No worries 😉, I shared tested regex. upvote if that solves your problem. ... View more

Join command  works well If you apply it for two small datasets or two searches which produce results from stats/timechart/chart command. I see you are applying without using such commands, what will happen in this case there would be high number of events in both searches. Having high number of results in first search is perfectly fine, but the problem is with second search which is also called sub search. In this case join command only join first 50k results. Even search works fine, you will get partial results. for example, search 1 field header is, a,b,c,d search 2 field header is  d,e,f to get a,b,c,d,e,f using common field d. SPL would be: search 1 | join max=0 d type=left [search 2] The above search keeps all results from search1 and you will get e,f Only for  matching records. ... View more

Its looking like connection error only Based on the error you have posted. can you Check in internal what is the domain used for other logs ? Is that same us-api.mimiecast.com ... View more

worth watching below video if you are beginner in regular expressions. Regular expressions in Splunk  Can share _raw to give you correct regex? formatted json may have special characters which will not appear here. ... View more

Alright. Then you can replace first search in my previous answer with your new search and it should work. if it solves your problem, thumbs up is really appreciated😊 ... View more

Is Length of the string dynamic?    ... View more

I don’t really understand how you are getting sourcetype field from Your first search. I am giving you spl to join based on the results you posted. sourcetype field should be there in both search results. index="_internal" source="*metrics.log" per_index_thruput series=autoshell host=lelsplunkix* | eval GB=kb/(1024*1024) | timechart span=12h sum(GB) as GB by series | join type=left sourcetype  [| tstats count where (index=BlackPearl OR index=Tortuga OR index=Swashbuckler) by index, sourcetype | table sourcetype, index] ... View more

Are you managing these hosts using deployment server? if yes, you can make use of deployment sever logs. If you don’t see phonehome for last n minutes, you could create an alert. ... View more

/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py connectionpool.py might be throwing this warning. can you check connectionpool.py if its importing urllib3? if yes, add to this file. ... View more

It looks like, your connection is getting blocked by proxy. check in your proxy logs if you are behind any proxy. or you could check on your own laptop where everything is opened to see you are able to connect. ... View more

How about your field extraction? is that done at index time or search time? if it’s happening at search time, you could change your extractions. I see %a is %a before and after so the existing fields are not changed, only new fields are added. In my opinion it will work if can change field extraction. ... View more

Complete failover automation is impossible. but you can have workaround. Splunk manual start is required on secondary Splunk instance where Splunk_app_dbconnect will be idle. 1. open firewall rules from secondary instance  to all destinations from which you are collecting records from active instance. 2. Configure all inputs on secondary instance 3. don’t start splunk service 4. rsync db checkpoints available at $SPLUNK_HOME/var/lib/splunk/modinputs/splunk_app_dbconnect/* for every one minute from active to secondary instance 5. Configure to get an alert if  primary Instance Splunkd service is down. 6. You can have simple alert action which will be called by the alert. you have to test this before taking decisions. this is my idea only. Not tested really. ... View more

I have shared query for the values you posted. I tried before posting and its working  ... View more

can you provide csv lookup header. ... View more

may be some of your alerts are set to live for more number of days , thus Splunk can't delete the jobs. dispatch.ttl = <integer>[p] * Indicates the time to live (ttl), in seconds, for the artifacts of the scheduled search, if no actions are triggered. * If the integer is followed by the letter 'p', the ttl is calculated as a multiple of the execution period for the scheduled search. For example, if the search is scheduled to run hourly and ttl is set to 2p, the ttl of the artifacts is set to 2 hours. * If an action is triggered, the ttl is changed to the ttl for the action. If multiple actions are triggered, the action with the largest ttl is applied to the artifacts. To set the ttl for an action, refer to the alert_actions.conf.spec file. * For more information on the ttl for a search, see the limits.conf.spec file [search] stanza ttl setting. * Default: 2p, which is 2 times the period of the scheduled search   you can make use of below rest query to see if the setting is changed for any of your alerts:   | rest /services/saved/searches | search title="test alert" | table title dispatch.ttl   ... View more

index=yourindex rejected authentication | rex "\s(?<user>[\w\/]+)\.$" | stats count by user | where count > 5 ... View more

The regex you posted extracted nothing from the event posted. rex field=_raw "ERROR - (?<Error_Message>.+)" to explain your regex. field=_raw - indicates Splunk to look  in _raw field for extraction ERROR - (?<Error_Message>.+) The extraction "ERROR - (?<Error_Message>.+)" - first identify  ERROR - and value will be extracted after ERROR - till end of line  and the value will be kept in Error_Message field. Find below video useful Regular Expressions in Splunk  ... View more

| stats values(state) as State, values(severity) as Severity, values(tags) as "Tags", values(plugin.name) as "Plugin Name", values(plugin_publication_date) as "Plugin Publication Date", count by plugin_id | rename plugin_id as "Plugin ID", count as "Total Hosts" | eval Severity=lower(Severity) | sort num(Severity), -num("Total Hosts") | inputlookup Vulnerabilities append=t | stats values(*) by "Plugin ID" | outputlookup Vulnerabilities append=t   stats values(*) is just to give you an idea, you can change. upvote if my answer solves your problem ... View more

are you creating lookup from Splunk settings or lookup editor? ... View more

Default syslog port is 514 (udp/tcp). Your syslog server might be receiving events on port 514. you can test this if you are sure of any source sending logs to syslog server. for example you know that server A is sending logs to syslog server B. you can run tcpdump on server B to see on which port events are received. tcpdump syntax is as below: tcpdump -vvv -i “yourinterface ame” srcip   and look for messages, you would see ip:port of server A and ip:port of serverB.   ... View more

Based on warn one of your search member is in out of sync. The search member is trying to update search head captain about the change made on search member. Did you try initiating search member rolling restart? if not, try restarting your search head cluster. ... View more

| rex "(?<computer>W[A-Z0-9\d]+)" ... View more

Can you check below https://community.splunk.com/t5/Dashboards-Visualizations/No-option-to-Export-CSV-results-from-dashboard-UI-app-view/m-p/51787#M2633 ... View more

There is no such option available in sendemail.  I believe you are looking some custom HTML email notifications. Are you looking for something like this.  then some additional coding is required. ... View more