First understand your Splunk topology. Are there heavy forwarders (HF) involved?  Index time instructions will only apply on a HF or Indexer, and events will only be parsed once. So if an event is parsed by and HF and sent to an indexer, instructions for that event on the indexer will be ignored. Try to use btool to track down the entries in props.conf. That should give you a good place to start. https://docs.splunk.com/Documentation/Splunk/9.0.1/Troubleshooting/Usebtooltotroubleshootconfigurations /opt/splunk/bin/splunk btool props list <sourcetype> --debug   ... View more

A good idea is to have a test/dev environment, so that you can test the outcome before putting the config into production. Perhaps the app you are refering to is this one? https://splunkbase.splunk.com/app/1352/#/overview You can use a 60day Splunk trial to experiment with the cisco data and apps, or you may also consider applying for a developer license. https://dev.splunk.com/enterprise/dev_license ... View more

Do you mean, how do I make this event multiple events at search time, OR do you mean how do I onboard this data correctly into Splunk? I can't see any reason for the raw event to be stored this way in Splunk. You could stich the events back together like this at search time using transaciton command or similar method. Let us know which outcome you are looking for. ... View more

Yes, for events and metrics.  If you have HEC/HTTPOUT requirements, then you should upgrade the UF tier after the indexers are upgraded. ... View more

Have you searched Splunkbase for add-ons to support the equipment in question? https://splunkbase.splunk.com/apps/#/search/cisco/product/all Here is the ASA addon for example, which will normalize change events https://docs.splunk.com/Documentation/AddOns/released/CiscoASA/DataTypes https://splunkbase.splunk.com/app/1620/#/details       ... View more

7.x is supported, but only just. https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers   ... View more

Without fully understanding what you are trying to achieve, you can try using the solution below to run the SPL command that @bowesmana suggested add-on offers, or perhaps this may give you other ideas to solve the problem. https://community.splunk.com/t5/Dashboards-Visualizations/Button-to-run-splunk-query/m-p/454739/highlight/true#M29819     ... View more

You could set an alert around a search similar to this index=_audit  sourcetype=audittrail (savedsearch_name="MySavedReport" OR savedsearch_name="YourSavedReport") ... View more

Assuming you can  ping the DS / HF from the UF. - Have you run a netstat to check those ports are open, and that they are being used for Splunk and not something else? - Have you checked the splunkd.log file on the DS and HF for any errors relating to these services/ports? - Tried hitting the rest API on either DS or HF  using curl examples from docs? https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing - Is there enough disk space on the HF? (Less than 5GB by default will pausing indexing) - Take a look at the  issue described here. It's going to be network related at some level.  https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-err-not-connected-quot-error-in-Deployment/m-p/229246/highlight/true#M44603 Hope this helps.   ... View more

Hi @willsy , You can build a MultiSite Splunk Indexer Cluster without migrating from single site: https://docs.splunk.com/Documentation/Splunk/9.0.1/Indexer/Multisitedeploymentoverview The Splunk Cluster admin class takes this path so as to demonstrate the process, but also to make good use of the Splunk environment given to you during training.  Instead of deletiing all the config after your single site labs and starting again, you migrate to multisite, which raises some issues around single site buckets ect. There is no need to build a single site first, go straight to multisite using the link above. ... View more

I see that you are using the cloud app, not on prem, however similar solution most likley. https://developer.carbonblack.com/reference/carbon-black-cloud/integrations/splunk-app/#app-setup-and-configuration   Create two Event index(s) for your data. One index for the Carbon Black Cloud data e.g. carbonblackcloud One index for the results of the Alert Actions e.g. vmware_actions   Navigate to the Administration –> Application Configuration menu in the VMware Carbon Black Cloud App On the VMware CBC Base Configuration tab set the VMware CBC Base Index and VMware CBC Action Index to the index names from step 1 including index= e.g. index=carbonblackcloud   ... View more

Hi @bsanjeeva , It's likley an index that is not searchable by default, or a macro needs to be updated to specify the indexes with the data. Is this the app you are using? (VMware Carbon Black EDR On-Prem) If so: Navigate to the Administration > Application Configuration menu, VMware EDR Base Configuration tab. Update the index names to those created above Click the Save Application Configuration button to enable the App Otherwise, open a report panel from the app in search, if it contains macro's, use the CTRL-SHIFT-E shortcut to expand the search. The problem should become a bit more obvious at that point. ... View more

Also review the docs for the rex command. It uses named capture groups for the extracted field names. https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Rex   ... View more

Hi @mdyunusraza , Try escaping those bracket symbols you are matching with a backslash.  | rex "((?:\[^"\\\/\b\f\n\r\t\]|\\u\d{4})*)" ... View more

Hi have no experience with this vendor, however the devices do support syslog: https://customer.cradlepoint.com/articles/Knowledge/NCOS-How-to-setup-a-Cradlepoint-router-to-send-info-to-a-Syslog-Server As a starting point, you could open a port on Splunk and send the syslog to a test index to get an idea of what it looks like. Be sure to review the best practice for handling syslog with Splunk (Opening a port on Splunk is NOT best practice) Syslog-ng https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html Splunk connect for syslog https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-connect-for-syslog-turnkey-and-scalable-syslog-gdi.html Hope this helps get you started. ... View more

Ok, a few things to try: - Try removing quotes - Try escaping the path with and wihtout quotes \/wealthsuite\/tti\/current\/*   ... View more

sourcetype=bar OR sourcetype =foo OR sourcetype=cisco:* ... View more

I don't know the answer to your question regarding why it's not a thing. But you can clone reports to rename, you don't have to delete and recreate. Clone to rename, then delete or disable original.  https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Report/Createandeditreports#Clone_a_report   ... View more

Ahh ok. For on premise, you will need to follow the docs for rewnewing the certificates. It could be as simple as  "If you have previously configured certificates for your infrastructure, the process can be as simple as updating the expiring or expired certificate with the new certificate and restarting the Splunk platform instance to recognize the certificate." https://docs.splunk.com/Documentation/Splunk/9.0.1/Security/RenewExistingCerts Also worth noting that Splunk support will assist here if you have a valid support agreement. ... View more

If I understand correctly, the certificate used to secure data feeds to Splunk Cloud has expired? Have you tried downloading a new copy of the UF App from your Splunk Cloud environment and either deploying that or moving the valid certificate files into the exiting App? The reason config is in default is because its the config provided by the App developer. An empty local directory impies you are using the defauts, and not overiding them with your own config. ... View more