Hi guys. I'm assuming this would be through OAB. Any tips would be appreciated; both my Exchange administrator and I are at a loss how to do this. Thanks. ... View more

It is 2019 and there is still not a comprehensive Splunk Answer or Documentation on how to ingest XML. Can someone explain to me how to configure props to ingest <?xml version="1.0" encoding="utf-8"?> <ArrayOfUser xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <User> <Id>removed</Id> <Uuid>removed</Uuid> ... many more attributes at this same level ... <User> <User> <Id>removed</Id> <Uuid>removed</Uuid> ... many more attributes at this same level ... <User> ... View more

I have a dashboard that loadjobs a scheduled savedsearch. I needed to grant dashboard access to a new role, so I added permissions for that role both to the dashboard and to the savedsearch. But I got a Error in 'SearchOperator:loadjob': Permission denied. Cannot access artifacts of job_id message when I accessed the dashboard as that role. I forced the savedsearch to run again ahead of schedule and it fixed the error. Does changing permissions on a savedsearch really not affect permissions for the actual past jobs ran? Is there a way to do this without manually rerunning to force the permissions change? I confirmed that a reboot still does not propagate the new permissions down to the formerly ran jobs. ... View more

Hi, I have a requirement to implement Splunk Mobile. I opened up a support case because 98% of our dashboards were not working in Splunk Mobile and I was told that most features (JS, post-processing, etc.) were not currently supported. I asked if there was a way to manually (and painstakingly) convert a dashboard to a Splunk Mobile dashboard. That is, to recreate the dashboard with only features allowable in Splunk Mobile. Splunk responded by sending me a woefully inadequate list of supported features (https://docs.splunk.com/Documentation/Gateway/1.8.0/ReleaseNotes/VizSupport) that doesn't even begin to mention features like JS or post-processing or anything at a remotely granular level. Does anyone actually know what is and is not supported in Splunk Mobile? How can I go about creating a dashboard that I know will be compatible with Splunk Mobile? ... View more

A hat-wearing dinosaur and I tried to figure this out in usergroups without any luck. tl;dr moving this string exactly | table owner LastFirst OfficeName PersonType JobTitleGroup JobClassGroup JobTitle serial model lease_start lease_end ownership os carrier phone_number enrollment from the base search to the post-process search results in one line of data being duplicated and shown twice. Otherwise the data is presented normally. <search id="base"> <query> index=main sourcetype=snow:cmdb_ci_list dv_assigned_to!="" dv_assigned_to="*$network_id$*" earliest=-30d latest=now | sort 0 - _time | dedup dv_serial_number | eval serial=dv_serial_number | rex field=dv_assigned_to "\((?&lt;owner&gt;[^\)]+?)\)" | eval owner=lower(owner) | join type=left serial [search index=test source=us_bank_05-22-19.csv earliest=1 latest=now | eval model=device | eval lease_end=least_end] | where lease_start!="" | append [search index=test source=airwatch_10-18-19.csv "$network_id$" earliest=1 latest=now | rename "Serial Number" AS serial | rename "User Name" AS owner | eval owner=lower(owner) | rename "Device Model" AS model | eval ownership=if(Ownership="E","BYOD","MYCOMPANY") | rename "OS Version" AS os | rename "Current Carrier" AS carrier | rename "Phone Number" as phone_number | rename "Enrollment Date" AS enrollment | rename "Last Seen" AS last] | table owner LastFirst OfficeName PersonType JobTitleGroup JobClassGroup JobTitle serial model lease_start lease_end ownership os carrier phone_number enrollment </query> <search base="base"> <query> </query> <preview> <set token="search_count">$result._count$</set> </preview> </search> I am guessing this has something to do with the very annoying 7.2.0 bug where if you table the same field twice, it screws everything EDIT: The workaround here is to keep the table in the base and then use fields - in the post , but I would very much like to know why this happened for this particular search. I obviously table in post-process searches all the time. ... View more

Hi guys, For the Mimecast TA, we have configured all eight of the inputs the exact same way. Six are ingesting. TTP_Impersonation and TTP_Attachment are not. Does anyone have any insights on how I can get these two to ingest? App version is 3.1.3 running on Splunk 7.2.0, Linux ... View more