thanks in advance..  

Hello, i'm currently ingesting XML and non-xml windows event logs, i wanna know the impact if i disable the render xml in my UF, i wanna know also if i'am getting duplicated raw event if im rendering xml data (non-xml and xml are being ingested together ? ) if the answer is yes and if i disable the xml format do i get some data loss ? (because i get some event id that being ingested only in xml format).      

Hi Community, I need support to know how I can get the non-existent values from the two fields obtained from the "appendcols" command output. Example of Splunk output in table format below: 1st_Field  2nd_Field 1111          2222 empty        3333 empty         1111 I am able to get 1111 after using the lookup command but I want to get 2222 and 3333 only as those are not present in 1st Field.

Hi Team,   One of the important dashboard has been deleted by an user in our Search Head and our SH  is hosted in Cloud and managed by Splunk Support. So is there any possibility to restore the deleted dashboard in the Search head.         

Hello, When the cs_uri field is not present in the log, the url field is evaluated from cs_uri_scheme, cs_host, cs_uri_path  and cs_uri_query.  But it does not take in account the cs_uri_port in case the url use a non standard port. For instance, if the real URL is http://somesite:8080/foo/bar, the TA will compute the url field as http://somesite/foo/bar. To solve this for the most common protocols (http, https with and w/o interception, ftp & rtsp), the line  EVAL-url = coalesce(cs_uri, if(isnull(cs_uri_scheme) OR (cs_uri_scheme=="-"), "", cs_uri_scheme+"://") + cs_host + cs_uri_path + if(isnull(cs_uri_query) OR (cs_uri_query == "-"), "", cs_uri_query)) should be replaced by  EVAL-url = coalesce(cs_uri, if(isnull(cs_uri_scheme) OR (cs_uri_scheme=="-"), "", cs_uri_scheme+"://") + cs_host + if((cs_uri_scheme=="http" AND cs_uri_port!=80) OR (cs_uri_scheme IN ("https","ssl") AND cs_uri_port!=443) OR (cs_uri_scheme="tcp" AND cs_method="CONNECT" AND cs_uri_port!="443") OR (cs_uri_scheme="ftp" AND cs_uri_port!=21) OR (cs_uri_scheme=="rtsp" AND cs_uri_port!=554),":".cs_uri_port,"") + cs_uri_path + if(isnull(cs_uri_query) OR (cs_uri_query == "-"), "", cs_uri_query))

Hi, I need to increase the size of text box filters in my dashboard studio? I need to be able to increase size of all or select textbox filter. I can't find articles about dashboard studio. Can someone assist pls? Thanks!

Hi, Since the Splunk cloud upgrade to 9.0.2208.1, we have noticed that our monitoring dashboards now have 90 second gaps on some of the search panels. Previously we would see a constant feed of data without gaps. Now we are experiencing intermittent lines with 90 second time gaps. we have tried tweaking the data model summarization period from the original 2 minutes to a large period and also a shorter 1 minute period. However, this does not prevent the 90 second gap in monitoring. Any suggestions on how to rectify this would be really appreciated. Thanks  

I have an issue where the logs aren't ingested regularly. The log file updates every 5 minutes with the same line entries, and will roll over to a new file end of day. -rw-r--r--+ 1 novlua novlua 160416 Sep 18 23:55 iga_check_2022-09-18.log -rw-r--r--+ 1 novlua novlua 197664 Sep 19 23:55 iga_check_2022-09-19.log -rw-r--r--+ 1 novlua novlua 241056 Sep 20 23:55 iga_check_2022-09-20.log -rw-r--r--+ 1 novlua novlua 241056 Sep 21 23:55 iga_check_2022-09-21.log -rw-r--r--+ 1 novlua novlua 241056 Sep 22 23:55 iga_check_2022-09-22.log -rw-r--r--+ 1 novlua novlua 271783 Sep 23 23:55 iga_check_2022-09-23.log -rw-r--r--+ 1 novlua novlua 326880 Sep 24 23:55 iga_check_2022-09-24.log -rw-r--r--+ 1 novlua novlua 326880 Sep 25 23:55 iga_check_2022-09-25.log -rw-r--r--+ 1 novlua novlua 124783 Sep 26 09:06 iga_check_2022-09-26a.log -rw-r--r--+ 1 novlua novlua 271376 Sep 26 23:55 iga_check_2022-09-26.log -rw-r--r--+ 1 novlua novlua 248613 Sep 27 23:55 iga_check_2022-09-27.log -rw-r--r--+ 1 novlua novlua 97092 Sep 28 09:35 iga_check_2022-09-28.log Log file entries example: 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/changeset_*.* 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/queue/*.csv 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/work/*.csv 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/completed/*.csv 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/isimprod/changeset_*.* 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/isimprod/queue/*.csv 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/isimprod/completed/*.csv 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/sanbussroles/changeset_*.* 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/sanbussroles/queue/*.csv 09:35:02 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/sanbussroles/completed/*.csv 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/changeset_*.* 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/queue/*.csv 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/work/*.csv 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/mudad/completed/*.csv 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/isimprod/changeset_*.* 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/isimprod/queue/*.csv 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/isimprod/completed/*.csv 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/sanbussroles/changeset_*.* 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/sanbussroles/queue/*.csv 09:40:01 Processing: /opt/netiq/idm/apps/tomcat/fulfillment/sanbussroles/completed/*.csv I noted when requesting a forced entry, it gets picked up. inputs.conf [monitor:///opt/netiq/idm/apps/tomcat/fulfillment/logs/*.log] # blacklist = (\.gz) whitelist = \.log$|\.txt$ # crcSalt = <SOURCE> # disabled = false index = IG_RequestLog sourcetype = IG:RequestLogCheck time_before_close = 10