Can you try accessing endpoint using local admin account and see how events is generated then you can understand event behavior. ... View more

Can you share sourcetypes returned from the search? ... View more

Since you have mentioned 75 users and you need to allocate 1 cpu= 1 search for 1 user at any time.  having 75 cpus in box may cost you more. I would suggest you to have search head cluster to balance resources very effectively. search head cluster with 3 search members and one load balancer. each search member should have at least 24 cpus. The reason for taking more cpus, we are not sure how many concurrent searches are received by search members. there should not be any delay while serving to users. ... View more

Did you see 4672 events collected from endpoints? ... View more

Are you collecting logs from endpoints to see if  user is making login locally instead using his/her domain account. You need to have event logs from each endpoint to detect if they are login  locally using admin rights. 4672 is the event code. https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4672 or you could easily detect employees who are login using local admin account if you have Microsoft defender ATP installed on endpoints. ... View more

| eventstats count | mvexpand stages | rex field=stages “(?<key>[^,]+),(?<value>\d+)” | stats values(count) as count sum(value) as value by key | eval avg=value/count | table key avg Note: replace double quotes in rex command with double quotes from your keyboard. not tested also. ... View more

I think you got wget URL after choosing .deb file. First you click on .tar in downloads that will give you link for .tar which you can extract in your linux machine. ... View more

check if your DB team has any DB performance tools. With the help of DB performance tools they could check which query is taking more resources like CPU and memory. https://docs.oracle.com/en/cloud/paas/exadata-express-cloud/csdbp/use-sql-developer-monitor-database-performance-ee.html#GUID-992DA8CA-5950-4D3A-851E-89B506BEA8FC   ... View more

It’s not impossible as you don’t require to set admin password while installing. You can automate this one completely. I will share script soon. ... View more

Was it working before? if yes, did you remember making any changed to TA. can you set logging level to debug and share logs? ... View more

index=apache_core  userAgent!="nginx/*" source="*access.log*"  requestURI!="/web/app*" NOT (requestURI="/api/xyz/*"  OR requestURI="/api/yyy/*"  AND statusCode=404) earliest=-30m latest=now | bin _time span=10m | stats count(eval(statusCode>=400)) as errors, count as total by _time | eval ErrorRate = errors * 100 / total | fields ErrorRate _time | where ErrorRate > yourthreshhold ... View more

I have changed a lot this TA 1.5 years ago to make it work. I really need to look into it to understand where the problem is. please message me, I can look it into for you. ... View more

I don’t think there is visualizations to see complete flow of an event from source to destination. there could be many components involved from source to destination. lets say: universal forwarder(original data ) -> heavy forwarder -> indexer -> search head(result) ... View more

Can you Provide splunk enterprise version and Splunk db connect version and java version and os and os version. ... View more

Please up vote the answer. ... View more

Is it showing same format when you do |inputlookup yourlookupname | rename _time as testingtime can you let me know how is the format of testingtime field value.share one sample value of testingtime. I am trying to understand _time is recognized by Splunk or not.   ... View more

splunk offline is not recommended for two hours long.  you can enable maintenance-mode on cluster master. you can do below: stop the Splunk Indexer disable boot-start (if you need to do multiple restart during your maintenance, this will avoid starting of splunk service) once you are done with activity you can start splunk and enable boot-start. you can do same for other Indexer at the same time. once you are done with activity on both servers. You can enable maintenance-mode on cluster master. ... View more

Can you share one sample value of _time from your lookup file? ... View more

Check if you password has special characters that needs to be escaped in terminal. set passwd=yourpassword echo $passwd see the complete password is echoing or breaking some where. ... View more

The events look like very much structured and values are delimited with pipe symbol. you can use IFX(Interactive Field Extraction) to extract them very nicely. https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

can you specify index or sourcetype or source in append search? this will limit search to that particular index or sourcetype or source and performance will improve.  your sub search used in append : search routingKey=routingCLBT_Infrastructure_Operations # this will return only one routingKey | top limit=50 routingKey # you will only get one result with 3 headers routingKey count percent and percent is 100% here since you have applied filter already and routingKey has only one at the moment. | stats sum(count) as count, avg(percent) as percent # it has no effect | eval routingKey="CLBT" # creating field and assigning static value. I would suggest below search in append command: | append [search index=<specify_index> | stats count by routingKey | eventstats sum(count) as total | eval percent=round((count/total)*100,2) | search routingKey=routingCLBT_Infrastructure_Operations | eval routingKey="CLBT"] ... View more

provide more details to get answers. ... View more

Hi @Rdoggala  Please post your question as new. You question may not be answered if you post like this. and the subject is different and the one you asked is different. ... View more

the page what you have shared is from splunkweb only. if you are using corporate laptop, there could be connectivity issues since you are trying to connect the host and port unknown.     ... View more