Emoji example: | makeresults | eval A="UP" | eval B="DOWN" | eval C="UNKNOWN" | eval D="N/A" | eval E="WARN" | eval F="UP" | fields - _time | replace UP with ✅ | replace DOWN with ⛔️ | replace UNKNOWN with ❔ | replace N/A with ❔ | replace WARN with ⚠️ ... View more

|tstats values(sourcetype) as sourcetypes, values(source) as sources where index=* by index ... View more

You could use a UF on another server as an intermediate forwarder. https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Configureanintermediateforwarder Another option is to use Windows Event Forwarding (WEF) to send the events to the second server, then have the UF on that server send them to the indexer. ... View more

If it is a single uriPath you are looking at, you can do this: index="<index>" sourcetype="<sourcetype>" URL="<uriPath>" | stats count by srcIP | search count>5 ... View more

You can use Serilog. https://github.com/serilog/serilog-sinks-splunk A Serilog sink that writes events to the Splunk. Supports .NET 4.5+, .NET Core, and platforms compatible with the .NET Platform Standard net45, netstandard1.1, netstandard2.0 ... View more

There is a MobileIron Cloud Splunk app. If you have access to MobileIron's support site, search for "Splunk Enterprise app for MobileIron Cloud User Guide". ... View more

You could possibly do something like this Jamf Graylog Integration using the Splunk Java Logging Appenders. Documentation Example Configs ... View more

IN should be in caps, and you should not need the "| search" in there. index="things" AND sourcetype="user_pixel" AND os="*" page IN ("Contact Us") | timechart span=3hr count by os limit=7 https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Search#Multiple_field-value_comparisons_with_the_IN_operator ... View more

##### Explanation for SEDCMD Extractions ##### ## windows_security_event_formater: This will replace all values like "Account Name:-" to "Account Name:" ##### SEDCMD Extractions ##### #SEDCMD-windows_security_event_formater = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g Source Add to props.conf, remove the # before SEDCMD-windows_security_event_formater. ... View more

It should not require html dashboards. After adding the dashboard.css to your app, you may need to restart Splunk or access https://<yoursplunk>/en-US/_bump and click the button. ... View more

You can change the color of this on all custom dashboards in an app by adding the following to the app's appserver/static/dashboard.css file: .splunk-header.splunk-view.splunk-header.splunk-view > div[data-view="views/shared/appbar/Master"] { background-color: #742255; } ... View more

It appears to be available here: https://github.com/thaumos/ansible-tower-splunk-framework ... View more

This works for me: <dashboard> <label>bug_repro</label> <row> <panel> <table> <search> <query>|makeresults | eval test="test"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">search?q=|makeresults | eval test="$row.test$"| rex field=test "(%3F<testxtract>.*)"&amp;earliest=$earliest$&amp;latest=$latest$</link> </drilldown> </table> </panel> </row> </dashboard> ... View more

You can use SECMD in props.conf on the indexer/heavy forwarder to remove some of the extra text in the logs. Here are some examples. https://answers.splunk.com/answers/44865/remove-out-section-of-log.html https://answers.splunk.com/answers/4752/disabling-or-removing-extra-description-text-in-windows-2008-event-logs.html https://gist.github.com/automine/5c8ef5b50e1df38249dfba01a70f2875 [WinEventLog:Security] #Returns most of the space savings XML would provide SEDCMD-clean0-null_sids = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(\:)(\s+NULL SID)$/\1/g s/(?m)(ID\:)(\s+0x0)$/\1/g SEDCMD-clean1-summary = s/This event is generated[\S\s\r\n]+$//g SEDCMD-clean2-cert_summary = s/Certificate information is only[\S\s\r\n]+$//g SEDCMD-clean3-blank_ipv6 = s/::ffff://g SEDCMD-clean4-token_elevation_summary = s/Token Elevation Type indicates[\S\s\r\n]+$//g SEDCMD-clean5-network_share_summary = s/(?ms)(A network share object was checked to see whether.*$)//g SEDCMD-clean6-authentication_summary = s/(?ms)(The computer attempted to validate the credentials.*$)//g SEDCMD-clean7-local_ipv6 = s/(?ms)(::1)//g # Removed due to issue with Windows Filtering Platform events # SEDCMD-clean8-firewall_summary = s/(?ms)(The Windows Filtering Platform has permitted.*$)//g ... View more

It looks like Bomgar has an integration: https://www.bomgar.com/docs/remote-support/how-to/integrations/splunk/index.htm There is also this: https://github.com/guilhemmarchand/bomgar-for-splunk ... View more