Hello, It is missing a \ after the name and before the ". The correct one is: | rex mode=sed "s/\"name\":\s\"[^\"]+\"/"name":"###############"/g" ... View more

Hello @an , You could do the following to troubleshoot this issue: 1 - Download the Universal Forwarder app from your Splunk Cloud trial instance and install it on /opt/splunkforwarder/etc/apps (If you not already installed this app). 2 - Verify the permissions of the files that you added on the monitor path (if the user that is running Splunk can read/execute these files). 3 - Verify if the monitor configs are correct and an index is being defined on the monitor stanza. 4 - Run splunk btool check command to check for any typos on .conf files. 5 - Restart the Universal Forwarder (The changes on the Universal Forwarder are only applied after a restart). 6 - Search for index=_internal host=<your_uf_host> on Splunk Cloud trial to verify if internal logs are being indexed. If the internal logs are being indexed, search for the index that you configured your monitor on the step 3. 6.1 - If there are internal logs from your instance but there are no logs on your index, there is an error on the configs of this input. 6.2 - If there are no internal logs, the error could be related to a firewall issue that you could try to troubleshoot on the UF log files (search for an error that shows that you cannot connect to the Splunk Cloud): cat /opt/splunkforwarder/var/log/splunk/splunkd.log | grep -i ERROR   Thanks. ... View more

Hello @Gregski11 , The role that you are saying is the Monitoring Console role or the Deployment Server actually acting as a Search Head? In the first case, only the Search Heads should have the Search Head role. In the second case, it is not recommended because if the DS have many clients phoning home, searches could overwhelm this instance.   Thanks. ... View more

Hello, To use a Heavy Forwarder as an intermediate tier, you should listen to the port that the data is being sent from the UF/HF (usually 9997) and configure the correct outputs to the Indexer tier. The first HF should also have the outputs configured to the second HF and the Indexer tier should listen to the inputs port (9997) too. Also, the data is not indexed on the second HF, only on the Indexing tier the data is indexed.   Thanks.   ... View more

Hello @madhukar3us , Could you please provide more information? Are these values on the same field? Could you also share some log samples?   Thanks. ... View more

Hello @krishnabv , which endpoint are you using to create these ports on Splunk Cloud? It should not be allowed to create TCP/UDP inputs on Splunk Cloud since it only accepts connections from forwarders that have the correct SSL certificates and if you want to send data via TCP/UDP sources you should use a forwarder. ... View more

Hello @Vineedee , could you please post the error that you are facing? Maybe a firewall rule is blocking your access to download splunk apps from splunkbase. ... View more

Hello, Please, try that:   [replicationBlacklist] block_suds_mx_files = apps/XYZ/bin/suds/mx/*.(py$|pyc$) block_suds_files = apps/XYZ/bin/suds/*.(py$|pyc$)   ... View more

Hi, The commands are the following: - Stop Splunk: splunk stop - Restart Splunk: splunk restart You should be on the following path to execute the commands: $SPLUNK_HOME/bin/ ... View more

Hi,   Please try the following: <YOUR_QUERY> | stats count by type, status ... View more

Hello, Just to make sure, the searches returns any results or only returns as succeeded? Because, even without the permissions the user could search on the index but the search will not bring any results. ... View more

Hello,   Please, try the following (considering that everything before and after the [ and ] will be removed as you said):     [<sourcetype_name>] SHOULD_LINEMERGE=false LINE_BREAKER=(\,\s)\{\"links\"\: TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3NZ TIME_PREFIX=\"endTime\"\:\s\" MAX_TIMESTAMP_LOOKAHEAD=24   ... View more

Hello,   The extra spaces of the file name are blank spaces? If so, you could use the trim command to remove these spaces like the following: | rex "sent to: https://someurl/(?<file>.*)" | eval file = trim(file) | table file   ... View more

Hello, You should create an inputs.conf file that will monitor this directory and collect only the Alert Logs files.  You can create an new app and place the inputs.conf file on the /local/ folder of the app or add this inputs.conf file directly on the $SPLUNK_HOME/etc/system/local/ of your splunk universal forwarder.  Make sure that you will collect only the desired logs if they are in the same directory of the other logs. Also, make sure the user that is running the splunkd process have the right permissions to read this directory. An example of the inputs.conf file is the following: [monitor://<YOUR_PATH_TO_ALERT_LOGS] index = <INDEX_OF_YOUR_DATA> sourcetype = <SOURCETYPE_OF_YOUR_DATA> disabled = false   More information could be checked on the official docs: https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitorfilesanddirectorieswithinputs.conf   ... View more

Hello, You can create a new app as you create on the Splunk Enterprise and add the logo on the static folder. After that, you can ask for this app vetting to be installed on Splunk Cloud environment and then your app will be installed with your custom logo. I believe that it is not possible to add a custom logo to your app created directly on the Splunk Cloud UI. ... View more

Hello, The second option of the use of wild cards is correct.  Are these events being indexed at splunk? If not, please verify if the inputs.conf file is configured correctly. Also, as you are using the TRANSFORMS, do you have a transforms.conf file with the address-anonymizer definition? ... View more

Hello, Could you try to unpack the splunkclouduf.spl package and move it to the C:\Program Files\SplunkUniversalForwarder\etc\apps\ folder and then restart the UF instance? Something like that:   tar xvf splunkclouduf.spl mv <extracted_folder> C:\Program Files\SplunkUniversalForwarder\etc\apps\ splunk restart   ... View more

Hello, Not sure if I understand correctly your question. Do you want to get the list of all the users created on a Search Head? You can use the following search if you want to list all the users created: | rest /services/authentication/users | table title   If you want to list the count of distinct active users you can use the following search: (index=_audit info=completed action=search user!="splunk-system-user") | stats dc(user) as "Distinct Users"   ... View more