If you have access to back-end (SSH access to Splunk search head), you can find Splunk alerts in below configuration file(s). $SPLUNK_HOME/etc/apps/<appname>/local $SPLUNK_HOME/etc/users/<username>/<appname>/local ... View more

Assuming field1 is the common field among indexes and lookup file, try below query. index=index-1 | join field1 [ search index=index-2 | table field1 | search [| inputlookup mylookup.csv | table field1] ] ... View more

How do you verified that logs come from Syslog sender are well received? What Splunk configuration performed? Is the UDP port open (in Splunk) for the syslog servers? ... View more

Try to increase the logging level and check the internal logs ( splunk_app_db_connect*.log ) to troubleshoot the issue. Log configuration URL: http://splunk-host:8000/en-GB/app/splunk_app_db_connect/configuration#/settings/logconfiguration ... View more

The error is due to missing *.conf.spec file under README folder of corresponding apps under /opt/splunk/etc/deployment-apps directory. Try below steps to validate your apps under /opt/splunk/etc/deployment-apps cd /opt/splunk/etc/ mkdir deployment-apps-for-btool cd deployment-apps-for-btool ln -s /opt/splunk/etc/deployment-apps apps /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps-for-btool/ | grep 'No Spec file' Reference: https://docs.splunk.com/Documentation/Splunk/8.0.1/Troubleshooting/Usebtooltotroubleshootconfigurations ... View more

What's the output of './splunk btool check' command? Did you make changes to $SPLUNK_HOME/etc/system/default/web.conf file? What's are the errors you can see in 'splunkd.log' file? ... View more

Glad, it worked out for you. Can you upvote and accept the answer if it's helped you? Thanks. ... View more

Thank you.. It worked for me. ... View more

You should assign the edit_lookup capability to 'ess_analyst' role under Access controls->Roles->ess_analyst as shown in below snapshot. ... View more

In my case, the header line was having 'tab' character. After replacing the 'tab' characters with 'space' characters, the field extraction worked. ... View more

Can you share the Python snippet where you use the regex? ... View more

Where do you see below remark? " src_user is recommended field for the Authentication datamodel" ... View more

Thanks. I have resolved the issue by adding below config in props.conf in indexers (followed by indexer restart) to parse the timestamp properly in the log file (dns.log). DATETIME_CONFIG = TIME_FORMAT = %d/%m/%Y %I:%M:%S %p TIME_PREFIX = ^ ... View more

Thanks. Can you specify the parameter name in the 'inputs.conf' that need to be modified to limit the amount of data flowing in? ... View more

Thanks. Can't we use below one? https://<splunk-base-url>/en-GB/debug/refresh?entity=admin/health-report-config ... View more

Based on your response (Threatname field has non-NONE values. But all the values in dlpdictionaries has NONE value.), it makes sense now. FIELDALIAS-aob_gen_zscalernss_web_alias_4 = threatname AS signature FIELDALIAS-dlpdictionaries_as_signature = dlpdictionaries AS signature As per the above sequence in your props.conf , 'dlpdictionaries' NONE value overwrites the NON-NONE values of 'threatname' field. Based on your use-case, you can either reverses the oder of FIELDALIAS configuration as below or you can use different FIELDALIAS name (as you figured it out). FIELDALIAS-dlpdictionaries_as_signature = dlpdictionaries AS signature FIELDALIAS-aob_gen_zscalernss_web_alias_4 = threatname AS signature ... View more

Do you see the threat intelligence files in the directory that is mentioned the 'Threat Intelligence Management' - Data Inputs page? Eg: In '$SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/local/data/threat_intel' directory. ... View more

Can you elaborate your requirement with little more details? Is the data ingested into Splunk from all 20 domain controllers? And are the fields are extracted and normalized as per CIM standard? ... View more

@gdigrego If my answer helped you, please accept and/or upvote it! ... View more

@prajapatividhyut2 If my answer helped you, please accept and/or upvote it! ... View more

@rhoush If my answer helped you, please accept and/or upvote it! ... View more

What's your basic search? Is your lookup table has headers? ... View more

Can you post the content of [triggers] stanza? ... View more