Hello, I have many Windows DNS servers deployed worldwide with each one configured with local time. Unfortunately DNS debug log is writting local time information in the log. I already read here several answers related to that problem, and all of them suggest to use TZ attribute in props.conf. I have tried several variants of that without any success so far. Can somebody please confirm it can work when the TZ syntax is specified on the universal forwarder (not on the indexer) ? Thanks. ... View more

Hello, I have a query where I need to filter a date DateOpen_EPOC (already in EPOC format) with a time picker (token is date_open). This time picker is not linked to default _time. From a past question on the forum, I got this which works fine in most of the case: (...) | where DateOpen_EPOC >= if(replace("$date_open.earliest$","\d","")!="",relative_time(now(),"$date_open.earliest$"),"$date_open.earliest$") AND DateOpen_EPOC >= if(replace("$date_open.latest$","\d","")!="",relative_time(now(),"$date_open.latest$"),"$date_open.latest$") (...) However this query does not work in (at least) in two specific cases: - Time Picker = "All time" --> in that case, it looks $date_open.earliest$ and $date_open.latest$ return nothing and it does not work - Time Picker = "Last 7 days" (for instance). Here $date_open.latest$ equals now and it does not work Any suggestion to improve (or replace) this query to truly manage all cases ? Thanks. ... View more

Hello, I have the following input [powershell://Audit] script = & "$SplunkHome\etc\apps###\bin\Audit.ps1" schedule = 45 * * ? * * index = ### sourcetype = ### source = Powershell disabled = 0 Audit.ps1 is periodically executed to collect local data I need to audit. It works fine during a given period then suddenly stops to collect data, until I restart the UF. At the time where indexing stops I see the following WARN in splunkd.log 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Tag "\stream\event\data" was unexpected. 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "index". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "source". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "sourcetype". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "event". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "time". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "data". 01-18-2017 13:20:15.713 +0000 WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "index". As the collected data is changing from one script call to another, I guess there are special character or syntax that are making the input crash. But I cannot figure out exactly what (note: I cannot post the collected data on the forum, it is a bit sensitive). Any suggestion to troubleshoot the problem ? Regards. Sylvain ... View more

Hello, When connecting to my search head, I got a notification about a new release being available. However my search head is already up to date, same for my indexer. I have a few additional Splunk Enterprise server connected with misc. roles (Heavy forwarder, etc.) so I assume one of them has not been properly upgraded yet. Eventually I will find out which one but I was wondering if we can find this info directly from Splunk, typically what is the search ran behind the process displaying this kind of notification? Thanks. Sylvain ... View more

Hello, I am using Splunk 6.5 I would like to leverage scheduled report capability to speed up dashboard rendering. I have a complex report making a search like search (...) | table A, B, C where (...) is a complex query made of dedup, lookup, eval, etc. commands. I scheduled this report to be computed every hour I check I get the expected result Then I try to define this scheduled search as parent search of a dashboard like following... <form> <search id="CurrentTickets" ref="my report"> </search> (...) <single> <search base="CurrentTickets"> <query>stats count by A</query> </search> </single> (...) When I try to display the dashboard, it does not display anything (trying to search forever). On the other hand, if I replace the parent search by: search (...) | table A, B, C In this case, it displays as expected, but of course not with the expected performance as it does computer real-time my search. Is it possible to combine a scheduled report with parent search concept? Regards. Sylvain ... View more

Hello, I have a theoritical question as I am currently working on index organisation to setup my future user access delegation. Let's say I have: - two servers SERVER1 and SERVER2 - I am collecting security event logs and performance counters on both servers - security logs go into index security, and performance counters go into perfmon index Now the theoritical use cases... let's say I have 2 teams (among others use cases): - team 1 needs to access security logs only for his server (SERVER1) but perfmon data for any server - same for team 2 and SERVER2 Is the following going to work ? - I create three roles: perfmon-all, security-server1, security-server2 - perfmon-all is granted access to index perfmon and both teams are granted this role - security-server1 is granted access to index security + I use "Restrict search terms" to enforce "host=SERVER1" - security-server2 is granted access to index security + I use "Restrict search terms" to enforce "host=SERVER2" Else what are the options to cover this kind of use case ? Note: multiplying the number of indexes to adjust with required granularity is not a practical option as I will have hundred of servers in production with mixed similar use cases. Regards. ... View more