My environment: Splunk Ver : 7.2.3 When I used the bin command to wrap _time , I found that value was weird like the below capture. it only shows the year, month, date. Apparently, if you set the span to 30 minutes, or if you use minspan, it seems to be happening. I confirmed this event in 7.1.4 too. Is this a specification? Or is it a problem? ... View more

I think both of these function can output alert's result to index. Then, is the difference only these? 1. "summary index" is not related to license calculation.(But "Log Event" is related to it.) 2. "Log Event" can output event data to other splunk instance.(But "summary index" can't.) ... View more

When I want to update lookup using search like below, it updates lookup table even if there is no results, but I want to avoid it. ~ | outputlookup sample.csv So, I was thinking that I can do it by using macro, and configured like below, but it didn't work. Definition outputlookup sample.csv Arguments arg Validation Expression isnotnull($arg$) Validation Error Message result is null ! For example, in the sample search shown below, the field "result" is passed to the macro and the field is null, so I thought that I would get an error, but I did not get an error. | makeresults count=1 | macro(result) How can I do it? If someone know about it, please tell me. ... View more

I want to add AS number to ip by using some geo data. This data has column AS number and network like below. AS_number,network xxxxx,10.0.0.0/24 I uploaded this data as lookup, and configured lookup definitions with CIDR(network) . Then I tried some ip addresses like below, but it didn't work. | makeresults count=2 | streamstats count as c | eval network=if(c=1,"2001:4860:4860::8844","216.58.197.131") | lookup Geo_AS_Lookup network OUTPUT So I extracted only the lines with the following two networks matching the test addresses, and created a lookup table and lookup definition newly. AS_number,network xxxxx,2001:4860:4840::/42 yyyyy,216.58.192.0/19 Then it began to match well. I wonder is there result limit of lookup?(* Because this lookup has about 440000 rows.) If someone knows about it, please tell me. additional info Apparently the size is more concerned than the number of rows. I made two pieces of data as below and found that the size of less than 10 MB matched well. sample_geo.csv 27MB (500000 rows with 3 columns) sample_geo_2.csv 8.95MB (500000 rows with 2 columns) ... View more

I want to configure routing that sends specific logs( syslog_test ) to only 514 and other logs to 9997, so I edited props.conf , transforms.conf , outputs.conf of HF like below. props.conf [syslog_test] TRANSFORMS-routing = syslogRouting DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = custom disabled = false transforms.conf [syslogRouting] REGEX=. DEST_KEY=_SYSLOG_ROUTING FORMAT=syslogGroup outputs.conf [tcpout] defaultGroup=everythingElseGroup [tcpout:everythingElseGroup] server=Indexer's IP:9997 [syslog:syslogGroup] server=Indexer's IP:514 But HF forwards syslog_test to 514 and 9997. What is wrong? Could anyone tell me? ... View more

My environment: Splunk 7.2.3 When I do the following search, the result is truncated. search-1 | makeresults count=1 | eval num="123456789123456789123456789" | stats max(num) result-1 max(num) 123456789123456790000000000 search-2 | makeresults count=2 | eval num="123456789123456789123456789" | eval num2=num+num result-2 num2 246913578246913580000000000 How can I avoid this? ... View more

My environment : Splunk Indexer : 7.2.3 on Linux7 Splunk Deployment Server : 7.2.3 on Linux7 Universal Forwarder : 7.2.3 on Linux7 I configured that Deployment Server deploys below inputs.conf to universal forwarder(UF). [script//./bin/sample.sh] interval = 14 12 * * * index = sample_index source = sample.sh sourcetype = sample disabled = 0 Everyday, the UF kicks this script that runs "cat" to file(* about 7MB), and forwards result to Indexer. However, sometimes the UF ignores the setting of "interval" and tries to do this script input many times (* dozens times etc.), and is causing duplicates on the Indexer. Why does this happen? If anyone knows a similar event, please tell me. ... View more