Hello, I'd like my search to return 30 min interval searches between 9/24/2020 20:00 and the current date; what's the best way to do this?  I'm trying to investigate what is causing lockouts every six hours on Account_Name="johndoe"  Suggestions are greatly welcomed. index=* source=win* Account_Name=johndoe EventCode=4740   ... View more

Hello, Splunk is timing out after I try and use the export feature in UI.  There is quite a bit of data that needs to be exported.  Is there a way to keep it from timing out? ... View more

Hello I have a basic search that I am running from the following: index=sso This search returns a lot of events.  Within those log events, I would like to extract two pieces of  information and create fields for them both, they are: "saml:Issuer" AND "saml:Audience>https://" I'd then like to run a simple query against these two new fields index=sso sourcetype="pingfed*" table saml:Issuer saml:Audience>https:// What would be the most efficient way of doing this field extraction step-by-step? ... View more

Hi All, curious if anyone has any SPL that can track a particular domain's SSL certificate and where it's being used at?  Any help with this is GREATLY appreciated. Example: I need to know every place "exampledomain.com" SSL certificate is being used. Thanks again!    ... View more

I'm running the below query across the network and would like it to pinpoint that search towards two users rather than run the search across the entire network and have hundreds of users.  When I use the "where" clause and enter in both users that I'd like to search under, nothing comes back.  The moment I remove the "where" clause, data comes back.  Should my where clause positioned elsewhere up the pipe?  Or is it just a matter of incorrect syntax? | from datamodel:"Authenticate" | eval host=upper(host) | search [| inputlookup hosts_upper.csv] | search user!=svc* NOT src_user IN (system, dbagent, svc*) | search NOT signature_id IN (4769, 4672, 4648) | eval "Logon Type" = case(Logon_Type == 2, "Interactive", Logon_Type == 3, "Network", Logon_Type == 4, "Batch", Logon_Type == 5, "Service", Logon_Type == 7, "Unlock", Logon_Type == 8, "Clear Text", Logon_Type == 9, "New Credentials", Logon_Type == 10, "Remote Interactive", Logon_Type == 11, "Cached Interactive") | fillnull value=NULL "Unknown" | table _time action host user src app Logon_Type "Logon Type" host signature sourcetype | where user="johndoe" OR user="janesmith" | sort -_time ... View more

I'd like to add a filter to the Traffic Size Analysis Dashboard. The filter I'd like to add is the "src_ip" field. Currently, this dashboard doesn't allow you to search by one IP and I think having that filter would be very helpful. What would be the best way in going about and adding this? ... View more

Hello, I'd like to run an average over the course of May 16, 2020 (24-hours), on a particular IP address. I'd like to see an event count on this IP with an average overlay over the course of a 24-hour timespan on the indicated date above. Heres my base query: index=* "IP Address" |timechart count by src |sort -count Suggestions are greatly welcomed and very much appreciated. ... View more

Hello, I have a user that just needs to view a particular dashboard when logging into Splunk. I do not want him to have access to anything else, just the dashboard by default so that he can view and export panel metrics as needed. Is it possible to lock Splunk down this tight for a user? If so, how? ... View more

Hi as the title suggests, I am looking for some SPL that will show per index disk used by warm, cold, etc. buckets. Your input is greatly appreciated. ... View more

I've got a bit of a dilemma. I have created a dashboard under my Splunk user account. I'd like folks to see this dashboard on a separate big monitor on the wall. What would be the best way to deploy this? ... View more

Hi, last week, I had full administrative access with Splunk but opened Splunk this morning and it appears my role may have changed; I now have what appears to be limited visibility into the Settings menu, something to that a normal end-user role might see. Looking for some SPL that would detect if changes were made to my account, when those changes were made, what changes were made, and who made those changes. Any help with this is appreciated. ... View more

I'd like to pull a complete listing of all domain controllers in my environment and I'd like to do it through Splunk. Does anyone have some helpful SPL that can query the network for this? ... View more