Hi @Dinkos , you are using the same time frame, but if you're using a relative timeframe, running the secondary search in a different moment, you are using two different time periods. I mean: did you tried to pass as tokens the earliest and latest values from your main search to the secondary search? e.g., if the time picker is called "Time", you should try to pass the tokens: earliest=$Time.earliest$&latest=$Time.latest$ Ciao. Giuseppe ... View more

Hi @Dinkos , to the dropdown search, did you passed also the search or also the time borders? if you didn't passed the time borders, try to pass them. Ciao. Giuseppe ... View more

Hi @kjain041523 , you must use as token the same field name of the Detection search, in yur case $host$ and not $Host$. Ciao. Giuseppe ... View more

Hi @ekb , I suppose that you're speaking of a syslog input, is it correct? if not what kind of input are you using? If you are speaking of network or HEC inputs you must use a Load balancer in front of the two Heavy Forwarders, without it it's normal to have duplicated events using the same input on two machines. The best solution is to have a Load Balancer, otherwise, you should enable the input on only one machine. Ciao. Giuseppe ... View more

Hi @0xAli , as also @PickleRick said: the best approach is to use a certified Architect from a trusted Splunk Partner. Ciao. Giuseppe ... View more

Hi @0xAli , as @livehybrid said, the main difference is if you can use the same IP and hostname of the old machines. In this case, you could copy the $SPLUNK_HOME folder in the server and it will run. Only one attention point: remember to add the start at boot procedure. If instead you will have a different IP and hostname it's a longer process. I'm not an Hyper-V expert, but are you shure that you cannot import the VM in the new environment? Ciao. Giuseppe ... View more

Hi at all, I agree with all the considerations from  @0xAli, there's only one additional information: the sizing of using an indexer every 80-100 GB/day to index: this sizing arrives from the Enterprise Security Admin Course, but it isn't in any Splunk official documentation, infact working with the Splunk PS I received by them a different sizing: they hinted to use 150 GB/day per Indexer and, having very performant physical servers, also 200-250 GB/day per Indexer (this is the sizing from a Splunk architect of a project that I'm implementing ). What is the correct answer? I usually try to request a sizing to Splunk SE to be sure, if I must do the sizing by myself I use 150 GB/day per Indexer. Ciao. Giuseppe ... View more

Hi @sirpatrick , At first: you are using a Universal or an Heavy Forwarder? Then, what kind of input are you using in this add-on? if API inputs, you should understand where the checkpoint is located (e.g. DB-Connect stores checkpoint in a KV-Store);  if you are using only monitor, the checkpoint is in the _fishbucket folder, baut it shouldn't be relevant because in the new server you should have different files to read. Ciao. Giuseppe ... View more

Hi @msrama5 , it isn't possible to export all the panels in CSV, but only one by one. Ans, as I said, if you have Post Process Search, you have to open each search in Search dashboard and then export in CSV. Ciao. Giuseppe ... View more

Hi @SplunkWorthy , could you share a sample of your resulta ans logs? Ciao. Giuseppe   ... View more

Hi @spl_aficionado , what do you mean with active-active? you can configure only one DS for each client. You can also configure a Load Balancer with a VIP or a scaling DS. Ciao. Giuseppe  ... View more

Hi @himanshu2 , please don't call people in questions! Anyway, following the documentation, it's a known issue, you must follow the documentation during upgrade from 9.3.x to 9.4.x: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/administer-the-app-key-value-store/upgrade-the-kv-store-server-version Ciao. Giuseppe ... View more

Hi @Wohamed_wakkad , as also @PickleRick said, following the Splunk best practices, you should use a dedicated machine to Deployment Server role if it has to manage more than 50 clients. Ciao. Giuseppe ... View more

Hi @ankit13 , if you see license utilization only of the last days, it's related to the retentin of the _internal index. If instead you don't see any information about license utilization, do you forward License Master's logs to the Indexers? Ciao. Giuseppe ... View more

Hi @pruthviraj_k_m , at first, never use a join because it is very slow and expensive. Then if you must use a join don't start with the lookup, because the subsearch has the limit of 50,000 results. Using the lookup command you have a left join. Please adapt to your situation something like this (I cannot test the search because I haven't your data), index=notable | lookup incident_updates_lookup rule_id AS source_guid | table rule_id, source_guid_in_lookup, source_event_id, status  I don't know the relation between rule_id (in lookup) and source_guid (in index). Ciao. Giuseppe ... View more

Hi @0xAli , I usually use something like this: input(type="im<protocol>" port="<port>" ruleset="<input_name>") template(name="<template_name>" type="string" string="/data/syslog/<technology>/%fromhost-ip%/%$YEAR%/%$MONTH%/%$DAY%/<technology>_%$HOUR%.log") ruleset(name="<input_name>"){ action(type="omfile" dynaFile="<template_name>" fileOwner="<splunk_user>" fileGroup="<splunk_group>" dirOwner="<splunk_user>" dirGroup="<splunk_group>") } in a dedicated .conf file. ciao. Giuseppe ... View more

Hi @pruthviraj_k_m , let me understand: which changes do you want to track? Anyway: notable creations are recorded in the notable index, status changes are recorded in the incident_updates_lookup, notes are recorded in the mc_notes lookup. You can find a starting point in this my old answer: https://community.splunk.com/t5/Monitoring-Splunk/Need-help-with-Splunk-query-for-MTTD-and-MTTT-per-SOC-analyst/m-p/760135#M11134 or in this search: index=_audit source=mc_notes | eval json_blob=replace(_raw,"\\\\\"","\"") | rex field=json_blob "\"notable_id\":\s*\"(?<notable_id>[^\"]+)" | rex field=json_blob "\"content\":\s*\"(?<note_value>[^\"]+)" | eval note_value = urldecode(note_value) | rex field=json_blob "\"username\":\s*\"(?<user_value>[^\"]+)" | join type=left notable_id [ search index=notable | rename source_event_id as notable_id ] | table note_value user_value orig_rule_title Obviously, these are only starting point to create your own search. Ciao. Giuseppe ... View more

Hi @0xAli , as also @livehybrid pointed on, it depends on the syslog data volume and on the available storage on your receiver. I usually configure hourly rotation and, when I have available storage, I zip logs after 24 hours (removing zipped files) and I maintain zipped files for three days. If I don't have sufficient storage for this policy I adapt my polity to the available storage. In addition, I prefer to use rsyslog instead syslog-ng because it's more modern, but it's a choice! Ciao. Giuseppe ... View more

Hi @hrawat , could you better describe your search and its purpose? because I have an error in my on-premise installation, Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-Utils/configs/conf-savedsearches/Audit%20-%20Sourcetype%20readiness%20-%20Lookup%20gen?appcontext=true&count=0 from server=https://127.0.0.1:8089 - Not Found and on Splunk Cloud I have a result but not so comprehensible. Ciao. Giuseppe ... View more

Hi @fatsug , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @fatsug , no props.conf doesn't run only on indexed fields, it works on all fields, but there's a sequence in executions. If you put the eval in the search, it runs on an already done transformation for the severity field, so it correctly runs. If you put it in props.conf, you must analyze the sequence of transformations, in you your case, you have a rename that probably is executed after the eval transformation, for this reason the severity field isn't still available for the eval, and for this reason I hint to put in the eval the name of the severity field before the rename. Ciao. Giuseppe ... View more

Hi @fatsug , I'd modify the calculated field also beacuse it's the easiest way, even if I don't think that the case is relevant. Ciao. Giuseppe ... View more