Hi @VijayA, If you have a valid license, you can contact your Splunk Partner or Splunk Sales, to add one or more (until three) of you to your license. Then you can use these accounts to open cases. Ciao. Giuseppe ... View more

Hi @balu1211, let me understand: you want to apply this search to the Network Traffic Data Model, is it correct? if this is your requirement, please try something like this: | tstats values(dest_port) AS dest_port values(dest_ip) AS dest_ip dc(dest_ip) AS num_dest_ip dc(dest_port) AS num_dest_port from datamodel=Network BY src_ip | where (num_dest_ip > 350 AND num_dest_port > 800) Ciao. Giuseppe ... View more

Hi @Atchyuth_P, as @woodcock said, in general there's no requirement to use an HF in your architecture. Usually HFs are used as concentrators when you want to reduce the open routes between a segregated network and an external Splunk or when you have to pull logs from Cloud Service Providers. About the License Master, I usually don't install it on the Deployment Server because, if it has to manage more than 50 clients, it must be on a dedicated Server. I usually put the License Master on the Master Node or on the Monitoring Console, in your case I'd put it on the Indexer. Ciao. Giuseppe ... View more

Hi @psimoes, as @yeahnah said, this is an incorrect way to use subsearches and anyway, you don't need a subsearch for your purpose. Please try something like this: index=A (action=view OR action=purchase) | stats dc(action) AS action_count values(action) AS action BY user | where action_count=1 AND action=view  Ciao. Giuseppe ... View more

Hi @AsafMarxRoz, Splunk accepts UDP traffic if you enable it! you have at first to disable local firewall on the server for this protocol and port and then you have to enable the input in the section [Settings > Inputs > Network Inputs > UDP]. In addition you should check that there isn't any intermediate firewall between Check Point and Splunk. Ciao. Giuseppe ... View more

Hi @fatanyk, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @sarashafek, you have to install the Zscaler technical Add-On for splunk (https://splunkbase.splunk.com/app/3865) and follow the instructions at  https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728 Ciao. Giuseppe ... View more

Hi @VijayA, Splunk reads and immediately sends files when they are generated, the generation frequency hasn't inpact one the UF activity. If you want to limit the bandwidth occupation of your data, you can setup a limit of the dimension of the data packets sent by the UF, but you don't need any intervene on the frequency. ciao. Giuseppe ... View more

Hi @hoseineagle, could you share some sample of your logs? Ciao. Giuseppe ... View more

Hi @pavan_kumar, are you speaking of two differen dashboards or two panels of the same dashboard? Anyway, you could schedule a  frequent refresh your panels so the data are frequently updated. Could you share your searches or the code of your dashboard? Ciao. Giuseppe ... View more

Hi @Anidy21 , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @aru949 , you can add a message or an image where there isn't any result in your search, following the instructions in Splunk Dashboard Examples app (https://splunkbase.splunk.com/app/1603). Anyway, to change the aspect of a panel, you have to modify the CSS, here you can find some explanation (I'm not an expert!) https://www.splunk.com/en_us/blog/customers/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html Ciao. Giuseppe ... View more

Hi @gitingua, using my search you have the list of all reports and alerts. Then, as @woodcock hinted, using tye Monitoring Console, you have alla the information about reports and alerts executions. Ciao. Giuseppe ... View more

Hi @ali-a981, yes, as I said the Splunk server uses the interfaces of the operative system, so if your Splunk Enterprise is installed on your laptop, it uses the IP address of your laptop. Ciao. Giuseppe ... View more

Hi @ali-a981, Splunk uses the Operative System of the server, so, you have to run "ifconfig" (on Linux) or "ipconfig" (on Windows. Ciao. Giuseppe ... View more

Hi @Texascoast88, I'm continuing to use Classic Dashboard, so I usually use theDashboard Examples App, and I didn't used the examples for Dashboard Studio. So Install the Dashboard Examples on your computer and apply them to your dashboards. Ciao. Giuseppe ... View more

Hi @Texascoast88, you could start installing the Dashboard Examples App (https://splunkbase.splunk.com/app/1603) if you want to use Classic interface. Or for dashboard Studio: Demo - See an example of the power of Dashboard Studio! https://drive.google.com/file/d/1j8KiNSzLPqsRtyPPWNu2c-QysKGdj6JB/view?usp=sharing Tech Talk - Watch this to get a great 20 minute introduction https://events.splunk.com/tech-talks-dashboard-studio?utm_medium=email&utm_source=splunk&utm_campaign=Global_FY21Q2_GLBL_RTN_OnEvt_CUS_EN_DashboardStudio_CSM_May21 Blogs - Read more about our newest features https://www.splunk.com/en_us/blog/search.html?query=%22dashboard+studio%22 Conf21 Breakout Session - Learn how you can reimagine your data visualizations https://conf.splunk.com/watch/conf-online.html?search=PLA1266A#/ Documentation - Find more details! https://www.splunk.com/en_us/blog/search.html?query=%22dashboard+studio%22 Tutorial - Try it out yourself with this step-by-step guide to create this dashboard: https://docs.splunk.com/Documentation/SplunkCloud/latest/DashStudio/dashStudioTutorial  Ciao. Giuseppe ... View more

Hi @vinod743374 , don't attach a new question, even if on the same topic, to an already answered question, open a new one, because in this way you'll have more and faster answers. Anyway, yes, you can downgrade your license changing your contract when it will expire and you have to renew it. But before doing this, analyze your logs identifying how many time you exceed the new license in 60 days. Otherwise, on Splunk Cloud, you could also use a different licensing method, called SVC, that calculates the license not on the indexed logs but on the really used system resources. For more infos see at https://www.splunk.com/en_us/products/pricing.html?utm_campaign=google_emea_tier2_en_search_brand&utm_source=google&utm_medium=cpc&utm_content=Splunk_Prod_Pricing_EN&utm_term=splunk%20pricing&_bk=splunk%20pricing&_bt=505717294060&_bm=e&_bn=g&_bg=75654874028&device=c&gclid=Cj0KCQjw_r6hBhDdARIsAMIDhV_WP5lduipB0sHkvGUaKgofFI3rQa07rHSlghT5wuSchN0xXZRa9BYaAuW9EALw_wcB Ciao. Giuseppe ... View more

Hi @vineela, you have three ways to extract fields from a file in json format: add INDEXED_EXTRACTIONS=json to your props.conf, in this way the file is correctly parsed and you have all the fields, remember that this configuration must be located in the Universal Forwarders, on Heavy Forwarders  (if present), on Indexers, and on Search Heads, using "spath" command (https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Spath) in your searches, as @tscroggins said, using regexes in your searches, but you have to extract one by one all fields. Ciao. Giuseppe ... View more

Hi @vik, could you share your search? did you expressed the _time in the fields outputted in the results? Ciao. Giuseppe ... View more