@sbutto here is my inputs in the script CHANGE THIS TO YOUR ACTUAL ARCHIVE DIRECTORY!!! ARCHIVE_DIR = "/splunk/index/splunk/archiveindex" ARCHIVE_DIR = os.path.join(os.getenv('SPLUNK_HOME'), 'frozenarchive') script_path = '/opt/splunk/etc/apps/Encrypt-upload-archived-Splunk-buckets-master/coldToFrozenPlusS3Uplaod.py' log_file_path = '/opt/splunk/etc/apps/Encrypt-upload-archived-Splunk-buckets-master/' gnu_home_dir = '' #where the gpg directory is. For example /home/s3/.gnupg/ gnu_home_dir = ' /home/splunkqa/ ' reciepient_email = '' #the email the gpg uses to encrypt the files reciepient_email = ' xyz@@@domain.com ' Enabling the logging system logger = applyLogging.get_module_logger(app_name='SplunkArchive',file_path=log_file_path) Finding out the epoch value at four month ago so we can copmare the bucket timestamp against it. FYI - my splunk was setup standalone indexr host splunk is installed under /opt/splunk my indexr is configured under /splunk/index ... View more

As of now its just stand alone splunk running on single instance indexer ... View more

Thanks for checkinh @Sbutto mine is native Linux running I have put your script under /opt/splunk/etc/apps/ I have configured in indexes. conf to run python path/opt/splunk/etc/apps/Encrypt-upload-archived-Splunk-buckets-master/coldToFrozenPlusS3Uplaod.py' Can you please help me on this im stuck ... View more

Here splunk answer https://answers.splunk.com/answers/373542/why-does-the-splunk-add-on-for-infoblox-not-always.html ... View more

Hey im beyond that source type level, InfoBlox have predefined 2 sourcetypes infoblox:dhs and DNS, DNS had issues flip when you getting response and request logs. ... View more

here is my error code 02-09-2019 13:51:36.711 -0500 ERROR BucketMover - coldToFrozenScript File "/opt/splunk/etc/apps/Encrypt-upload-archived-Splunk-buckets-master/coldToFrozenPlusS3Uplaod.py", line 150 02-09-2019 13:51:36.711 -0500 ERROR BucketMover - coldToFrozenScript sys.stderr.write("mkdir warning: Directory '" + ARCHIVE_DIR + "' already exists\n") 02-09-2019 13:51:36.711 -0500 ERROR BucketMover - coldToFrozenScript ^ 02-09-2019 13:51:36.711 -0500 ERROR BucketMover - coldToFrozenScript SyntaxError: invalid syntax 02-09-2019 13:51:36.715 -0500 ERROR BucketMover - coldToFrozenScript cmd='"/bin/python" "/opt/splunk/etc/apps/Encrypt-upload-archived-Splunk-buckets-master/coldToFrozenPlusS3Uplaod.py" /splunk/index/splunk/noindexdb/db/db_1543106304_1543105443_10' exited with non-zero status='exited with code 1 ... View more

