index IN (wineventappsys_*) EventCode=7036 host IN (ABC,DEF,GHI) | stats count by _time,Message, host,EventCode, SourceName, LogName | fields - count | rex field="Message" "The\s+(?<service>.+)\s+service\s+entered\s+the\s+(?<state>\w+)\s+state" | eventstats latest(_time) as latest_time by service, host | where _time=latest_time | fields - latest_time | search state=stopped | lookup service_list Message OUTPUT Short_Description Severity | eval State="OPEN" | sort - host Date ShortDescription   if you are okay with latest service state to be running or closed, you can remove search state=stopped. there could be latest service state running also for some services. if you remove search state=stopped then you need to add your old eval    | eval State =if(match(Message,"running state"),"CLOSED","OPEN")     ... View more

index IN (wineventappsys_*) EventCode=7036 host IN (ABC,DEF,GHI) | stats count by _time,Message, host,EventCode, SourceName, LogName | fields - count | rex field="Message" "The\s+(?<service>.+)\s+service\s+entered\s+the\s+(?<state>\w+)\s+state" | eventstats latest(_time) as latest_time by service, host | where _time=latest_time | fields - latest_time | search state=stopped | lookup service_list Message OUTPUT Short_Description Severity | eval State="OPEN" | sort - host Date ShortDescription ... View more

In simple words: event types are more related to your data/events.  for example: there could be many types of events in your single source type, windows failed authentications, windows successful authentications. There could be another source which will also give same types of events but different format like application authentication failed logs and application successful logs. you can create 4 event types to easily understand context of your data. event types are created to give context of your data. tags are more related to event types. for example: you can call all those 4 event types authentication logs. tags are not specific to single source events/data. tags are created to give context of your event types. hope this will make sense 🙂   ... View more

can you try adding credentials & inputs using CLI and restart or debug/refresh? ... View more

try below index IN (wineventappsys_*) EventCode=7036 host IN (ABC,DEF,GHI) | stats latest(Message) as Message latest(_time) as Date by host, EventCode, SourceName, LogName | lookup service_list Message OUTPUT Short_Description Severity | eval State =if(match(Message,"running state"),"CLOSED","OPEN") | sort - host Date ShortDescription   like answer if it solves your problem.   ... View more

@niketn  even by clause is not required. 🙂 | makeresults | eval _raw="Title,Duration T1,2 T2,5 T3,1 T2,6 T4,12" | multikv forceheader=1 | table Title,Duration | streamstats count as padSpace | eval Title=replace(mvjoin(mvrange(1,padSpace+1,1)," "),"\d","")."".Title | fields - padSpace | transpose 0 header_field=Title column_name=Title ... View more

@niketn  may be you can remove sort to give expected result. ... View more

can you provide inputs.conf. ... View more

Can you check resources are dedicated in vcenter? because if resources cpu and memory are not dedicated you might be seeing that error. ... View more

Are they VMs or physical boxes? ... View more

index=_internal | timechart count by sourcetype choose visualization as you like. ... View more

if you are using lookup command look at splunk lookup property that lookup should have 2 fields at least to be qualified as lookup. https://youtu.be/E3-JaZEIXPw add a new column let’s say flag and have value yes for all rows. index=test dst_ip=* OR src_ip=* | lookup blacklist.csv src_ip as ip OUTPUT flag as foundIp | where isnotnull(foundIp) ... View more

You can add ciphersuite and sslversion manually. whats your idea behind it?  what would you like to enable if you disable ssl3? would you like to enable tls? first you mentioned your Vulnerability scan found sslv3 is enabled on 8090. again you mentioned end of your question that you would like to disable on 443?     ... View more

App was developed in year 2014. Splunk 8 uses python 3. There could be version compatibility issues. ... View more

If you think you have security problems while opening port to another domain. You can request deployment server license from Splunk support. ... View more

Of course, yes. Otherwise you will loose web authentication and deployment server functionality after your Splunk Enterprise trail is over. ... View more

set default value * for all your text boxes. That should solve your problem. ... View more

The error you have seen in curl output will be suppressed if you use -k option. ... View more

You should check the connectivity from indexer to licence master from your indexer: telnet yourlicensemaster 8089 ... View more

What credentials are you talking about? are you making use of alert actions to manage your firewall from splunk TA? ... View more

what is your splunk enterprise version ? https://community.splunk.com/t5/All-Apps-and-Add-ons/Palo-Alto-Networks-Add-on-6-3-1-upgrade-on-Splunk-7-3-5-index/m-p/516585#M63209 ... View more

yes, inner search takes time range from time range you chosen in time range picker.  for example , if you choose last 90 days, inner search earliest time would be 90days-300seconds and latest time would now()+60 seconds. I read your question properly understand that you want to pass different times based on your inner search results. is that right ? ... View more

Sample event please  ... View more