Hey @asimit  Out of interest, what LLM are you using to generates these responses?  By the way, half of the links you posted are hallucinations.   ... View more

Hi @kiran_panchavat  $10/GB? Where are you seeing that?  That would be nice.  (Edit - I see you've now removed this and replaced it with other content) Google suggests "Splunk typically costs between $1,800-$2,500 per GB/day for an annual license." but this is probably based on public pricing resources without any partner/volume discounts etc.  For what its worth, I agree with @isoutamo that Splunk Cloud would be a good option here, I thought smallest was 50GB but if its only 5GB then the annual cost for this is probably less than the cost of someone building, running and maintaining a cluster on-prem!  For what its worth - I did a conf talk in 2020 about moving to Cloud and the "cost" ("The effort, loss, or sacrifice necessary to achieve or obtain something") - TL;DR; Cloud was cheaper. https://conf.splunk.com/files/2020/slides/PLA1180C.pdf#page=37 The Free version wont suffice for the PoC because it doesnt have the features required such as clustering, authentication etc etc. Get in with Sales and they can help arrange a PoC license if they think you'll be looking to purchase a full license 🙂 https://www.splunk.com/en_us/talk-to-sales/pricing.html?expertCode=sales 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing     ... View more

Hi @danielbb  I think from memory the minimum I've seen a Cloud stack is 50GB, however this is just based on a some of the smaller customers I have worked with.  It is possible to get ingestion based licenses for on-premises which I believe go from 1GB in chunks, so you would be able to purchase a 2GB license. I think your best option here is to speak to sales, if you dont have a contact go via https://www.splunk.com/en_us/talk-to-sales/pricing.html?expertCode=sales and tell them you wish to do a PoC etc, they should be able to provide you a proper license for the PoC versus the trial license available online. Happy Splunking! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Harikiranjammul  If you can, restrict the first part of the search by adding (Status="*host is down* OR Status="*Some other criteria*") 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @asadnafees138  I assume you are using Ingest Actions to send your data to S3? If that is the case then you have the option of either raw, newline-delimited JSON or JSON format. This makes it easier for other tools or re-ingestion in the future as it is not stored in a proprietary format. If you are ever looking to use Federated Search for S3 to search your S3 data in the future then this requires newline-delimited JSON (ndjson). For more information I'd recommend checking out the Ingest Actions Architecture docs. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Harikiranjammul  Use an eval statement with a conditional to build the description field based on the value of status. |makeresults | eval Server="host1", Status="host is down", Threshold="unable to ping" | append [| makeresults | eval Db="db1", Status="database is down", Instance_status="DB instance is not available"] | eval date=strftime(_time, "%d/%m/%Y %H:%M:%S") | eval description=case( Status=="database is down", "date=" . date . " Db=" . Db . " Status=" . Status . " Instance_status=" . Instance_status, Status=="host is down", "date=" . date . " Server=" . Server . " Status=" . Status . " Threshold=" . Threshold )   This SPL checks the Status field and constructs the description field by concatenating the relevant fields for each case. Ensure your field names match exactly (case-sensitive) and are extracted correctly before using this logic. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @Ciccius  This is likely to be an issue with permissions, please could you validate that the permissions within the rest_ta app in $SPLUNK_HOME/etc/apps/rest_ta is the same across your SHC?  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @sankardevarajan  The configuration you provided is for the OnBase application to send logs to Splunk, not for Splunk configuration itself. You need to configure the OnBase application's .config file to send logs to Splunk. The configuration snippet you provided is for the Hyland.Logging component, which is part of the OnBase application. You need to modify the .config file ( likely Application-Server-Web.config or another relevant config file) on the OnBase Application Server to include the specified route. <Route name="Logging_Local_Splunk" > <add key="Splunk" value="http://your-splunk-heavy-forwarder-or-indexer:8088"/> <add key="SplunkToken" value="your-splunk-http-event-collector-token"/> <add key="DisableIPAddressMasking" value="false" /> </Route>   To receive these logs in Splunk Cloud, you need to: Set up an HTTP Event Collector (HEC) token in your Splunk Cloud instance. Configure the OnBase application to send logs to the HEC endpoint. In Splunk Cloud, you will need to create an HEC token and get the HEC endpoint URL. You can then use this token and endpoint URL in the OnBase application's .config file. The http://localhost:SplunkPort in the configuration should be replaced with the URL of your Splunk HEC endpoint (typically https://http-inputs-<stackName>.splunkcloud.com ) and SplunkTokenNumber should be replaced with the actual HEC token. For more information on configuring HEC in Splunk Cloud, refer to https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/UsetheHTTPEventCollector. For reference the current instructions for creating HEC tokens for Splunk Cloud are: Click Settings > Add Data. Click monitor. Click HTTP Event Collector. In the Name field, enter a name for the token. (Optional) In the Source name override field, enter a name for a source to be assigned to events that this endpoint generates. (Optional) In the Description field, enter a description for the input. (Optional) If you want to enable indexer acknowledgment for this token, click the Enable indexer acknowledgment checkbox. Click Next. (Optional) Make edits to source type and confirm the index where you want HEC events to be stored. See Modify input settings. Click Review. Confirm that all settings for the endpoint are what you want. If all settings are what you want, click Submit. Otherwise, click < to make changes. (Optional) Copy the token value that Splunk Web displays and paste it into another document for reference later. (Optional) Click Track deployment progress to see progress on how the token has been deployed to the rest of the Splunk Cloud Platform deployment. When you see a status of "Done", you can then use the token to send data to HEC. Ensure that the Splunk HEC endpoint is accessible from the OnBase Application Server. If it's not, you may need to set up a Heavy Forwarder to act as an intermediary. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @aravind  There isnt a suppression list which customers can access, however if you log a support ticket they are able to check the PostMark mail server logs to check if any emails bounced, this could help confirm that  a) If the alert actually fired correctly b) Email accepted by the mail relay c) If the relay had any issue sending on to the final destination. At a previous customer we had a number of issues with the customer email server detecting some of the Splunk Cloud alerts as spam and silently bouncing them. You can contact Support via https://www.splunk.com/support 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @Ramachandran  To force the omhttp module to use HTTP instead of HTTPS, you need to specify the usehttps parameter and set it to off. action(type="omhttp" server="172.31.25.126" serverport="8088" usehttps="off" uri="/services/collector/event" headers=["Authorization: Splunk <token>"] template="RSYSLOG_SyslogProtocol23Format" queue.filename="fwdRule1" queue.maxdiskspace="1g" queue.saveonshutdown="on" queue.type="LinkedList" action.resumeRetryCount="-1" )   The usehttps parameter controls whether the module uses HTTPS or HTTP to connect to the server. By default, it is set to on, which means HTTPS is used. Setting it to off will force the module to use HTTP. Additionally, you should use serverport instead of port to specify the port number. The behavior you're seeing is expected if you only set the port to 8088 without configuring the protocol because the default protocol is HTTPS. https://www.rsyslog.com/doc/v8-stable/configuration/modules/omhttp.html 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @amit2312  If you want to extract this as part of a search then you can do the following: | rex "Service ID - (?<Service_ID>\S+)$" For example:  To convert your rex to an automatic extraction, add the regex as a REPORT extraction or inline FIELD extraction to your props.conf: == props.conf == [yourSourcetype]REPORT-service_id = service_id_extraction == transforms.conf ==  [service_id_extraction] REGEX = Service ID - (?<Service_ID>\S+)$ 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @RdomSplunkUser7  I think ultimately this depends on what your searches are doing, if there is a risk of pulling in duplicate data then dedup is a good option, or you could look at using something like stats latest(fieldName) as latestFieldName It really depends on your search(es). If you'd like to share the SPL we might be able to help further. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Mobyd  Please could you confirm - is this using an admon:// input? If so you should be able to specify a "startingNode" which would the OU which you would like to monitor. https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf#:~:text=startingNode%20%3D%20%3Cstring%3E 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Varun18  Its not easy to get a list of all the usernames, but passwords is easy with the /services/storage/passwords endpoint. However you might have some success with the following search I've put together. It uses a map command so be careful - it gathers the passwords then attempts to reconstruct the stanza from the config file it originated in! | rest /services/storage/passwords | search clear_password!="``splunk_cred_sep``S``splunk_cred_sep``P``splunk_cred_sep``L``splunk_cred_sep``U``splunk_cred_sep``N``splunk_cred_sep``K``splunk_cred_sep``" | table clear_password realm username | rex field=realm ".+\#(?<app>[^\#]+)\#(?<configPath>.+)" | table app configPath username * | rex field=username "(?