All Topics

robertlynch2020 · ‎09-08-2022

In HTML - how do I get the text to be on the right side of the button? (The white text) I have the following, but I am trying to get the text to be on the right of the button. At the...

In HTML - how do I get the text to be on the right side of the button? (The white text) I have the following, but I am trying to get the text to be on the right of the button. At the moment I use label of a table to add my message, but ideally i would like it to be on the right side of the button <html rejects="$Config_path_token$"> <style>.btn-primary { margin: 5px 10px 5px 0; }</style> <a class="btn btn-primarys">Press to Download Congifuration File</a> </html> <table id="tbl1"> <title>Configuration File http://dell967srv.scz.murex.com:15022/public/mxres/common/launchermxmarketdataevaluation.mxres</title>

Bobmc · ‎09-08-2022

Hello, I'm a bit new to Splunk and I'm trying to run a query that shows me users in Active directory that are still enabled but haven't logged in for past 30 days. I've tried searching through varie...

Hello, I'm a bit new to Splunk and I'm trying to run a query that shows me users in Active directory that are still enabled but haven't logged in for past 30 days. I've tried searching through varies post but none seem to be exactly what I'm looking for. I may have overlooked it so If someone can point me in the right direction or provide a sample query to get me started I'd be very grateful. Thanks, Bob

bro_coded101 · ‎09-08-2022

My current search is: `index` | search source="Main Source" | fields identifier, status_label | chart count over identifier by status_label My output statistics for this search looks like t...

My current search is: `index` | search source="Main Source" | fields identifier, status_label | chart count over identifier by status_label My output statistics for this search looks like this Identifier | F1 | F2 | F3 | F4 | F5 ID_1 | 6 | 4 | 3 | 2 | 0 ID_2 | 0 | 3 | 7 | 9 | 4 I need to combine F1, F3, and F4 as Total_1 and F2 + F5 as Total_2 for each identifier. I only want my table to show Identifier, Total_1, and Total_2 Is this possible?

Harish_Patel · ‎09-08-2022

Hi team, I'm using a SAAS controller. I have so many duplicates users on my account management module, And I would find a way to detect the last status of them and to detect their activity logs. ...

Hi team, I'm using a SAAS controller. I have so many duplicates users on my account management module, And I would find a way to detect the last status of them and to detect their activity logs. I want to delete the duplicate users from my account management module. Is there any solutions for this I need this ASAP. Thanks you in advance and I am very grateful for your help. Comment title edited for clarity and searchability. Claudia Landivar, Community Manager

fhirata1 · ‎09-08-2022

Hello Guys. I use splunk cloud to monitor logs from Windows, Firewall, Office 365, etc. I recently got a message that splunk's license has expired, since then splunk has stopped receiving firewall ...

Hello Guys. I use splunk cloud to monitor logs from Windows, Firewall, Office 365, etc. I recently got a message that splunk's license has expired, since then splunk has stopped receiving firewall logs. I updated the license and renewed the credentials, but I still don't receive the logs. And some of the error messages appear: "The TCP output processor has paused the data flow." Could someone help me please?

majilan1 · ‎09-08-2022

I need to create a Splunk alert that will trigger when storage on /vi/vip_pdh/00d for a host reaches at least 90% capacity. index=A sourcetype=B /vi/vip_pdh OR /var/log earliest=-2h | eval Use...

I need to create a Splunk alert that will trigger when storage on /vi/vip_pdh/00d for a host reaches at least 90% capacity. index=A sourcetype=B /vi/vip_pdh OR /var/log earliest=-2h | eval UsePct=rtrim(UsePct,"%") | stats latest(UsePct) as UsePct by MountedOn host. Just a Slight correction, I want to monitor both /vi/vip_pdh and /var/log. Thanks!

KH · ‎09-08-2022

I'm extremely new to Splunk and finding learning SPL very frustrating. I'm trying to look for windows log on events/ attempted log ons by leavers accounts after their last working day. How do i say...

I'm extremely new to Splunk and finding learning SPL very frustrating. I'm trying to look for windows log on events/ attempted log ons by leavers accounts after their last working day. How do i say where a specific field (the last working day) is before todays date. The last working day field which I'm pulling from a separate index is in the following format "2020-02-28 00:00:00.0"

medtemo · ‎09-08-2022

Hello ALL, My deployment is UF ---->HF(local copy)----->indexer I would like to send logs from HF to indexer except some sourcetype, at the same time need to keep a local event copy of all forward...

