Hi Team, I need to create 3 calculated fields | eval action= case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (valid="Success")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success") | eval app= case(action="success" OR action="failure", "appname_Authentication") | eval valid= if(error="invalid credentials","Error","Success") action field is dependant on valid app field is dependant on action I am unable to see app field in the splunk, may I know how to create it? ... View more

Hi Team, We have some reports in a shared path, how to bring it to splunk? ... View more

Hi Team, I have an auto-extracted field - auth.policies{} I have another field called user  Whenever auth.policies{} is root, I need that to be a part of user field May I know how to do it? Is there a possibility to use case and coalesce together? ... View more

In Python script I get a below error in internal logs TypeError: Object of type bytes is not JSON serializable We are using python 3 May I know how to get rid of this error in internal logs?   ... View more

Hi Team, How to integrate proficio with splunk ... View more

Hi, Working on splunk capacity planning 1. splunk is in cloud 2. 100GB of data 3. 10 users 4. No use of splunk enterprise security How much license would be required? No. of indexers?  search heads?  Is there any site where I can get the exact details?   ... View more

Hi, I could see duplicate data in splunk by using below query index="indexname" | stats count by _raw | where count >1   I checked 10 different indexes out of which 8 indexes are having duplicate logs   ... View more

Hi All, How to find unwanted logs (noise) in crowdStrike Falcon logs? Do you know the details that can be filtered in crowdstrike falcon logs?   ... View more

Hi All, Is there an option to see the working of Fish bucket in real time? Switching off the server? can we test it? If yes, please let me know how to do it in test server. ... View more

Hi  I have extracted a field username and it has domain and user username= "google\\john" username="googleuser" username = "admin" I need calculated to be created in props.conf where google should go to domain and john should go to user field This domain field will be there only in certain logs So whatever is there before "\\" should be considered as domain and after "\\" is user In some cases domain wont be there, for those cases username to be tagged to user field All this should happeb at backend props.conf domain = google user= john user = googleuser user = admin ... View more