Hi Team, Our Splunk Search heads are hosted in Cloud and managed by Support and currently we are running with the latest version (9.1.2308.203).   This pertains to the Max Lines setting in the Format section of the Search and Reporting App. Previously, Splunk defaulted to displaying 20 or more lines in search results within the Search and Reporting App. As an administrator responsible for extracting Splunk logs across various applications over the years, I never encountered the need to expand brief search results, to read all lines. However, in the recent weeks, possibly following an upgrade of the Splunk Search heads, I've observed that each time I open a new Splunk search window or the existing Splunk tab times out and auto-refreshes, the Format > Max Lines option is reset to 5. Consequently, I find myself changing it after nearly every search, which has become cumbersome. Therefore, Kindly guide me on how to change  the default value to 20 from 5 in the Search and Reporting App on both Search heads? This adjustment would alleviate the challenge faced by most of our customers and end-users who find it cumbersome to modify it for each search. So kindly help on my requirement. ... View more

Hi Team, Want to mask two of the fields "password" and "cpassword" from the events which are getting written with the plain text information. So needs to be changed as #####. Sample event information:   [2024-01-31_07:58:28] INFO : REQUEST: User:abc CreateUser POST: name: AB_Test_Max;email: xyz@gmail.com;password: abc12345679;cpassword: abc12345679;role: User; [2024-01-30_14:05:42] INFO : REQUEST: User:xyz CreateUser POST: name: Math_Lab;email: abc@yahoo.com;password: xyzab54;cpassword: xyzab54;role: Admin; So kindly help with the props.conf so that i can apply with SEDCMD-mask. ... View more

Hi Team,  I have created a dashboard with the below mentioned query and the output would be in Column chart format with a timer. And the output would display the Top 10 Event Codes with Count when we choose the time and click submit. index=windows host=* source=WinEventLog:System EventCode=* Type=Error OR Type=Critical | stats count by EventCode Type |sort -count | head 10 So post the results are displayed in the Column chart then my requirement is that if we click any one of the EventCode  consider as an example of 4628 from the Top 10 details in the Column Chart then it should  navigate to a new panel or a window showing up with the Top 10 host, source, Message, EventCode along with Count for Event Code 4628. So something like that we want to get the results displayed.  But this should happen if we click the EventCode from the Column chart of the existing dashboard. Example: index=windows host=* source=WinEventLog:System EventCode=4628 Type=Error OR Type=Critical | stats count by host source Message EventCode |sort -count | head 10   So kindly let me know how to achieve this requirement in a dashboard format.   ... View more

This below mentioned lines are coming as a single event and not as separate events. So we want to get them splitted i.e.. It starts with IP and the end would be with Email field so after which it needs to be a separate next  event. IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 15:10:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/98765_3598/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 17:12:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/1234_9564/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 18:10:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/9821_365/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 20:10:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/222_123/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com SO kindly let me know how can be get them splitted into separate events. ... View more

Our objective is to integrate OpenTelemetry into a new project and establish a connection with Splunk. We are specifically interested in initiating the transmission of OpenTelemetry (otel) data to Splunk. OpenTelemetry is capable of generating traces, metrics, and logging data tailored for services. Currently, our focus is directed towards collecting telemetry data for a single service stack. However, if this proves successful, we are open to expanding and incorporating additional services in the future. To facilitate this integration, we are utilizing the OpenTelemetry Collector, a crucial component of the OpenTelemetry project and a freely available open-source tool. Although Splunk offers its version, we are presently not utilizing it. We seek confirmation that there are no associated costs for using the OpenTelemetry Collector, considering its contribution to OpenTelemetry, where vendors extend the functionality. Furthermore, our Splunk infrastructure, including the Search Head, Cluster Master, Indexers, and License Master, is hosted in the Cloud and managed by Splunk Support. As a Splunk Administrator, I am interested in understanding how to configure and onboard OpenTelemetry logs into Splunk. However, we are seeking clarification on potential costs and efforts associated with this initiative. Is it a separate subscription or something similar, as I currently lack information on this matter? Kindly assist in checking and providing an update. ... View more

