Hi Team, i have observed a strange behavior. Actually we had 'Splunk add-on for AWS' installed in IDM cloud node and indexers. Recently we asked Splunk cloud team to get the add-on installed on Search Heads as well. Post installation on SHs, we didn't get any alert/notable triggered for AWS which was there. We simply disable that add-on on SH and it started working. What could be the possible issue?   Thanks   ... View more

Hi SMEs, What should be the MemoryLimit value for *nix UF max? I think usually UF takes max to 5% of the memory for normal input config and processing however customer don't want to be messed up in worst scenario where UF is eating all memory. Thanks ... View more

Hi,   There is constant time diff (_indextime - _time) from few windows server as below, not sure what causing this and how to fix it   ... View more

Hi SMEs,   I need to configure UF to restrict not to collect logs older than X Days. Is it feasible than how? Also what is the best practice for no of days to configure here?   Many thanks  ... View more

Hi ,   Is there a way to migrate current running config from local account to some other account (AD)? How to accomplish the same ... View more

Hi SMEs, i have quick query here. While searching DHCP logs i could see huge latency (indextime -time) for few events , rest all looks ok. sharing two consecutive event logs with minimal and max latency reported. Any clue. Event collection is through UF here ... View more

Here i am having AWS data collecting through IDM on Splunk cloud. I need to route certain data basis on some regex pattern to other index. Is this feasible from GUI. If yes plz suggest. Many thanks in advance  ... View more

Hi Team, We could see paloalto network add-on parsing informational messages to alert datamodel (having tag=alert) assigned. Sharing the snap-shot for ref. Can anyone assist me to identify & some business justification behind this please. Thanks in advance    ... View more

We have below CEF logs coming in from the device where few field doesn't have any value like cs2 below   CEF:0|vendor|product|1.1.0.15361|6099|DirectoryAssetSyncSucceeded|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=16699 cs3label=AssetName cs3=ABC.LOCAL AD cn3label=AssetPartitionId cn3=7 cs4label=AssetPartitionName cs4=XYZ.LOCAL partition cs5label=TaskId cs5=9ec9aa87-61b9-11ec-926f-3123456edt   How can we assign 'NULL' value to such field using SEDCMD or any other possible way here? ... View more

We need to capture field value for the below CEF log pattern  CEF:0|vendor|product|1.1.0.15361|6099|DirectoryAssetSyncSucceeded|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=16699 cs3label=AssetName cs3=ABC.LOCAL AD cn3label=AssetPartitionId cn3=7 cs4label=AssetPartitionName cs4=XYZ.LOCAL partition cs5label=TaskId cs5=9ec9aa87-61b9-11ec-926f-3123456edt   I am using the below regex  (?:([\d\w]+)label=(?<_KEY_1>\S+))(?=.*\1=(?<_VAL_1>[^=]+)(?=$|\s+[\w\d]+=)) Unfortunatelly it is not taking the blank one, like cs2= , which doesn't contain anything so EventUserDomainName should be blank    Kindly suggest  ... View more

Hi SMEs,   I am trying to write regex to parse/map CEF format fields as below. so that all corresponding fieldname can capture values, i am not able to capture values having spaces in between. Seeking suggestion. Attached snap shot for ref. regex101 c[n|s]\dlabel\=(\w+).*?c[n|s]\d\=([\.a-zA-Z0-9_-]+)   CEF:0|vendor|product|1.1|1234|PolicyAssetUpdated|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=20888 cs3label=AssetName cs3=ABCDPQRS.domain.com cn3label=DirectoryId cn3=856 cs4label=DirectoryName cs4=Active Directory cs5label=DomainName cs5=domain.com ... View more

Hi SMEs, We need to split event logs into 2 different indexes (index_1 & index_2) which is coming to index_1 only as of now.   FYI - The log source is on AWS cloud and we are using add-on to get those logs through inputs. ... View more

  We have logs coming in from one of the source in CEF format. How to deal CEF Format data parsing in Splunk so that it get auto converted in field value pair. Post that i could alias those fields basis on my datamodel need. Kindly suggest. Thanks in advance   ... View more

what should the best regex to catch it up these 3 diff fields    -ec-1 -ec-01 -ec01 ... View more