Below may help.  For Linux : [monitor:///opt/splunk/var/log/splunk/temp.csv] index = main sourcetype = csv disabled = 0 crcSalt = <SOURCE>   For Windows [monitor://C:\splunk\var\log\splunk\temp.csv] index = main sourcetype = csv disabled = 0 crcSalt = <SOURCE> ... View more

Below may help | timechart span=1w count by Customer | eval week=strftime(_time, "%U") ... View more

Check if the below works. | makeresults count=10| streamstats count| eval TrustedLocation="Zscaler Miami III"| eval TrustedLocation=if(count%2=0,TrustedLocation,"otherdata") | search TrustedLocation!="Zscaler Miami III" ----------------------------------------- An upvote would be appreciated if the above reply is useful to you.   ... View more

We can create a scheduled search & save the results to separate index by using collect command in Splunk. https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Collect   ----------------- An upvote would be appreciated if the above comment helps. ... View more

This may help... Below will search in the lookup and pull the results when the ip is not available in lookup. | makeresults | eval field3="192.168.1.6", field4="hostname" | fields field3 field4 | dedup field3 | rename field3 as Source_IP | lookup ip_whitelist  IPAddresses AS Source_IP | eval InWhitelist=if(isnull(SubnetMasks),"Yes","No") | table Source_IP field4 InWhitelist SubnetMasks | where InWhitelist="Yes" ... View more

It seems the actual sourcetype is not WinEventLog.  The original sourcetype is "WinEventLog:Application". It is being renamed as wineventlog during the search time. Please find below the props.conf for renaming from the TA. [WinEventLog:Application] rename = wineventlog     ... View more

Mostly this could be firewall issue. Check the host firewall by connecting to destination server. From forwarder we can telnet to destination to confirm the same telnet indexer 9997 ... View more

Check the firewall communication. ... View more

Use  frozenTimePeriodInSecs parameter in index stanza.  https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Setaretirementandarchivingpolicy ... View more

This may help.. https://docs.splunk.com/Documentation/DBX/3.0.2/DeployDBX/Commands#procedure -------------------- An upvote would be appreciated if the above reply is useful to you.   ... View more

Yes it will. The precedence order will be of the below.  source host sourcetype https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Attributeprecedencewithinafile#Precedence_for_events_with_multiple_attribute_assignments --- An upvote would be appreciated if the above comment is helpful. ... View more

I presume this is coming from the learned app in Splunk. Splunk automatically stores the sourcetype in props.conf if it is not mentioned by default. Please check if the sourcetype is available in the learned app in both UF & indexer. $SPLUNK_HOME\etc\apps\learned\local\ ... View more

It might be configured in some other apps. Please check the value through btool. ./splunk btool indexes list _audit --debug | grep frozenTimePeriodInSecs ... View more

Yes, it is possible in UF that you can enable a UDP/TCP port and start receiving logs from network appliance. Check the firewall communication between network devices -- > UF --> Indexers. ... View more

This small sample script may help you. #!/usr/bin/bash mkdir /home/splunk/scripts/ cd /home/splunk/scripts/ echo "Please enter the start date of the required events in (mm/dd/yyyy hh:mi:ss)?" read Startdate #Startdate="02/13/2020 00:00:00" st_epoch=$(date -d "${Startdate}" +"%s") echo "Please enter the end date of the required events in (mm/dd/yyyy hh:mi:ss)?" read enddate #enddate="02/13/2020 18:00:00" ed_epoch=$(date -d "${enddate}" +"%s") echo "Please enter the Index Name?" read index ed_epoch=$(date -d "${enddate}" +"%s") #enter your frozen bucket path below find /opt/splunk/$index/frozendb/db_* -maxdepth 0 -type d > idx.txt while read line do #set the delimeter as per the frozen path file_st=$(echo $line | cut -d'/' -f6 | cut -d'_' -f3) file_ed=$(echo $line | cut -d'/' -f6 | cut -d'_' -f2) if [ $file_ed -lt $ed_epoch -a $file_ed -gt $st_epoch ] || [ $file_st -lt $ed_epoch -a $file_st -gt $st_epoch ] then echo "$line" >> /home/splunk/scripts/backup_temp.txt else if [ $file_st -le $st_epoch -a $ed_epoch -le $file_ed ] then echo "$line" >> /home/splunk/scripts/backup_temp.txt fi fi done < idx.txt ... View more