Steps are, essentially: Download the Heavy Forwarder Install, ./splunk enable boot-start Configure the HWF to receive data Configure the HWF to send data to indexer ( ./splunk add forward-server customer.splunkcloud.com:9997) Download your Universal Forwarder app from your Splunk Cloud instance Install the app at the CLI on your HWF (./splunk install app /tmp/100_customername_splunkcloud.spl -update 1 ) Check HWF configs ( ./splunk list forward-server) List item ... View more

I believe it should be: | pivot Statistics HTTP sum(HTTP) as HTTPSum | eval HTTPSum = 'HTTPSum'/3600 If that's what you're angling for.... ... View more

Did you try deleting that expired license and leaving just the valid one? ... View more

This is all that I know of - setting in the server.conf: # The following 'allowRemoteLogin' setting controls remote management of your splunk instance. # - If set to 'always', all remote logins are allowed. # - If set to 'never', only local logins to splunkd will be allowed. Note that this will still allow # remote management through splunkweb if splunkweb is on the same server. # - If set to 'requireSetPassword' (default behavior): # 1. In the free license, remote login is disabled. # 2. In the pro license, remote login is only disabled for the admin user that has not changed their default password allowRemoteLogin=requireSetPassword So basically no - you can disable wholesale or enable wholesale. I don't see a way to just disable CLI for admin only while still allowing other Splunk users the ability to access via CLI. ... View more

No. App https://splunkbase.splunk.com/app/2695/ did not pass app vetting for installation in Cloud. The main issue with it is that it stores credentials in free text in the app configuration files. ... View more

Have you tried something like the following: |inputlookup my_kvstore | eval myTime=now()-Last_PA_Send | where myTime<=2700 stuffing the difference result into a new field might get you around that filter parsing issue. ... View more

Question: What does your data look like? That sub search essentially pulls in search parameters to filter out more events based on the values of those fields. If any of those are null/empty, you might be filtering out everything. What you might want to look into is using a left join. Possibly first using index=my_com sourcetype=my_desk query=file_data values!=val | join type=left workstation [ ] | join type=left date_min [ ... View more

It's been stated that the system requirement that says "Linux, 3.x and later" is conclusive of 4.x as well. So I've basically confirmed that support will support you on kernel version 4.4. Of course, one should always test said upgrade (freshening) before committing a production environment to the upgrade and/or version. ... View more

I will see what I can find out about 'support' - as for installing 6.5 on a Linux distribution with kernel 4.x, I've performed an installation of 64 bit Splunk 6.5.0 on Linux Mint 18 with a v4.4 kernel. No problems whatsoever thus far. ... View more

The v2.2 version was vetted for Cloud and was accepted after some documentation changes as of March of 2016. That being said, splunkbase is not reflecting that status. Submit a Splunk support ticket requesting the installation of the app in your instance. It should be approved and scheduled for install. ... View more

Only way I know of how to do this is to set up hybrid search where a search head (the heavy forwarder?) is on premise and is able to search your Splunk Cloud indexers. Thus the alert can be set up on-prem and thus has access to first see the data to trigger the alert but also have access to your device in order to trigger the run of the script. That being said, this does require Splunk Support/Ops to set up. ... View more

rex field=urlField "^[^\/]+\/\/[^\/]+\/(?P<wantedField>[^\s;]+).*" should pick up all three of your example use cases into the new extracted field named 'wantedField' ... View more

I don't believe we have a way in the UI to do this, so it most likely will be a request to Splunk Support to do so on your behalf. The process is similar to resolving orphaned searches if a user is removed: http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Resolveorphanedsearches so changing the local metadata and a refresh of splunkd would take care of it. However, changing the local metadata is a CLI thing, which one does not have access to in Splunk Cloud. NOTE: Resolving orphaned objects is something that will be included in the UI in a near future release. ... View more

I think this might answer your question. With SAML in Splunk, there is an 'undocumented' feature when it comes to the group->role mapping. IF you have a group in your AD (or LDAP) that a comes across in the SAML assertion 'role' attribute, AND you have an exactly the same named role in Splunk, Splunk will associate that use to that role automatically without having to have a group->role mapping explicitly set in the SAML configuration (authentication.conf). For instance, if you have an AD group named 'acme-splunk-users' and you had a custom Splunk role created named 'acme-splunk-users' then any user with that group would automatically map to that Splunk role without the explicit mapping created in the SAML configuration. Now - that being said - it would still be a two step process. You would need to create a new custom role in Splunk for every new AD group that you create and wish to have come into Splunk via SAML. There is not an automagic way of doing that otherwise. ... View more

For specifics on how to configure Okta to work with Splunk (Cloud) - there is a new blog posting out there: See it here ... View more

FYI: There is a now 'howto' blog posting for configuring Splunk Cloud and Okta SAML integration. Part of that is doing just what you did - start from scratch instead of starting from the community app. 🙂 See it here ... View more

The basis issue is that there is enough skew between your Splunk instance time and the time of the system clock at Okta. In the SAML assertion, there is a set of time parameters: If the response occurs outside that time slice, the Splunk will shut things down. Some times with a more descriptive message, but definitely with the 'The conditions saml response failed validation Verify the time in the response from IDP is in UTC time format.' message as part of the resulting error. You can try a couple of things: - Set up an NTP date service in your Splunk Instance (search heads, indexers, cluster managers, the whole ball of wax! - all of them!). - Capture the SAML conversation with a SAML tracer plugin within your browser (chrome, firefox, etc. all have a SAML tracer plugin - this makes it easier to see all of the XML passed between Okta and Splunk to determine what the time values are in the NotBefore and NotOnOrAfter conditions as well as the time stamps in the responses I've not found a way to add additional time buffer for Okta. In other IdPs (such as ADFS for instance), you can 'tune' the amount of time between the before/after conditions to make it a bit more tolerant of delays between Okta (IdP) and Splunk. ... View more

Sideview Utils might be a solution for you: https://answers.splunk.com/answers/77568/different-timerangepicker-values-for-different-reports-in-same-app.html https://splunkbase.splunk.com/app/466/ ... View more