<stripUsername>[^\`]+)" | stats latest(*) AS *, list(clear_password) as concat_clear_password by configPath username app | eval restPath="/servicesNS/-/-/".configPath."/".stripUsername | map maxsearches=100 search=" | rest $restPath$ | foreach * [| eval secretField=mvappend(secretField,IF('<<FIELD>>'==\"******\",\"<<FIELD>>\",null()))] | eval clear_password=\"$concat_clear_password$\" | eval configPath=\"$configPath$\" | eval app=\"$app$\" | fields - eai:* author disabled published updated splunk_server " | rex field=configPath "configs/conf-(?<configFileName>[^\/]+)" | eval isJson=IF(json_valid(clear_password),"isJson","NotJson") | tojson | eval jsonKeys=json_array_to_mv(json_keys(_raw)) | eval stanza="==".app."/".configFileName.".conf== [".title."] " | foreach jsonKeys mode=multivalue [| eval stanza=stanza.IF(<<ITEM>> IN ("id","secretField","title","configFileName","configPath","isJson","clear_password","app"),"",<<ITEM>>."=".coalesce(json_extract(clear_password,<<ITEM>>),json_extract(_raw,<<ITEM>>))." ")] | table stanza 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @ajitabh  You might have resolved this but just incase, or if its useful for others in the future, there is a really useful PDF provided by the education team at https://www.splunk.com/en_us/pdfs/training/how-to-view-your-splunk-certifications.pdf which shows the current process for retrieving your certificate. TLDR: If you are a Partner you can download them from https://splunk.my.site.com/partner/s/credentials If you are not a partner visit: https://splunk.my.site.com/customer/s/list-views/certifications If you have any issues then certification@splunk.com is your best contact. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @tamalunp  You could try with searchmatch maybe? | eval isFoo=if(searchmatch("[\"foo\"]"),"yes","no")   Full example: |windbag | head 1 | eval _raw="This is a test message [\"foo\"] bar" | eval isFoo=if(searchmatch("[\"foo\"]"),"yes","no") | table _raw isFoo 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @LearningGuy  It isnt possible to set the token within the dataSources section *however* you can do the following... ... "viz_gE0iilm3": { "dataSources": { "primary": "search1", "search1": "search1", "search2": "search2" }, "options": { "table": "> $mysearch$" }, "type": "splunk.table" } }, "dataSources": { "search1": { "name": "search1", "options": { "query": "| makeresults \n| eval msg=\"Search 1\"" }, "type": "ds.search" }, "search2": { "name": "search2", "options": { "query": "| makeresults \n| eval msg=\"Search2\"" }, "type": "ds.search" } }, ... What we're doing here is defining the references to the searches under the dataSources section of the viz, so mapping "search1" to the relevant ID of search1 (not the name!), so in your case "ds_index1". Important Note: you *must* have a primary otherwise the viz doesnt seem to load, this could be a basic makeresults empty search, or just search1. Then within the table options we set : "table": "> $mysearch$" This defaults to "> primary" but we are overriding with the dataSource we want it to pull from (as defined in the dataSources section of the Viz) Full example: { "title": "testing", "description": "", "inputs": { "input_Ldh6KqEz": { "options": { "items": [ { "label": "Data 1", "value": "search1" }, { "label": "Data 2", "value": "search2" } ], "token": "mysearch" }, "title": "Dropdown Input Title", "type": "input.dropdown" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "-24h@h", "latest": "now" } } } } }, "visualizations": { "viz_gE0iilm3": { "dataSources": { "primary": "search1", "search1": "search1", "search2": "search2" }, "options": { "table": "> $mysearch$" }, "type": "splunk.table" } }, "dataSources": { "search1": { "name": "search1", "options": { "query": "| makeresults \n| eval msg=\"Search 1\"" }, "type": "ds.search" }, "search2": { "name": "search2", "options": { "query": "| makeresults \n| eval msg=\"Search2\"" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_Ldh6KqEz" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_gE0iilm3", "position": { "h": 300, "w": 830, "x": 10, "y": 30 }, "type": "block" } ], "type": "absolute" } }, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } } }   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @mattt  I'm a little confused as to why requestId= is still present in the second event example. If you want to run the regex extract against the "requestID" field then you need to add "in <fieldName>" to your extract: <regex> in <src_field> See the docs here For example: EXTRACT-requestId = (requestId=)?(?<field_requestId>[a-f0-9\-]{36}) EXTRACT-Response = Response:\s(?<field_response>([A-Z]+)\s([^\s,]+(?:[^\r\n]+))) EXTRACT-Request = Request:\s(?<field_request>([A-Z]+)\s([^\s,]+(?:[^\r\n]+))) 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @dtamburin  Cribl will be sending data which is already parsed, therefore the proposed props/transforms will not work, instead you can use Ingest Actions: == props.conf == [cribl] RULESET-ruleset_cribl = _rule:ruleset_cribl:set_index:eval:is31lica RULESET_DESC-ruleset_cribl = == transforms.conf == [_rule:ruleset_cribl:set_index:eval:is31lica] INGEST_EVAL = index=IF(match(_raw,"(?i)vpxa"),"vmware", index) 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more