Hello ALL, My deployment is UF ---->HF(local copy)----->indexer I would like to send logs from HF to indexer except some sourcetype, at the same time need to keep a local event copy of all forwarded logs from UF in HF. I have found a number of seemingly great answers and help pages for how to set this up with props.conf and transforms.conf but no luck. At what level do I need to change configuration HF or Indexer? please suggest how to achieve this. Thanks,

gitingua · ‎09-08-2022

Hello colleagues When running the command (/opt/splunk/bin/splunk reload deploy-server -class Class_Name -debug) There was no such error before. Literally today got out with what it can be connect...

Hello colleagues When running the command (/opt/splunk/bin/splunk reload deploy-server -class Class_Name -debug) There was no such error before. Literally today got out with what it can be connected? Will setenv SPLUNK_CLI_DEBUG to "v". In check_and_set_splunk_os_user(): In env found *no* SPLUNK_OS_USER var. WARNING (cli_common) btool returned something in stderr: 'Will exec (detach=no): USER=root USERNAME=root PATH=/opt/splunk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/opt/splunk/bin PWD=/opt/splunk/etc/deployment-apps HOSTNAME=splunk-deployer SPLUNK_HOME=/opt/splunk SPLUNK_DB=/opt/splunkDBcold/DBdefault SPLUNK_SERVER_NAME=Splunkd SPLUNK_WEB_NAME=splunkweb PYTHONPATH=/opt/splunk/lib/python2.7/site-packages NODE_PATH=/opt/splunk/lib/node_modules LD_LIBRARY_PATH=/opt/splunk/lib LDAPCONF=/opt/splunk/etc/openldap/ldap.conf /opt/splunk/bin/splunkd btool web list

Finn · ‎09-08-2022

I have encountered an issue with the foreach command on mv-fields. When I execute my search, Splunk says: "Error in 'eval' command: The expression is malformed. An unexpected character is reached at...

I have encountered an issue with the foreach command on mv-fields. When I execute my search, Splunk says: "Error in 'eval' command: The expression is malformed. An unexpected character is reached at '<<ITEM>>'. " SPL to reproduce: | makeresults | eval mvfield=mvappend("1", "2", "3"), total=0 | foreach mode=multivalue mvfield [eval total = total + <<ITEM>>] | table mvfield, total Note: this query is directly pulled from the examples for the foreach command. Note2: the argument "mode" is not syntax-highlighted (would expect green)

smanojkumar · ‎09-08-2022

What is the difference between now() and _time?

splunkmagu · ‎09-08-2022

Hello, we have a following integration in place: GuardDuty -> EventBridge (no transformation)-> Firehose (no transformation) -> Splunk (cloud) HEC sourcetype = aws:cloudwatch:guardduty HEC so...

Hello, we have a following integration in place: GuardDuty -> EventBridge (no transformation)-> Firehose (no transformation) -> Splunk (cloud) HEC sourcetype = aws:cloudwatch:guardduty HEC source override = aws_cloudwatchevents_guardduty Despite source override sometimes we see events with aws.guardduty source, and in those cases the message format is different (thus search outputs no results so we do not get an alert). Single source events start with: {"schemaVersion":"2.0","accountId":"<some_account>","region":"<aws_region>","partition":...} Double source events start with (additional header/metadata preceding schemaVersion): {"version":"0","id":"<some_id>","detail-type":"GuardDuty Finding","source":"aws.guardduty","account":"<some_account>","time":"2022-09-07T11:55:02Z","region":"<aws_region>","resources":[],"detail":{"schemaVersion":"2.0","accountId":"<some_account>","region":"<aws_region>","partition":...} AWS has been excluded as the source of the issue. Any ideas on how to have only one message format (Splunk Support ticket has also been submitted) ?

Tainted_Rajaion · ‎09-08-2022

Hello community, I'm trying to make a simple dashboard but I'm running into a problem with displaying dates. I'm using Splunk Enterprise version 8.2.3. In the data that I have to work, I made ...

