You dont need to put it into an eval . If you use | rex ... | , the filename is a field that is created ... View more

You can look at creating an alert action script, as documented at https://docs.splunk.com/Documentation/Splunk/7.2.5/AdvancedDev/ModAlertsIntro You will need to write a Splunk query that identifies the hosts which are not responsive. At the end of the search, you want a list of servers. Save this search as an alert, then assign an alert action to it. Your alert action script will need to read a CSV file which contains your servers, then decide what you want to do with them. I suggest using something like ssh with pre-shared certificates, then doing ssh [email protected] /sbin/reboot . Just do that for each host that is listed in the CSV. Splunk also supported very basic alert action scripts, which I summarised at https://simonduff.net/splunk_alert_script/ . This has been deprecated, but still works. Alternatively, you can also look at Splunk Phantom. That has many more features, running advanced playbooks, etc... which is probably overkill for what you require. ... View more

You can create a dashboard using Simple XML, and include html in it. https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/PanelreferenceforSimplifiedXML#html The html could include bullet points or icons, whatever you like, and can include links to the dashboards. It would probably be a manual process to keep all your dashboards up-to-date however, but it can be done this way. ... View more

Once you use values() , your fields become multi-value. There are numerous functions that can be applied to these sorts of fields, check out https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/MultivalueEvalFunctions If you want to sort the data, use eval sorted=mvsort(data) . If you want the first 10 events, you can use eval first10 = mvindex(data,0,9) ... View more

Does the following return the expected results in your dashboard? (index="uno") OR (index="secundo" earliest=-36mon) | fields * |eval ID=coalesce(Incident_Number, IDno) |fields Closed_Date Incident_Number Description Up Overal IDno ... View more

rex field=file_path "(?<filename>[^\\]*)$" That should extract the last segment (i.e., the filename) from the file path ... View more

Refer to the documentation on the different search modes https://docs.splunk.com/Documentation/Splunk/latest/Search/Changethesearchmode Using the Fast mode The Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required. Disables field discovery. Field discovery is the process Splunk software uses to extract fields aside from default fields such as host, source, and sourcetype. The Splunk software only returns information on default fields and fields that are required to fulfill your search. If you are searching on specific fields, those fields are extracted. Only depicts search results as report result tables or visualizations when you run a reporting search. A reporting search is a search that includes transforming commands. Under the Fast mode you will see only event lists and event timelines for searches that do not include transforming commands. Verbose The Verbose mode returns all of the field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands. Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab. Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands Depending on how the fields you are interested in (Closed_Date Incident_Number Description Up Overal IDno) are determined/extracted, they may or may not be present in fast mode. If you use smart mode, you should get a good balance of speed and the fields you need. ... View more

Instead of dbxquery , why don't you use dblookup ? That will avoid you needing to do an expensive join ... View more

That page refers to a Independent Stream forwarder, which is a standalone server for Splunk stream. In cases where you need to capture a very large amount of traffic, this might be suitable. Otherwise, you can follow the process listed at https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream to install it on Windows or Linux,. ... View more

Yes, you can use Windows Server 2012R2 or later for Stream Forwarders. Note the caveats listed here. https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/InstallSplunkAppforStream#Windows_installation_considerations ... View more

Splunk Stream is supported on Windows Server 2012R2 or later (64-bit) https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/Deploymentrequirements#Supported_operating_systems ... View more

Chris has the right idea, use emojis! I have some examples using rangemap at https://simonduff.net/visualising_status_with_emoji/ . Answers isn't letting me post the sample code here 😞 ... View more

Hi, You need to use the resultArgs.setCount(0) function to return all results JobResultsArgs resultsArgs = new JobResultsArgs(); resultsArgs.setOutputMode(JobResultsArgs.OutputMode.JSON); resultsArgs.setCount(0); // set this to 0 to return all results InputStream results = job.getResults(resultsArgs); https://docs.splunk.com/DocumentationStatic/JavaSDK/1.0/com/splunk/JobResultsArgs.html#setCount(int) ... View more

Use the addtime option documented at https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Collect index="defaultdb_713" sourcetype="winnetmon" | collect index="webtest1004" sourcetype="WinNetMon" addtime=false ... View more

A useful regex for CVSS v2 is the following rex field=_raw "CVSS2#AV:(?<access_vector>\S)/AC:(?<access_complexity>\S)/Au:(?<authentication>\S)/C:(?<confidentiality>\S)/I:(?<integrity>\S)/A:(?<availability>\S)" so your search should look like source="scan*" | rex field=CVSSv2 "CVSS2#AV:(?<access_vector>\S)/AC:(?<access_complexity>\S)/Au:(?<authentication>\S)/C:(?<confidentiality>\S)/I:(?<integrity>\S)/A:(?<availability>\S)" | where confidentiality="H" ... View more

index=main OR index=syslogservers will search multiple indexes. index=* will search all the indexes you have permissions to search. The default index that a user searches is configured as part of their user account and role. Best practice is that you specify the index that contains the data you are after, rather than use index=* ... View more

In a search head cluster, the configuration is shared (and should be identical) across all search head cluster members. Thus, any app installed on a cluster member will be replicated to the others. ... View more

You will need to develop your own script to call the REST endpoints. Usually, this is done in Python, but you can use any language you like. If you configure this as a scripted input, the standard output of your script will be ingested by Splunk ... View more

rex field=_raw "Container: (?AppropriateRex) (?AppropriateRex) (?AppropriateRex),\{(?AppropriateRex)\}" | spath input=field3 |eval orig_raw = _raw | rename field4 AS _raw | extract | eval _raw = orig_raw ... View more

Yes, that is the major purpose of the REST API Splunk provides. Refer to https://docs.splunk.com/Documentation/Splunk/7.2.5/RESTUM/RESTusing which outlines how to authenticate to Splunk via REST, then use the sessionID to create a search, poll to check if it has finished, and then fetch the results once finalized. ... View more