Your question would benefit from an added example to make it clearer. ... View more

So, something like: <base search here> | stats distinct_count(uri_path) as distinct_uri_count by src | where distinct_uri_count = 2 ? ... View more

So, did my answer help you? Personally, I would change the lookup to list companies and products separately with their relevant additional details, extract those from API_URL using field extract configurations or the rex command and then do the lookups. I don't know of a way to use wildcards and still force an exact match besides what I mentioned already. ... View more

You have a few options. You could move those to separate lookups and use the one relevant to your use case only, making it more flexible (vendors vs. products) You could simply drop the extra events you don't want in this particular case You could use max_matches in your lookup configuration to control how many lookup entries can match to supplied values in file-order. See https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration. I'm assuming here that "Product Details" and "Company Details" are placeholder for more detailed information in your example. ... View more

Not exactly what you are looking for, I know, but you could try to blacklist unwanted events instead and see if that works for you: blacklist = Type="(Information)" Alternatively, you could run a network trace to see if the level field is collected by the Splunk UF and in what form and then whitelist only that. I'll try to set that up in my lab and see what I get. ... View more

I assume you've configured the AWS Config service in both environment in the same way (recorder, etc...)? If so I would open a support ticket with us if not already done. ... View more

I don't have any in my test env. ... View more

I assume you could use the severity_id or severity field? If not, can you provide an example of your event data and how you'd like to filter them? ... View more

What's your current setup to pull Windows Log Events into Splunk at the moment? What do the events look like? ... View more

I assume you tried com.splunk.dbx2.DefaultDBX2JDBC ? ... View more

Assuming you are using Universal Forwarders on your Windows servers, you could use the blacklist facility in inputs.conf . For example the Splunk Add-on for Microsoft Windows comes with this blacklist by default for security log events: [WinEventLog://Security] disabled = 1 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" renderXml=false The reference documentation is here: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Event_Log_whitelist_and_blacklist_formats ... View more

Alternative suggestion, if I may: Splunk> All your silos are belong to us ... View more

Splunk> Big Brother 4 good ... View more

Splunk> I can has answers ... View more

Splunk> To the logs battlestation! ... View more

Splunk> Like having a Palantir ... View more

Splunk> The data Swiss Army Chainsaw ... View more

Splunk> The 42 of Operational Intelligence ... View more

Splunk> I see what you did there... ... View more

Splunk> More power to the indexers Scotty! ... View more

Splunk> I welcome our Big Data overlords. ... View more

I suggest you check the following Splunk answer: https://answers.splunk.com/answers/105292/what-is-the-cause-of-these-socket-errors-reported-in-splunkd-log-since-upgrading-to-6-0.html I'd then check your splunkd.log logs for anything mentioning a limit being hit or something that might help explain that behaviour (probably for the HTTPListener component). As a last resort, you might want to do a network trace (Wireshark, NetMon, etc...) with or without the help of your network team. That should help you see what is happening from the network side and might help direct where to look for the issue's root cause next. ... View more

As in "I would like to duplicate a subset of selected events data to another index on top of the current one"? I suggest you please clarify your question. ... View more

Indeed, this is where I was leading. 😉 ... View more

Sadly, I don't have a Splunk AWS environment to compare with anymore which make this a little harder, but here's a few questions: I assume you have the relevant saved searches enabled to generate the topology data? See https://docs.splunk.com/Documentation/AWS/latest/Installation/Savedsearches If you believe the issue is from the Splunk AWS application or add-on, you can and should open a ticket with Splunk (it doesn't sound like you believe so, however) Alternatively, if the issue appears to come from the AWS Config service (or account) configuration, you can hopefully open a ticket with AWS That being said, if you can provide data about your issue from both your environments (one works the other doesn't if I understand correctly), that would help us help you. ... View more