Hi ayush8878, try this: ( source="/opt/jboss/jboss-fuse/data/log/fuse.log" "Audience value in the JWT is" ) OR ( source="/opt/jboss/jboss-fuse/data/log/access_log" ("path=/rest/cases/" "filename*=")) | eval filename=if(isnotnull(filename), filename, "none") | stats values(*) AS * by breadcrumbid filename Hope this helps ... cheers, MuS ... View more

Hi ryangillan, read about this use case in this blog post https://www.duanewaddle.com/proving-a-negative/ it will show and explain how you can use Splunk to search for something that is missing or not has been updated and there no longer has new events. Hope this helps ... cheers, MuS ... View more

Hi mayurr98, see the docs https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020#Upgrade_Splunk_platform_instances_to_a_version_with_an_updated_version_of_datetime.xml to get a table of the Splunk versions. cheers, MuS ... View more

Hi cald0002, Give this a try: (SPL to get events from index 1) OR (SPL to get events from index 2) | stats values(hostname) AS hostname by ip You might need to adapt the query to match the hostname and ip fields according to your events. hope this helps ... cheers, MuS ... View more

Update Looks like I'm not good in error capturing, the endpoint actually reloads - you can see it in the debug logs. But something after the reload makes the script think there was an error .... oh well debugging time ¯\_(ツ)_/¯ cheers, MuS ... View more

Hi robertlynch2020, enable debugging like in the documentation written: Debug If needed you can enabled debugging to splunkd.log in the script refresh.py by setting myDebug='yes' on line 6 If this does not provide any useful message, try running the script from the CLI like this: $SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/etc/apps/TA-debug-refresh/bin/refresh.py Hope this helps ... cheers, MuS ... View more

Hi robertlynch202, I would not recommend to grant users access to the | refresh command for various reasons like it reloads entities that could cause event loss or restart scripted/modular inputs. Like the description of the app states The intention / reason for this app is to reload changed configs on the fly so you can **test and validate** them. you should only use it on Dev/Test systems and not in prod. If you still think your users need access, then there is no other way than doing the tests yourself what capabilities they need to run the command. Hope this helps ... cheers, MuS ... View more

Hi bpladna81, Keep your rsyslog server for the syslog collection and install an universal forwarder on the same server to monitor the files the rsyslog server creates. Some good background information is available here http://www.georgestarcher.com/splunk-success-with-syslog/ Hope this helps ... cheers, MuS ... View more

In this case the error message actually tells you what to do 😉 10-23-2019 00:30:50.477 +0000 ERROR PersistentScript - From {/opt/splunk/bin/python /opt/splunk/lib/python2.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py:846: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings cheers, MuS ... View more

Well, it come all down to two options: accept the fact that you will loss events if you enable the SSL verification and something happens in Azure which invalidates the certificate accept the less secure connection when not verifying the certificate but continue to get events even something happens in Azure which invalidates the certificate cheers, MuS ... View more

Hi mgbersales, Please read this great post of @dwaddle https://www.duanewaddle.com/proving-a-negative/ that covers exactly this topic. Hope this helps ... cheers, MuS ... View more

Hi lucas4394, without knowing the order those fields will be extracted it is hard to tell what the issue is. I would try the regex on _raw and also use a completely new field name like MyNewUser so it will be unique while you are testing. Once it works, disable the original user extract and modify yours so it will extract the user field from _raw . Hope this helps ... cheers, MuS ... View more

Updated version on https://github.com/M-u-S/TA-maclookup available, apps.splunk.com will take a few hours/days 😉 cheers, MuS ... View more

Hi staten, Sorry for the late reply. Not at the moment, but I can add something like this in a later version. Hope this helps ... cheers, MuS ... View more

Sorry I missed that question in the first place 😞 I will have a look today cheers, MuS ... View more

blank lines are no problem at all in Splunk configuration files 😉 cheers, MuS ... View more

When you change settings in the Splunk web UI, it will modify config files in the background - so in the end both approaches are doing exactly the same. ... View more

Okay to me that sounds like a bug in the mscs_checkpointer.py script, because you should only have the latest checkpoint in that file and not a list of checkpoints. Haven't checked very deeply but it sounds like it does an append instead of a replace in the checkpoint file. Hope this helps ... cheers, MuS ... View more

In the log.cfg search for the appender.xyz.maxFileSize or appender.xyz.maxBackupIndex options for some examples. cheers, MuS ... View more

Hi captcha, you can create a $SPLUNK_HOME/etc/log-local.cfg and add a log rotation configuration for that log file. Use the $SPLUNK_HOME/etc/log.cfg file as example. Find some basic information about the log management process here https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/WhatSplunklogsaboutitself#The_log_management_process Hope that helps ... cheers, MuS ... View more

Hi edoardo_vicendone, try something like this: | makeresults | eval A="test;sample;example", B="test;sample;example;check" | makemv delim=";" A | makemv delim=";" B | mvexpand A | mvexpand B | stats values(A) AS A by B `comment(" Everything up til here creates events, please ignore ...")` | eval C=if(B!=A, B, null()) The first 8 lines create, prepare the dummy events and the last line does the actual comparison of field A and B and puts the result into the new field C . The important part of the SPL is line 4-7 where I create the multi value fields and split them so we are able to compare the values. Hope this helps ... cheers, MuS ... View more

Hi Bentash, If I recall it correct this (using an unverified SSL connection) was done to prevent data collection issues in case of any SSL certs issues in o365/Azure. It tells you that the SSL certificate is not validated. Long story short, this is not really an error more a warning and should be reported as such like the actual python error tells you it is just a warning : InsecureRequestWarning Hope this helps ... cheers, MuS ... View more