Hello community, I'm trying to make a simple dashboard but I'm running into a problem with displaying dates. I'm using Splunk Enterprise version 8.2.3. In the data that I have to work, I made changes in my search to display the time in the correct time zone directly (+2 hour). My research looks like this (it is certainly perfectible but the subject is not there): Having obtained what I wanted in terms of display, I prepared a dashboard but when I do it with Dashboard Studio, the display of dates does not seem to take some of my modifications: However, by making the same request in a classic Dashboard, I no longer have the problem: Is there something specific to do for Dashboard Studio? Am I the only one having the problem? Best regards, Tainted Rajaion

smanojkumar · ‎09-08-2022

Start_Time=092659 Start_Date=20220908 My requirement is to find the job amount many jobs that runs longer than a day, the above 2 fields relates the job start date and time,

CybSec1 · ‎09-08-2022

Hello, I have logs like : samples={'xxxxxxx' : {'111' :{'222' :{'333'}}}}{'yyyyyyy'{'444'}}{'zzzzzzz'} I need to take all words to one field like ; my field : 'xxxxxxx','yyyyyyy','zzzzzzz'...

Hello, I have logs like : samples={'xxxxxxx' : {'111' :{'222' :{'333'}}}}{'yyyyyyy'{'444'}}{'zzzzzzz'} I need to take all words to one field like ; my field : 'xxxxxxx','yyyyyyy','zzzzzzz' Thank you,

hettervik · ‎09-08-2022

We're looking over our environment for potential safety flaws. One question that came up is whether an admin-user is available by default on Splunk Universal Forwarders (UF). I'm not thinking about t...

We're looking over our environment for potential safety flaws. One question that came up is whether an admin-user is available by default on Splunk Universal Forwarders (UF). I'm not thinking about the user the UF runs as on the OS, but an admin user on the application layer. Earlier Splunk Enterprise had a default admin password "changeme". Did this also apply for UFs? How can we make sure that there is no admin users on our UFs, or that if there is, that they have proper passwords?

Dharani · ‎09-07-2022

Hi, Below is the example for raw log: 20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/cu...

Hi, Below is the example for raw log: 20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/cust HTTP/1.1#0115ocilpapgap11.op.okobank.com 20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/cust/apis/info/015-000234567 HTTP/1.1#0115dummyvalue.com 20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/015-0000004847/cust/api HTTP/1.1#0115dummy value.com From the above raw logs I need to extract the below fields: /wapi/v3/gat/cust /wapi/v3/gat/cust/apis/info/015-000234567 wapi/v3/gat/015-0000004847/cust/api and it should be extracted and displayed in table/statistics like below format: /wmpapi/v3/gat/cust /wapi/v3/gat/cust/apis/info/{Id} wapi/v3/gat/{Id}/cust/api Basically in the fields , it should only take alphapets (including that v3) and we should replace digits to {Id} whereever it exist . Can someone help me on this. Thanks!

FGAnders · ‎09-07-2022

Hi, Is there any way to exclude any events that has more than one value of a field from end result. index=X status=1 | rex field=_raw Product\W.(?P<Product>\w*) | rex field=_raw english...

Hi, Is there any way to exclude any events that has more than one value of a field from end result. index=X status=1 | rex field=_raw Product\W.(?P<Product>\w*) | rex field=_raw englishName\W.\W(?P<englishName>\w*.*\w)\W | rex field=_raw name\W.\W(?P<name>\w*.*\w) | eval indexTime=_indextime | sort + indexTime | stats list(name) as Customer, list(transaction) as amount, list(Product) as Products, list(currency) as currency, list(englishName) as Item | fieldformat Time = strftime(Time, "%Y-%m-%d %H:%M:%S") | Data from Event name: "JohnA",selection=2,Product: "ABC",description=<null>,country='MT',selection=1,Product: "??",description=<null>,country='MT',selection=2,Product: "GOLD",description=<null>,country='MT', While Having other results where there is only one Product in the events. I would like to exclude any events where there is more than 1 Product. I do not want them in the result. I have tried to find out if there is an option to have rex max_match to only show the ones with max 1 result. Without any luck. Thank you in advanced,

BalaMandalapu24 · ‎09-07-2022

My UF configured with deployment server 8089 and with HF 9997 both are not connecting troubleshoot steps performed: 1. disabled iptables firewall 2. all servers in same subnet there is no n...

