Key "search_name" or u'search_name' or param.name="$name$" is available in the json payload only for scheduled alerts. I am sorry 'user' doesn't exists in it but you can check if 'sid' or 'results_file' contain user name. ... View more

is the results link contains sid? Please post a sample URL. ... View more

Splunk does support nested json parsing.Please remove attribute TIME_FORMAT from your configurations and try. I am able to parse above json with below configurations. [google:gcp:pubsub:message] INDEXED_EXTRACTIONS = json KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false AUTO_KV_JSON = false TIMESTAMP_FIELDS = data.timestamp ... View more

Please check this link: https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector. It contains all the steps to create token for both Splunk Enterprise and Splunk cloud. ... View more

You can use below regex: | rex field=<FIELD_NAME> "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]" Test query: | makeresults | eval test="[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][[email protected]:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:[email protected]@hostname.com 0] API ID [34] execution started.&[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][[email protected]:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:[email protected]@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds." | makemv delim="&" test | mvexpand test | rex field=test "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]" | table id, name, test ... View more

Yes configuration you posted works. Also please set KV_MODE = none and AUTO_KV_JSON = false for this source/sourcetype on search head(s) to avoid multi values in fields. File: props.conf [google:gcp:pubsub:message] KV_MODE = none AUTO_KV_JSON = false ... View more

App setup is a non-Knowledge setting and Splunk hides this since cluster only replicates certain setting changes. Please note that if you make a change to a hidden setting, the changed configuration will exist only on the cluster member where you made the change. If you want other members to get that change as well, you must use the deployer to push the underlying configuration file for that setting. ... View more

Can you share the saved searches configurations? ... View more

You can try: index=WebFilter | lookup BadWords.csv BadWordsList as Web_BadWords OUTPUT BadWordsList | stats count by Web_username, Web_IP, Web_GoogleSearch, BadWordsList | sort -count ... View more

It is restart splunk service. No system/server reboot is required. ... View more

Check this: https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020. You need to replace existing datetime.xml with one provided in the link and restart splunk. ... View more

You can find answers here for all your questions here: https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020 ... View more

You don't need 3 separate monitors here, just create one and check with following configurations. inputs.conf [monitor:///opt/myAPP/.../*.log] host_segment = 3 index = route sourcetype = reroute_1 props.conf: [reroute_1] TRANSFORMS-index_routing = route_to_index TRANSFORMS-sourcetype_routing = route_to_sourcetype transforms.conf [route_to_index] SOURCE_KEY = MetaData:Host REGEX = host::(.*) DEST_KEY = _MetaData:Index FORMAT = indexname_$1 [route_to_sourcetype] SOURCE_KEY = MetaData:Host REGEX = host::(.*) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype_$1 ... View more

There will be no impact if you remove top stanza as bottom one contains 2 more attributes. Make sure that you are restarting splunk if you changing this on standalone indexer server. ... View more

Are you trying to index same data in multiple indexes? ... View more

You can run scripts or playbooks using custom alert actions. For more details check: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomAlertConvertScripted ... View more

Try index=myindex src_ip!="10.0.0.0/8" OR index=myindex NOT src_ip="10.0.0.0/8" . ... View more

You can try just using TIMESTAMP_FIELDS, ignore other attributes (TIME_PREFIX, TZ, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD). And also attribute KV_MODE is not required during indexed time field extractions. [sourcetype] INDEXED_EXTRACTIONS = json KV_MODE = none TIMESTAMP_FIELDS = created ... View more

Best thing is not to monitor the file itself. As per my understanding there is no interval control over file monitoring, it is only there for modular and scripted inputs. ... View more

You can use kvstore Rest API to get count of existing records and restrict data insertion if existing count is = 50000. https://localhost:8089/servicesNS/nobody/<app>/storage/collections/data/<collection_name>?fields=_key ... View more