Token Authentication: This is definitely your best bet for security. You can create these through Splunk Web or via the API itself.  https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTtoken HTTPS: Always, always use HTTPS for your API calls. It's a must for encryption. RBAC Make sure your API user or token only has the permissions it absolutely needs. Less is more when it comes to security! Create splunk roles and map accordingly. MFA: While Splunk supports MFA for user logins, it's not directly used for API calls. Instead, you'd set up MFA for the user generating the API tokens. https://docs.splunk.com/Documentation/SIM/current/User/SetupMFA SAML: If you're using SAML, you'll still use tokens for API access. SAML is more for the web interface. Tokens are usually the way to go for most scenarios. https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SetupuserauthenticationwithSplunk https://docs.splunk.com/Documentation/Splunk/9.3.1/Security/UseAuthTokens   Hope this helps! ... View more

Based on what I can understand, you can try using something like this and tweak it as needed. | makeresults | eval datetime_str="Thu 10 Oct 2024 08:48:12:574 EDT" | eval datetime=strptime(datetime_str, "%a %d %b %Y %H:%M:%S:%3N %Z") | eval day_name=strftime(datetime, "%A"), day_of_month=strftime(datetime, "%d"), month=strftime(datetime, "%b"), year=strftime(datetime, "%Y"), week_number=strftime(datetime, "%U"), time_part=strftime(datetime, "%H:%M:%S") | fields datetime_str, datetime, day_name, day_of_month, month, year, week_number, time_part | eval hour=substr(time_part, 1, 2), minute=substr(time_part, 4, 2), second=substr(time_part, 7, 2)     ... View more

Hi @Raj_Splunk_Ing No need to apologize - we all start somewhere, and asking questions is how we learn! Let's break down your question about using AND ... IN (...) versus WHERE ... IN (...) in Splunk searches. Both of your examples will work, but there are some slight differences:   AND ... IN (...): index=ADFS_AWS AND clientId IN ("Abc123","ABC123","ABC_ABC","abc_abc")   This is part of the main search string and is evaluated early in the search process.   Using WHERE:   index=ADFS_AWS | WHERE clientId IN ("Abc123","ABC123","ABC_ABC","abc_abc") The WHERE command is a separate search command that filters results after the initial search. In terms of efficiency: For most cases, they'll perform similarly. The AND version might be slightly faster as it's applied earlier in the search process. The WHERE version is more flexible if you need to do more complex filtering. Remember, the best approach often depends on your specific data and use case. Don't hesitate to test both and see which works better for you! Splunk Search Manual: https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsearch Search Processing Language (SPL) Reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual WHERE command documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where Comparison of search commands (including AND and WHERE): https://docs.splunk.com/Documentation/Splunk/latest/Search/Comparesearchcommands Best practices for searching: https://docs.splunk.com/Documentation/Splunk/latest/Search/Bestpracticesforsearching Using the IN operator: https://docs.splunk.com/Documentation/Splunk/latest/Search/Usetheinoperator Splunk Search Tutorials: https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial Hope this helps.     ... View more

can you try adding this below line to the end of your search? and give it a try? | noop search_optimization.predicate_push=f https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Noop#Managing_specific_search_optimizations_with_the_noop_command Hope this Helps. Karma would be appreciated.  ... View more

Hello @Cheng2Ready Are you on classic stack or Victoria stack? If you are on classic stack, we need to configure this inputs on the idm.  ... View more