All, We have mandatory compliance settings requiring certain GPOs to pushed. I'd like to have a Splunk dashboard for our evidence. So basically daily or so I want to pull the setting into Splunk. Any idea how I can do this? thanks! ... View more

All, I have a script which I'd like to capture the output from. I assumed that as long as I had it started by my splunkforwarder with an interval=0 it would run for ever and capture anything the script generates. But doesn't appear so. [script://./bin/spidertrap.py] interval = 0 index = main sourcetype = spidertrap source = spidertrap.py disabled = 0 The script source can be found here - https://github.com/omarkhan/spidertrap/blob/master/spidertrap.py I've verified that Splunk is running the script. If I run the script directly I get output to the console I expect. Any ideas? ... View more

All, I have need to make a "Red alert" noise on a dashboard when certain values flatline. ANy idea where I get started? ... View more

All, I've done this before but I am rusty. My log looks like this 1/2/2019 12:34pm priority=info soemthing=12 mydictionary={"iq":"123", "lovescars":"True"} Where mydictionary can as many as 30 elements in it. How do I get those into fields? ... View more

All, I have this indexes.conf and added a frozen archive. The path is fully readable and writable by the Splunk user account. But when I add this config stanza the indexer fails to start. Just starting with this so I am curious what area some areas I should check. ... View more

All, I have a relatively simple search but I am tripping over it for some reason. I want a pie chart of all hosts in my company. Any host with package="telnet*" as red and those without in blue. Any idea how I'd get that search working? ... View more

All, I just happened to notice that source=strea:Splunk_SSLActivity from Splunk stream isn't tagged with tag=certificate as I believe is outlined in CIM https://docs.splunk.com/Documentation/CIM/4.12.0/User/Certificates Is this an oversight/bug or am I misunderstanding the process on that? ... View more

All, Our developers need a lot of training just on producing solid log quality. Wondering if anyone has any formal training or books that we can recommend to them? ... View more

All, I have the host name, so I am looking for the IP of that host. Not sure how to do that. any help? -Daniel ... View more

All, I'd like to alert on process which have Netcat or nmap running for quick notable event. I can get one or the other. But not really both in the single query. I can't seem to find any sort of "OR" for the pivot language. | pivot Application_State Processes values(process) AS "process" SPLITROW dest AS dest FILTER process startsWith nc* Any ideas? ... View more

All, I am getting logs into an existing Splunk installation with index=wrong sourcetype=wayoutofdate that data needs to continue as is. There are users counting on those logs as they are . I'd like to send a second copy of these logs to a new set of indexers with index=correct sourcetype=correctsourctype I am not sure how to make the three transform changes without breaking what already exists off my heavy forwarders. Any help? ... View more

All, I indexed a 30-line config file off all our Linux hosts. But accidentally used the wrong source-type and index. So I deleted the delete with | delete. Now I need to reindex the file now that I have the correct inputs.conf configured. I thought it would as simple as adding crcsalt= and I'd be set. But it's not working. Any ideas? ... View more

All, I have a file just packed full of garbage. I really just want the first 96 characters of the file. I thought I could set TRUNCATE=96 on props.conf on my intermediate heavy forwarders and it would limit that to 96 characters, but that does not seem to the case. Any recommendations? What I might be missing? ... View more

All, I have a list of X hosts and another list of Y hosts. Seems to be Splunk should have an easy way to diff these. Any special commands or tools? ... View more

all, I am getting a dispatch count alert . Indexers and search heads have plenty of RAM, CPU and IO is almost nothing. I can't think of a reason for this to start to backup. Honestly the environment is under almost no load. My knee jerk here is to increase the jobs per CPU count. But wondering what others think here? Dispatch Command: The number of search artifacts in the dispatch directory is higher than recommended (count=6444, warning threshold=5000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf / dispatch_dir_warning_size. ... View more

All, I noticed that asset.csv auto lookup isn't happening with sourcetype=yum. Is there a special way to enable this on Splunk ES? Just a normal lookup? ... View more

All, I have enabled Splunk Stream on a single domain controller as a test to monitor the DNS traffic. It's largely went well but I am suprised to find I am not seeing the actually DNS query value. In the CIM I see query=* I also see that in Splunk TA DNS. Any idea why that isn't working on Stream? ... View more

All, Just really getting into Stream. Curious if you can think of any reason I would need apache logs when I can enable stream:http? If apache is encrypted of course, can stream read that? ... View more

All, How can I delete specific metrics? We have a GDPR concern that is preventing our metrics use cases. They are worried the metric name itself might be PAN/PII so until we have LUHN scanning of metric names and a way to delete we're kinda stalled. ... View more