Hey @sbutto im using your /coldToFrozenPlusS3Uplaod.py to upload to S3 but getting issues can any one help me here is the attributes i have added import sys, os, gzip, shutil, subprocess, random, gnupg import boto import datetime import time import tarfile applyLogging is a python script named applyLogging.py that exists at the same level of this script. If the file applyLogging.py doesn't exist where this file is located, the import statement will fail. sys.path.append(script_path) import applyLogging CHANGE THIS TO YOUR ACTUAL ARCHIVE DIRECTORY!!! ARCHIVE_DIR = "/splunk/index/splunk/archiveindex" ARCHIVE_DIR = os.path.join(os.getenv('SPLUNK_HOME'), 'frozenarchive') script_path = '/opt/splunk/etc/apps/Encrypt-upload-archived-Splunk-buckets-master/coldToFrozenPlusS3Uplaod.py' log_file_path = '/opt/splunk/var/log/splunk/' gnu_home_dir = '' #where the gpg directory is. For example /home/s3/.gnupg/ gnu_home_dir = /home/splunkq/.gnupg reciepient_email = '' #the email the gpg uses to encrypt the files reciepient_email = [email protected] Enabling the logging system logger = applyLogging.get_module_logger(app_name='SplunkArchive',file_path=log_file_path) Finding out the epoch value at four month ago so we can copmare the bucket timestamp against it. First we need to find today's epoch today=round(time.mktime(datetime.datetime.today().timetuple())) Substract 120 days one_month_earlier=today-120*86400 logger.info('Started on '+str(datetime.datetime.today())) Getting the hostname so we can prefix the uploaded file name with it to distinguish buckets from different indexes. hostname=os.uname()[1] S3 creds AWS_ACCESS_KEY_ID="xxxx" AWS_ACCESS_KEY_SECRET="xxxx" AWS_BUCKET_NAME="s3://zfu-splunk-pa/" Creating the gpg object gpg = gnupg.GPG(gnupghome=gnu_home_dir) ... View more

Can you please help me ... View more

Hi Sbuttio, Im using your script here is sample one getting issues import sys, os, gzip, shutil, subprocess, random, gnupg import boto import datetime import time import tarfile applyLogging is a python script named applyLogging.py that exists at the same level of this script. If the file applyLogging.py doesn't exist where this file is located, the import statement will fail. sys.path.append(script_path) import applyLogging CHANGE THIS TO YOUR ACTUAL ARCHIVE DIRECTORY!!! ARCHIVE_DIR = "/splunk/index/splunk/archiveindex" ARCHIVE_DIR = os.path.join(os.getenv('SPLUNK_HOME'), 'frozenarchive') script_path = '/opt/splunk/etc/apps/Encrypt-upload-archived-Splunk-buckets-master/coldToFrozenPlusS3Uplaod.py' log_file_path = '/opt/splunk/var/log/splunk/' gnu_home_dir = '' #where the gpg directory is. For example /home/s3/.gnupg/ gnu_home_dir = /home/splunkq/.gnupg reciepient_email = '' #the email the gpg uses to encrypt the files reciepient_email = [email protected] Enabling the logging system logger = applyLogging.get_module_logger(app_name='SplunkArchive',file_path=log_file_path) all are same ... View more

We have situation like we are getting events to splunk only query and request events source and destination info is mismatching when use the splunk_TA. we can make adjustment as custom fields but is there any work around any one found. ... View more

i found a document in Splunk website .. https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Configuremulti-clustersearch [clustering] mode = searchhead master_uri = clustermaster:east, clustermaster:west [clustermaster:east] master_uri=https://SplunkMaster01.example.com:8089 pass4SymmKey=someSecret [clustermaster:west] master_uri=https://SplunkMaster02.example.com:8089 pass4SymmKey=anotherSecret ... View more

I have tried below things in fields.conf but it did not worked [myfield] TOKENIZER = ([^|]+)|? OR [myfield ] TOKENIZER = ([^\x7c]+) [workstations] TOKENIZER = ([^\,]+)\,? ... View more

I have not tried but looks like this one also i need | makemv delim="|" name ... View more

Thank you mdsnmss ... View more

Thanks bud it worked .. ... View more

I have tried above one but it did not worked ..just thought of posting again ..when i run the search its working fine no issues . sourcetype=akamai:syslog |rex field=X_Akamai_Edgescape "country_code=(?P(.*?))," |rex field=X_Akamai_Edgescape "lat=(?P(.*?))," |rex field=X_Akamai_Edgescape "continent=(?P(.*?))," here is my code .. PROPS.CONF [akamai:syslog] REPORT-fields = country_code transforms.conf [country_code] SOURCE_KEY = X_Akamai_Edgescape REGEX ="country_code=(?P(.*?))," MV_ADD = TRUE ... View more

Thanks, but i was expecting some advanced kind of answer. Im aware of my field names all. ... View more

Thanks for the update, thats what i feel but just thought of double check ... View more