A key thing to remember about LINE_BREAKER is the text matched by the first capture is discarded. Based on my assumption that each event starts with a left brace this setting may work: LINE_BREAKER = ([\r\n]+)\{ ... View more

Most of the example events do not contain a timestamp so Splunk has to use the file mod-time or the current time.  To use the current time, specify DATETIME_CONFIG = CURRENT. Perhaps those lines are a single event.  If so, then try these settings SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)Status INFORMATION: Description: Beginning NO_BINARY_CHECK = true disabled = false TIME_PREFIX = Script: TIME_FORMAT = %m-%d-%Y-%I:%M:%S-%p ... View more

Splunk is unable to connect to your SMTP server.  The message implies a firewall is dropping connection attempts to the SMTP server from Splunk. ... View more

The AppInspect tool detected "requests.post" in your Python code.  The call to requests.post must include the certificate argument and that certificate must be included in your app. ... View more

Splunk does not support GPUs. ... View more

The construct $result.foo$ always returns the first instance of the foo field.  Splunk does not provide a way to get all results, except via a link (which probably won't work with SNOW). You may have to go back to having separate alerts for each device. ... View more

The stats command is a transforming command so it discards any fields it doesn't produce or group by.  Add new fields to stats to get them in the output. | makeresults count=1 | addinfo | eval days=mvrange(info_min_time, info_max_time, "1d") | mvexpand days | eval _time=days, count=0 | append [ search index="*appevent" Type="*splunk" | bucket _time span=day | stats count by _time, Type ] | stats max(count) as Total by _time, Type | eval "New_Date"=strftime(_time,"%Y-%m-%d") | table "New_Date" "Total" Type ... View more

Use the extract command to convert those key:value pairs into fields and values. <<your search>> | extract pairdelim="," kvdelim=":" | table date_minute host index *   ... View more

I think I understand the problem.  The application of props.conf settings is a single-pass operation.  If the sourcetype changes during that pass another pass for the new sourcetype is NOT performed. The only way (that I know of) to process the new sourcetype is by using the CLONE_SOURCETYPE setting in transforms.conf.  That will, however, keep the original copy of the data in its current form. You should be able to extract fields using a single sourcetype.  It looks like the only difference between the two sourcetypes is the words used to end some regexes.  Consider combining them. [virsec_log] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD=15 TIME_FORMAT=%b %d %H:%M:%S EXTRACT-processpath = Process Path=(?<ProcessPath>.*) (Library|Canary) EXTRACT-ParentProcessName = Parent Process Name=(?<ParentProcessName>.*) Process Threat EXTRACT-ProcessName = \d\sProcess Name=(?<ProcessName>.*) Process Profile Id EXTRACT-ProcessProfileName = Process Profile Name=(?<ProcessProfileName>.*) Number of Libraries EXTRACT-ProcessThreatVerificationStatus = Process Threat Verification Status =(?<ProcessThreatVerificationStatus>.*) Process Path EXTRACT-LibraryName = Library Name=(?<LibraryName>.*) Start Time EXTRACT-LibraryPath = Library Path=(?<LibraryPath>.*) Event Type ... View more

If you're masking the data using SEDCMD or a transform then there's no "unmasking".  The original data has been replaced and cannot be recovered. A workaround would be to clone the data to a separate index with limited read access.  Then you'd have to pull the unmasked data from the new index in addition to the masked data from the current index. Perhaps you can use Ingest Actions to only mask non-abc data. ... View more

You can use append instead of join. | makeresults count=1 | addinfo | eval days=mvrange(info_min_time, info_max_time, "1d") | mvexpand days | eval _time=days, count=0 | append [ search index="*appevent" Type="*splunk" | bucket _time span=day | stats count by _time ] | stats max(count) as Total by _time | eval "New_Date"=strftime(_time,"%Y-%m-%d") | table "New_Date" "Total" Or you can let timechart fill in the zeros. index="*appevent" Type="*splunk" | timechart span=1d count as Total by _time | eval "New_Date"=strftime(_time,"%Y-%m-%d") | table "New_Date" "Total" ... View more

That fits the original regex (I'm assuming "Filelog" in the original is a typo). Have you checked the logs to see if Splunk is reporting any errors accessing the files? ... View more

It sounds like the alert is configured to trigger for each result instead of once per run. richgalloway_0-1677768653535.png   ... View more

Do you have entitlement to submit support cases?  If not, contact someone at your company who does. If you do have entitlement then contact Splunk at one of the phone numbers in the link in the message. ... View more

Use the Admin Config Service (ACS).  See https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Config/ACSREF#Manage_indexes ... View more

crcSalt=<SOURCE> can help prevent re-indexing of a file that has been renamed, but won't help with files that aren't indexed at all. The regex in the whitelist doesn't match the file names in the OP.  For starters, none of the file names in with ".log".  This regex matches the example names, according to regex101.com D[0-9]{2}A[0-9]{5}\(Z[+-][0-9]{2}\)   ... View more

The first command works because it uses correct syntax. The others attempt to replace a set of key=value pairs with a command that returns who knows what.  Per the Search Reference Manual: WHERE clauses in tstat searches must contain field-value pairs that are indexed, as well as characters that are not major breakers or minor breakers. If you can get the loadjob or dbxquery command to return a list of key=value pairs then it might work.  Keep in mind that both are generating commands so they must be prefixed by |.  You may need to use a subsearch containing a format command. | tstats count where date_time="2022*" ( [ | loadjob savedsearch="XXX:YYY" | format ] ) groupby date_time | fields date_time Notice how the where clause moved into the tstats command for better performance and the redundant dedup command was removed (the groupby option removes duplicates). ... View more

A subsearch is part of a search so just submit the main search with the subsearch included using the prescribed methods. If there's something specific that's holding you back then please provide the details. ... View more

I'm not sure that can be done.  Splunk auto-load balances by default.  There are options that govern how the load balancing behaves, but none that disable it or turn it into a failover-only feature. ... View more

Splunk usually parses well events with fields in the format key=value, but stumbles when the value field contains embedded (and unescaped) quotation marks.  The ID sourcetype needs settings added or modified in a props.conf file to properly parse that data.  You may need a transform to parse the event using a regular expression. Please share the current props.conf settings for the ID sourcetype. ... View more

In expressions like those, the field name is replaced with the field's value and then the expression is evaluated using common arithmetic rules. ... View more

Maybe.  It depends on how you want to use them and what the end goal is.  Tell us more about your use case. tstats and dbxquery are both generating commands so there are limits to how they can be used together.  Either command can be in a subsearch or tstats can use the append=t option. ... View more