Library files can be in <app>/bin/lib or <app>/lib. I would resist the temptation to change the file structure of a standard app.  Put your external command into a new app. ... View more

Did you include gib_detect.py in /opt/splunk/etc/apps/search/lib?  It's probably in your home folder, but not in the Splunk folder. BTW, it's best to create external commands in custom apps rather than in the search app. ... View more

I hope you realize my "query" is just a fragment of a query that must be incorporated into your query to produce results.  Also, the field names I used may need to be changed to reflect the actual names in your data. Here's one possible way to do what you seek ```Read the first IP from the LinktunnelMap table.``` "IP-Address" NOT Audit NOT "%BGP_SESSION-5-ADJCHANGE" NOT "%BGP-3-NOTIFICATION" NOT "%BGP-5-NBR_RESET" NOT passive NOT "%BGP-3-BGP_NO_REMOTE_READ" AND "%BGP-5-ADJCHANGE: neighbor" ```Search for the events related to this IP.``` ``` Change "IP" to the name of the IP column in the lookup``` ``` Add a rename command if the lookup column name does not match the index field name ``` [ | inputlookup LinkTunnelMap | fields IP ] ```Perform calculations based on these events.``` <<add commands here>>> ```Save the result. Nothing needed here as the calculation results are automatically added to the current event.``` ```Once all IP addresses are processed, we should have a table with all IP addresses and their respective results``` | table IP <<results>> ... View more

Please explain your use case.  What problem are you trying to solve? ... View more

The TIME_PREFIX and TIME_FORMAT settings do not match the example event.  Try these settings TIME_PREFIX = stageTimestamp": TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%Z   ... View more

Installing a Universal Forwarder (UF) and a full Splunk instance (such as a search head) on the same machine is not a simple process.  Steps must be taken to avoid conflicts between the two. Fortunately, it is totally unnecessary to install a UF on a SH.  That's because a SH is capable of everything a UF can do. To monitor the SH's /var/log directory, simply add an input that does so.  Go to Settings->Data inputs->Files & Directories then click the "New Local File & Directory" button. ... View more

@k_ashabi wrote: Thanks. But I got this message for the first line: "Your search isn't generating any statistic or visualization results. Here are some possible ways to get results." Click on the Events tab to see your search results.  To see results in the Statistics or Visualization tab, the query must contain a stats, chart, or timechart command. For the main part, I need to do the calculation for all the IP addresses. For example,  if we have 2 IP addresses in the lookup table which are 172 and 192. In the result we need to have a table like below: IP          result 172     111111 192      222222 How should Splunk derive "111111" from "172" or "222222" from "192"? ... View more

It's not that message_id is a "created field". You may need to set a token to $results.message_id$ as part of the <done> element of your query, but you have a bigger problem:  the message_id field doesn't exist. The stats command transforms the results so the only fields passed to the rest of the query are 'count', 'USER', and 'TEXT'.  There is no message_id field to search for or to use in another panel. ... View more

SPL, by its nature, is a while-do loop.  It reads events one at a time and processes each one individually until there are no more events to process. To perform a lookup on an IP address, use the lookup command. | lookup LinkTunnelMap TunnelIP ``` Perform calculations and save the results ``` | eval results = <<some calculations on an IP address>> ... View more

Which app are you using (please share the splunkbase URL)?  Is it installed on your indexers and heavy forwarders?  Did you restart them after installation? It seems like the data doesn't match the props supplied by the app.  You may need to modify settings to match your data.  Knowing the exact app will help us be more specific. ... View more

If you only have a single Universal Forwarder (UF) then you don't need deploymentclient.conf.  Worry about that when you have multiple UFs to manage. The outputs.conf file is provided by Splunk.  Go to the "Universal Forwarder" app on your Splunk Cloud trial instance.  Download the configuration file provided by the app and install it on the UF.  Instructions are in the app. The UF does come with inputs.conf, but it's not where the docs say it is.  You can find the file in $SPLUNK_HOME/etc/system/default.  DO NOT MODIFY ANY FILES IN THIS DIRECTORY.  Instead, copy the stanza name and the settings you wish to change to $SPLUNK_HOME/etc/system/local and make your changes there. ... View more

The asset information is collected from AD by the ldapsearch command.  Of course, you must first configure the SA-ldapsearch add-on.  Work with your AD team to do that as they should have the information you need. ... View more

That's something the ldapsearch command can help with.  First, you'll need to craft a search that returns asset information.  Your Security Team should be able to help with that.  Do this on the HF. Once you have a working search, add a collect command to save the results to an index.  Use an index specific to this purpose, with a short retention time (7 days or less).  The index is used to transfer the data from the HF to the indexers.  The short retention time keeps storage usage low. Configure the search to run on a regular schedule.  Daily probably is good. Create another search on the Cloud SH that reads the index used above and uses the outputlookup command to save the assets to a lookup table.  This puts the assets into a form that is easier to use.  Schedule the search to run after the ldapsearch query. ... View more

The screenshot says "props".  Is that the actual file name?  It should be props.conf. It's difficult to determine if changes need to be made to transforms.conf without seeing the file, but since props.conf does not reference any transforms I'd say "no". I'm still waiting for an answer to this earlier question: Are you looking at data that was onboarded after the change (and restart)? How is the script(?) that is making the API calls tagging the data as sourcetype=kafka_metrics?  How is the data being sent to Splunk? ... View more

Thanks for the link.  It helps clarify the question. As it turns out, that app does not support Windows. CLI access to Splunk is managed by the operating system.  Connect to the server as you normally do then launch a command prompt. ... View more

Splunk does not use port 22.  The Splunk UI is on port 8000. Please share a link to the app you are trying to use. Scripts in apps usually are run as a scripted or modular input rather than running them manually from a shell. ... View more

Since a container has no awareness of its host, you'll need a UF on the host itself.  The UF does not use port 9997 so that's not an issue.  You can reassign port 8089 to another port in web.conf or disable it entirely in server.conf. ... View more

Is that the *raw* source name, before any Splunk transforms? Can you change the stanza to a sourcetype one, at least to confirm the regex is correct? ... View more

Similarly we have installed the Add-On in our Search Heads as well but didn't perform any configurations since its in Cloud. So post doing it when I went to search head and try to search the below queries as provided in the Add-on I am not getting the desired results else we are getting the error as below.   Search Query : | ldaptestconnection domain="xyz" Getting error as below : External search command 'ldaptestconnection' returned error code 1. Script output = "error_message=Cannot find the configuration stanza for domain=xyz in ldap.conf. ".   Search Query : | ldapsearch search="(objectClass=group)" attrs=distinguishedName | ldapgroup Getting error as below : External search command 'ldapsearch' returned error code 1. Script output = "error_message=Missing required value for alternatedomain in ldap/default. ". These errors occur because the add-on was not configured on the search head.  The add-on must be configured before it can be used. You don't need this add-on to ingest AD logs.  Simply install a Universal Forwarder on the AD server and configure it to use WinEventLog inputs.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/MonitorWindowseventlogdata#Monitor_Windows_event_log_data_with_Splunk_Enterprise for details. ... View more