Hi All, Our Splunk infrastructure, encompassing the Search Head, Cluster Master, Indexers, and License Master, is situated in the Cloud and managed by Splunk Support. Recently, there was a request from one of our application teams to integrate and ingest MongoDB Atlas (Host & Audit) logs into Splunk. Following the provided documentation, the application team attempted to install the Splunk OpenTelemetry (otel) connector on a Linux VM for a Proof of Concept (POC). In the process, they requested the generation of a token, which I fulfilled by generating one from our Splunk Cloud Search head. Unfortunately, the attempted integration did not yield the expected results. I am now seeking clarification on whether the token generated from the Splunk Search head is adequate, or if there is a need to generate an Organizational access token. If the latter is necessary, I would appreciate guidance on where and how to generate it. As the administrator of our Splunk Cloud instances, I am curious about the role of Splunk OpenTelemetry and whether it is included with Splunk Cloud. We receive multiple requests from users wanting to send OTEL logs into Splunk. If Splunk OpenTelemetry is indeed included, I would appreciate guidance on generating the organizational token and where this process should take place.   https://docs.splunk.com/observability/en/gdi/opentelemetry/components/mongodb-atlas-receiver.html https://docs.splunk.com/observability/en/gdi/opentelemetry/collector-linux/install-linux.html#otel-install-linux https://docs.splunk.com/observability/en/admin/authentication/authentication-tokens/org-tokens.html#admin-org-tokens   As I examine the documentation, it explicitly mentions Splunk Observability. I seek confirmation that I am following the correct procedure. The user attempted the installation using the same base64-encoded access token, but unfortunately, the result was once again unsuccessful. Additionally, the user has confirmed that there is internet access from the VM. At this juncture, we require guidance on how to generate an "organizational access token" to facilitate the integration process.   Can anyone kindly check and guide me on this please.     ... View more

Hi All, Our Splunk infrastructure, including the Search Head, Cluster Master, Indexers, and License Master, is hosted in the Cloud and managed by Splunk Support. We are currently in the process of integrating the ZenGRC tool with Splunk. On the ZenGRC tool side, there is a Splunk connector. I have created an account using the Splunk authentication method, with admin privileges. Following the documentation, when I attempted to connect to Splunk via the Connectors section in ZenGRC, I encountered an error message: "Failed to Connect: Unknown error." https://reciprocitylabs.atlassian.net/wiki/spaces/ZenGRCOnboardingGuide/pages/562331727/Splunk+Connector    For reference, the ZenGRC documentation providing information on the Splunk Connector can be found above. When configuring the ZenGRC end, three pieces of information are required: Splunk Instance API URL: https://[yourdomain].splunkcloud.com:8089 UserName/Email: xxx Password: yyy   Upon attempting to connect, the process fails. Additionally, I have whitelisted the IPs as indicated in the confluence documentation. Kindly provide guidance on resolving this issue. IP Whitelisting - ZenGRC Wiki - Confluence (atlassian.net)       ... View more

Hi Team, Our Splunk is hosted in Cloud. And my requirement is that if an index is getting created then i need to get an alert and similarly if an index is getting deleted from the Search head i need to get an alert. So kindly help with the query.   ... View more

Hi Team, We have opted for 250 GB of licensing on daily basis.  So if the license is reaching more than 70% (i.e. 175 GB) i need to get an alert similarly if the license is getting reached 80% and more (i.e. 200 GB) then i need to get another alert. And finally if it crossed more than 90% (i.e. 225 GB) i need to get another alert.   So can you help me with the Search query. ... View more

Hi All, Need a help to write a query based on the field "Timestamp" which is different from "_time" value. Sample Event in XML Format: Email: xyz@gmail.com RoleName: User RowKey: 123456 Timestamp: 2023-12-13T23:56:18.200016+00:00 UserId: mno UserName: acho This is one of the sample event in xml format and there is a specific field as "Timestamp" in the event and this "Timestamp" field is completely different from _time value. Hence I want to pull only the "Timestamp" value for a particular day might be yesterday 2023-12-13 i.e. from 2023-12-13 00:00:00 to 2023-12-13 23:59:59 So how can I write the query for the same. index=abc host=xyz sourcetype=xxx ... View more