Hi All, Please help me with splunk query to find removed (Off-boarded) hosts & index in splunk ... View more

Hi All, I have 10 index.  But in1 index logs were not being indexed frequently. Restarting HF fixing this issue for few days. And again same issue persist. How to find root cause of this issue and fix this permanently. @isoutamo @saravanan90 @thambisetty @ITWhisperer @gcusello @bowesmana   @to4kawa    ... View more

Hi, Below is my splunk search query & Screenshot. I want eliminate TrustedLocation = "Zscaler Miami III" from my result. Please help me with splunk query. I tried but unable to acheive it. index=test "vendorInformation.provider"=IPC | eval Event_Date=mvindex('eventDateTime',0) | eval UPN=mvindex('userStates{}.userPrincipalName',0) | eval Logon_Location=mvindex('userStates{}.logonLocation',0) | eval Event_Title=mvindex('title',0) | eval Event_Severity=mvindex('severity',0) | eval AAD_Acct=mvindex('userStates{}.aadUserId',0) | eval LogonIP=mvindex('userStates{}.logonIp',0) | eval Investigate=+"https://portal.azure.com/#blade/Microsoft_AAD_IAM/RiskyUsersBlade/userId/".AAD_Acct | stats count by Event_Date, Event_Title, Event_Severity UPN Logon_Location LogonIP Investigate | lookup WeirMFAStatusLookup.csv userPrincipalName as UPN | lookup Lookup_EMPADInfo.csv userPrincipalName as UPN | lookup WeirSiteCode2IP.csv public_ip as LogonIP | lookup ZscalerIP CIDR_IP as LogonIP | lookup WeirTrustedIPs.csv TrustedIP as LogonIP | fillnull value="Unknown Site" site_code | eval AD_Location=st + ", " + c | fillnull value="OK" MFAStatus | eval TrustedLocation=if(isnull(TrustedLocation), ZLocation, TrustedLocation) | rename site_code as LogonSiteCode | table Event_Date, Event_Title, Event_Severity UPN LogonIP LogonSiteCode Logon_Location AD_Location TrustedLocation MFAStatus count Investigate | sort - Event_Date alexspunkshell_1-1608637515737.png @soutamo @ITWhisperer @gcusello @thambisetty @richgalloway @to4kawa    ... View more

I can able to create Service Now tickets from Splunk.  In the email alert i receive Affected computer, UPN, Event title ,File name. I want to capture same details in the service now ticket. But in service now tickets, i don't have any informations. Its blank with no info. Please help me how to pass this info from splunk. Do i want to do any changes in setting -> Field -> Workflow? What changes i want to do. Please help me  Email Alert alexspunkshell_0-1605108845428.png Received Service Now Ticket with no Info alexspunkshell_1-1605108886790.png Servic now alert setting alexspunkshell_2-1605108939477.png alexspunkshell_3-1605108979025.png   @isoutamo @ITWhisperer  @gcusello @thambisetty @bowesmana @DalJeanis      ... View more

Hi All, I installed splunk add on for service now and configuration and inputs were made. But i  am not receiving any logs in the console.  In the messages i see "Some configuration are missing in Splunk add-on for ServiceNow" Fix the configuration to resume data collection. But in add-on configuration everything is fine i believe. Please help here. alexspunkshell_0-1604051041365.png @isoutamo @thambisetty      ... View more

Please help me with splunk query to find below 2 things. 1. To find percent to events/logs utilized by differents Indexes. 2. To find percent to events /logs utilized by differents hosts. @isoutamo @thambisetty  ... View more