Hello All,
I am new to Splunk.
My Splunk index is already getting data from a Kafka source
index=k_index sourcetype=k_message The query result is something like
{Field1=abc,Fiel...
I am building a new Splunk environment, and due to the number of clients we have, we are building a simple distributed environment that consists of 1 Heavy Forwarder, universal forwarders all pointin...
Hello Splunkers, I've been in some weird requirement/situation, which is, we need to validate if events of particular source and sourcetype are getting forwarded by UF or not. For E...
So I have a macro that has a field variable that I want to use a wildcard and worse the field names tend to have dots. So a good field would be body.system.diskio.write.bytes and I tried u...
Do any of you use (or know of) any scripts that look at splunk configuration and point out errors, or otherwise allow for a framework to do some sanity checking? This is a fairly open question, and I...
...SSQL Driver:
The log:
2022-05-27 21:37:44.537 +0800 [dw-59 - GET /api/connections/mssql-test/status] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=validation...
I'm interested in suggestions on how to tackle this. I know how I would implement it in Python, but not really sure best practice for SOAR.
Let's say I have an Action called "Lookup Host" If it ...
lastOccurrence=2011/08/25 03:29:25|firstOccurrence=2011/08/25 01:44:11
My logs contain data similar to the notes above. I'm trying to write a query to see if there is any data where the lastOccur...