Hi @toporagno , let me understand: you have an eventtyle like "index=my_index src=10.0.0.1" that tags these events with a tag like "MY_TAG", you have a search that uses the above src and it runs, you want to replace the condition "src=10.0.0.1" with the condition tag=MY_TAG, and it doesn't run, is it correct? If this is your use case, as also @ITWhisperer asked, the first thing is sharing the search and the eventtype associated to the tag. Then, tag is the only field case sensitive, are you sure that the tag value is correct? Second check: did you tried to replace the condition "src=10.0.0.1" with the eventtype associated to the tag? maybe the two conditions aren't compatible. Ciao. Giuseppe ... View more

Hi @Millowster , this (and many others) is the reason because I don't use Dashboad Studio: not all the functions of Classic Dashboard are still implemented. Ciao. Giuseppe ... View more

Hi @NReddy12, I never experienced this behavior on a Linux server. The only hint is to open a case to Splunk Support, sending them a diag of your Universal Forwarder. Ciao. Giuseppe ... View more

Hi @phanikumarcs  good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @gcusello  I checked the macros again and they contain the same values you listed earlier. Unless we've missed something, very basic they look in order. I've attached the screenshots of the macro configs. I believe they are correct? They were all self populated when the App was installed. There are no details about special settings for the index which I created via the WebUI with the suggested default index name. Thanks again   ... View more

Hi @CarolinaHB, there are two solutions that depend on the  location of the monitoring perimeter: if you have a lookup containing the list of each app that should be present in each host (called e.g. app_perimeter.csv and containing at least two fields: host and application), you could run something like this: <your_search> | stats count BY host application | append [ | inputlookup app_perimeter.csv | eval count=0 | fields host application count ] | stats sum(count) AS total BY host application | eval status=if(total=0,"Missing","Present") | table host application status If instead you don't have this lookup and you want to compare results e.g. of the last 24 hours with the results of the last 30 days, you could run something like this: <your_search> earliest=30d latest=now | eval period=if(_time>now()-86400,"Last day","Previous days") | stats dc(period) AS period_count values(period) AS period BY host application | eval status=if(period_count=1 AND period="Previous days","Missing","Present") | table host application status Ciao. Giuseppe   ... View more

You already had some sugestions which are OK but the question is what are your limitations on this search. How many events do you expect from each of those data sets, how long is the search supposed to take - these can warrant a different approach to the problem. For example, since you're dealing with email data, it's a relatively valid question why aren't you using CIM datamodel (and have it accelerated). ... View more

Hi @KingUs80 , see in the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435), or, if you already have, in Enterprise Security Premium App. The feature in ES is Threat Intelligence: you must have an internal list of malicious sites of a list downloaded from free or payment services. Other apps that you could use are MISP42 (https://splunkbase.splunk.com/app/4335) or https://splunkbase.splunk.com/apps?keyword=threat+intelligence  Ciao. Giuseppe ... View more

I have followed all the necessary guidelines. The operating system is Windows Server 2022, and I have installed it on a machine that didn't previously have UF installed. I have completely disabled the antivirus. I have performed the installation twice, once with the domain admin and once with the local admin. Each time, I encountered the same issue. The latest installable version on these machines is 9.0.1, and subsequent versions (up to 9.2.1) encounter the same error. ... View more

Hi @whitecat001 , you can use the regex hinted  by @ITWhisperer , but when you ha a pais fieldnem=fieldvalue, as in your case, you could simply use the field for searching your data: index=your_index permission=Permission12345 | ... Ciao. Giuseppe ... View more

Our splunk server keeps the logs for a lot longer.  Sorry I was unclear.   ... View more

Hi @AvivBenSha , as from its name, Heavy Forwarder forwards data ro the indexers, so it isn't involved in the indexing phase. In this phase, Indexers store _raw data and index events. HFs are only involved in the input, merge, typing and parsing phases, not in indexing phases. Instead UFs are only involved in the input phase, not in the others. Ciao. Giuseppe ... View more

Thanks a lot @gcusello ! I just created a search to create that CSV used in your query. | ldapsearch domain=default search="(objectClass=computer)" | table name | rename name as host | outputlookup append=false monitored_hosts.csv and I run your query using the monitored_hosts.csv. It works flawless! thanks once again.   ... View more

The thread you're responding to is relatively old and is not directly related to your question. To keep the Answers tidy and focused and to ensure visibility of your issue please submit your question(s) as a new thread.   ... View more

Hi @RanjithaN99, Indexer Cluster is managed by the Cluster Manager so you have to create the new indexes.conf in this server that deploys it to the indexers; for more infos see at https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Aboutclusters in few words, you have to create a stanza in indexes.conf with the new index using the CLI and push the configuration using GUI. For data forwarding from te SH to the Indexers, you should already have this configuration because it's a best practice to send internal logs from all the Splunk servers to Indexers. If not go in [Settings > Forwarding and Receiving > Forwarding] and configure Forwarding. Ciao. Giuseppe ... View more

1. Your problem is not clearly specified. You might want to find out how many users are logged in at some given point in time or which ones are logged in (also possibly counting or not duplicate logins). 2. Do you have a separate login and logout events? 3. Remember that as you're logging only login and logout events you won't find sessions which "overlap" your search time range. For example - if your user logged in at 9am and logged out at 12pm you won't find this session if you only search through 10am-11am because you have no events regarding this session during that time range. (this problem can be alleviated for specific use cases by using summary indexing). ... View more

Hello, Thank you for your answer! I made sure that all the points you mentioned are correctly implemented and also checked the documentation you sent. I fixed the problem by enabling the indexing on the Heavy Forwarder and now the client is appearing in it's fowarder management UI aswell. However, it's still showing in the other instances (Manager Server, Indexers etc.) aswell. Also, I don't want to turn on Indexing on the Heavy Forwarder, to not index data, is there a way to avoid enabling it and still get the client showing on the UI? It's a real pain bug i hope they fix it ... View more

Hi @sle, good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @mfonisso, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @kreddykotla , please try this  | rex "(?<your_field>[^-]+)\/[^\/]+$" that you can test at https://regex101.com/r/0yi0zt/1 Ciao. Giuseppe ... View more

This seems to be an limitation on the Microsoft end: https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984335(v=office.15)?redirectedfrom=MSDN#data-granularity-persistence-and-availability   The `delay_throttle` option in the input can be used to control it, but the docs seem to say that events can be delayed by 24-hours in the Microsoft end, so that seems to be why the default is 24-hours. ... View more

OP is aparently looking for someone to produce an output useable as answer to a question in some course quiz. (Hence Q1). ... View more

Small correction: NO_BINARY_CHECK = true (If I edit my original answer, the formatting will be mangled.) ... View more

Assuming you have a lookup containing three columns (index, host, sourceid) so that you can have multiple index/host pairs matching a single sourceid and you want to find situations where none of the index/host pairs for a given sourceid report indexed events, you can do it like this: Count the events you have (preferably with tstats if you can) | tstats count where <your conditions> by index host Now you want to append your table | inputlookup append=t yourlookup | fillnull count value=0 So you have to do check the overall count | stats sum(count) as count by index host sourceid This is not much different from your "single source check". But as you want to have it checked against a "multisourced" id. So do | eventstats sum(count) as combined_count by sourceid This will give you additional field containing a combined count of events across all index/host pairs for a given sourceid. So the ones you're interested in are those which didn't have any events in any of those index/host pairs | where combined_count=0   ... View more