My UF configured with deployment server 8089 and with HF 9997 both are not connecting troubleshoot steps performed: 1. disabled iptables firewall 2. all servers in same subnet there is no network firewall issue i believe 3. configured outputs.conf under opt/Splunkforwarder/etc/system/local [root@gcpas-d-sial02 ~]# tail -f /opt/splunkforwarder/var/log/splunk/splunkd.log 09-08-2022 05:41:22.535 +0000 WARN TcpOutputProc [13177 parsing] - The TCP output processor has paused the data flow. Forwarding to host_dest=10.236.65.143 inside output group HF from host_src=gcpas-d-sial02 has been blocked for blocked_seconds=34900. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. 09-08-2022 05:41:28.180 +0000 INFO DC:DeploymentClient [13138 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 09-08-2022 05:41:28.180 +0000 INFO DC:PhonehomeThread [13138 PhonehomeThread] - Attempted handshake 2910 times. Will try to re-subscribe to handshake reply 09-08-2022 05:41:32.336 +0000 WARN AutoLoadBalancedConnectionStrategy [13178 TcpOutEloop] - Raw connection to ip=10.236.65.143:9997 timed out 09-08-2022 05:41:40.180 +0000 INFO DC:DeploymentClient [13138 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 09-08-2022 05:41:52.180 +0000 INFO DC:DeploymentClient [13138 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 09-08-2022 05:41:52.247 +0000 WARN AutoLoadBalancedConnectionStrategy [13178 TcpOutEloop] - Raw connection to ip=10.236.65.143:9997 timed out 09-08-2022 05:41:54.623 +0000 WARN HttpPubSubConnection [13137 HttpClientPollingThread_A4B05094-DB53-4495-B31D-853E566CE7E0] - Unable to parse message from PubSubSvr: 09-08-2022 05:41:54.623 +0000 INFO HttpPubSubConnection [13137 HttpClientPollingThread_A4B05094-DB53-4495-B31D-853E566CE7E0] - Could not obtain connection, will retry after=43.540 seconds. 09-08-2022 05:42:04.180 +0000 INFO DC:DeploymentClient [13138 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected ^X09-08-2022 05:42:12.104 +0000 WARN AutoLoadBalancedConnectionStrategy [13178 TcpOutEloop] - Raw connection to ip=10.236.65.143:9997 timed out

Vani_26 · ‎09-07-2022

Query: |tstats avg(PREFIX(prtime)) as avg(prtime) where index=xdf source=sdsf TERM(pght=eff) OR TERM(pght=dfrg) OR TERM(pght=iojb) by PREFIX(pght=) _time span=1m |rename pght= as Pght this que...

Query: |tstats avg(PREFIX(prtime)) as avg(prtime) where index=xdf source=sdsf TERM(pght=eff) OR TERM(pght=dfrg) OR TERM(pght=iojb) by PREFIX(pght=) _time span=1m |rename pght= as Pght this query is working fine and getting the results in below format: Pght _time avg(prtime) eff 2022-09-07 13:00:00 40.667889889 dfrg 2022-09-07 13:01:00 75.678 iojb 2022-09-07 13:02:00 54.765423 but i want the results in below format _time eff dfrg iojb 2022-09-07 13:00:00 40.667889889 75.678 80.87656 2022-09-07 13:01:00 34.879 64.897 66.8765 2022-09-07 13:02:00 67.989 89.09876 67.985 please let me know how to do this.

All Topics

All Topics

In HTML, how do I get the text to be on the right side of the button?

Can someone help with a sample search to find Stale Active Users in Active Directory?

How to combine counts within a search?

Are there user management logs I can use to determine duplicated users, sign-up process status, last login-in date and activity?

The TCP output processor has paused the data flow.

How to create a Splunk alert for when storage on host reaches 75%?

How to leave date (in a field) is before today?

How to forward specific event data from HF to indexer?

Help with error reload class

Issue with foreach in multivalue <<ITEM>> not recognized

What is the difference between now() and _time?

AWS Guardduty - Splunk Integration

What is the date display difference between Dashboard Studio and Classic Dashboard?

Time stamp

How to extract multiple values to same field?

Is an admin-user available by default on a Splunk Universal Forwarder (UF)?

How to replace digits in regex?

Is it possible to exclude any events with multi value fields and only table ones with single value?

Why is my UF not connecting to HF and DS?

Help with reformatting Splunk Search

All Topics

Are you a member of the Splunk Community?

All Topics