I want to get events from below powershell input. inputs.conf [powershell://power_shell_sapmle] script = . "$SplunkHome\etc\apps\sample_app\bin\sample.ps1" schedule = */1 * * * * sourcetype = power_shell_sapmle sample.ps1 $Output = invoke-expression "wmic cpu list brief" Write-Output $Output But, the event is divided and outputted line by line, even if I configured props.conf in Indexer like below. props.conf [power_shell_sapmle] DATETIME_CONFIG = CURRENT SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = false MAX_EVENTS = 1000 BREAK_ONLY_BEFORE = "NEVER_BREAKE_LINE" How can I merge these events to 1 event? Please someone help me. *additional info Output event of this powershell input like below. ... View more

Splunk ver : 6.6.6 OS : Linux 7 Universal Forwarder ver : 6.6.6 OS : Windows Server 2016 I configured below inputs.conf and sample.ps1 in the Universal Forwarder and Splunk indexed once, but after that, no more events were indexed. inputs.conf [powershell://power_shell_sapmle] script = . "$SplunkHome\etc\apps\sample_app\bin\sample.ps1" interval = */1 * * * * sourcetype = power_shell_sapmle sample.ps1 $Output = invoke-expression "wmic cpu list brief" Write-Output $Output Is my configuration wrong? Please someone help me. ... View more

When I update Splunk to ver 7.2.3 from before ver 7.2.2(like 6.6.x) and enable boot-start, unit file is created under "/etc/systemd/system/", but "/etc/init.d/splunk" is still remaining. In such a case, what is the recommended method? Just by deleting "/etc/init.d/splunk" does not matter? I can't find description about case like this in install manual, so if someone knows about it, please tell me. ... View more

OS : Amazon Linux 2 Splunk Ver : 7.2.3 In Splunk before ver 7.2.2, there is start script in /etc/init.d , so I was adding commands to the file like below. splunk_start() { echo Starting Splunk... ulimit -n 64000 ulimit -u 16000 if test -f /sys/kernel/mm/transparent_hugepage/enabled; then echo never > /sys/kernel/mm/transparent_hugepage/enabled fi if test -f /sys/kernel/mm/transparent_hugepage/defrag; then echo never > /sys/kernel/mm/transparent_hugepage/defrag fi if test -f /sys/kernel/mm/redhat_transparent_hugepage/enabled; then echo never > /sys/kernel/mm/redhat_transparent_hugepage/enabled fi if test -f /sys/kernel/mm/redhat_transparent_hugepage/defrag; then echo never > /sys/kernel/mm/redhat_transparent_hugepage/defrag fi But in Splunk after ver 7.2.2, if Splunk detect systemd , it makes unit files to run splunkd service, and there is not start script in /etc/init.d . So I added options ExecStartPre , LimitNOFILE , LimitNPROC to unit file /etc/systemd/system/Splunkd.service , and I could change ulimit and disable THP. ExecStartPre=/bin/sh -c "echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled && echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag" ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd LimitNOFILE=64000 LimitNPROC=16000 *Answers I referred https://answers.splunk.com/answers/590209/rhelcentos-7-systemd-not-honoring-ulimits.html Anyway, I want to know whether this way is best, OR is there another best practice reccomended by Splunk? ... View more

There are descriptions on managing orphaned knowledge objects after deletion of users, for reasons such as change of operator in the following manuals. http://docs.splunk.com/Documentation/Splunk/7.2.1/Knowledge/Resolveorphanedsearches And It has the following description in it. -----Manual reference----- The Reassign Knowledge Objects page, in Settings, is the only orphaned knowledge object detection method that can find all orphaned knowledge object types. It can only find orphaned knowledge objects that have been shared at the app or global levels. In other words, knowledge objects with private privileges can not be found. However, if a knowledge object is with privileges of app or global , admin can see it and can also change the authority of it. Even if only the role of deleted user is set to allow read and write . If so, what is this function for? Also is there way to discover orphaned objects with private privileges from Splunk Web and reassign them to some other users? I would appreciate it if you let me know. ... View more

I know that Splunk doesn't support monitoring of encrypted data. But I want to know what happens when Splunk tries to monitor encrypted archive data, because I think that there is a possibility that Splunk accidentally monitored encrypted archive data when I configure dir monitoring. In whatever form (collapsed etc.), does Splunk capture those data? Are there any effects to performance? Can I detect monitoring of encrypted data from internal log or other some information? If someone knows about it, please tell me. ... View more

My environment : splunk stand-alone ver7.1.4 *I found same phenomenon in ver7.1.3 I executed search below by using two lookup tables .(*I attached them to this page.) | inputlookup test_lookup_2.csv | lookup test_lookup_1.csv key OUTPUT service as a | mvexpand a | eval a=if(a=service, null(), a) | eval _time=now() | transaction row_num | stats count by a Then, when I search it in fast mode and smart mode , Splunk returns No results found. But when I search it in verbose mode , splunk returns results normally! Also, if I add | noop search_optimization = false to the last line of this and do a search, the result will be returned normally regardless of the search mode! Why is this difference caused? This behavior is too weird as specification, so I think that it is issue. If someone know about it, please tell me. ... View more

In my environment, there are search head cluster , indexer cluster , and heavy forwarders . If I want to install Splunk DB connect v 3.x.x, should I install it to the heavy forwarders? Or I can't install it to peer of indexer cluster ? Also, when I install it to heavy forwarder, is there settings of redundancy like active standby? If someone knows about this, please tell me. ... View more

Splunk ver : 7.1.2 When I use the map command, if argument that pass to map is string, results are never displayed. But, if argument is int or string that contains space, then it works! Below search is examples. * Since it is a sample, it is weird search, but please do not mind. Not working case: | makeresults count=3 | eval field1="test" | table field1 | map search="| stats count | fields - count | eval map_field1=$field1$ | table map_field1" Working case1: | makeresults count=3 | eval field1=111 | table field1 | map search="| stats count | fields - count | eval map_field1=$field1$ | table map_field1" Working case2: | makeresults count=3 | eval field1="this is test" | table field1 | map search="| stats count | fields - count | eval map_field1=$field1$ | table map_field1" Is this specification, or issue? *if it is, I'm so sorry. Please someone tell me. ... View more