If the event is multi-line then .+ may not match newlines.  Try this alternative. REGEX = (<EventID>13<\/EventID>)[\s\S]+Bookmark   ... View more

As I've said before, timestamps must be in epoch (integer) form for Splunk to compare them.  Use the strptime function to convert first_detected and last_detected to integers.  Then compare them to todays_date. ... | eval fd = strptime(first_detected, "%Y-%m-%dT%H:%M:%S.%3N%Z"), ld = strptime(last_detected, "%Y-%m-%dT%H:%M:%S.%3N%Z") | where (fd >= todays_date OR ld >= todays_date) For display purposes, you can use the fieldformat command to show todays_date in human-readable form. | fieldformat todays_date = strptime(todays_date, "%Y-%m-%dT%H:%M:%S.%3N%Z") ... View more

Which version of Splunk are you using?  The first query works for me in 9.0.0.1. richgalloway_0-1677089502677.png   ... View more

Did you review the receiving system's health like the message suggested?  What did you find out? Check the firewall(s) between the UF and indexers to make sure connections are allowed. Also, not the problem, but the inputs.conf stanza should specify an index name. ... View more

If you use "%Z" instead of "Z" on the end of the format string then Splunk will know the time zone and handle it correctly.  The letter "Z" is another abbreviation for "UTC" and "%Z" is the format string variable for 'time zone name/abbreviation'. ... View more

The query searches for the same data twice.  Both the main search and the subsearch search the user_login_details index for the existing_login_users sourcetype (implicitly in the main search; explicitly in the subsearch). Avoid joins when possible.  append followed by stats values(*) by userName may be more performant. Using the collect command with a sourcetype other than "stash" will consume some of your ingest license. ... View more

The only way to compare dates is to first convert them in epoch (integer) form using the strptime function.  The current time, returned by now(), is already in epoch form.  Splunk accounts for time zone differences when converting to epoch. | eval first=strptime(first_time, "%Y-%m-%dT%H:%M:%S.%3N%Z"), last=strptime(last_time, "%Y-%m-%dT%H:%M:%S.%3N%Z") ``` Compare each timestamp to see if they are today's date. 'relative_time(now(), "@d")' returns the timestamp for midnight (0:00) today. ``` | eval first_is_today = if(first > relative_time(now(), "@d"), 1, 0) | eval last_is_today = if(last > relative_time(now(), "@d"), 1, 0) ... View more

Create the search on your Dev instance (or your workstation) then copy the stanza from savedsearches.conf to git.  When you've done that a few times, you'll have a feel for what to include in scratch-built stanzas. ... View more

The add-on uses shell scripts to capture data for ingestion by Splunk.  Run the scripts manually (see inputs.conf for the script names) to see what they return and how they should be modified to run on your OS.  Then make the changes to the add-on.  You'll want to include switches that test the current OS so you don't break the scripts on other systems. Be aware that upgrades to the add-on will overwrite your changes so you will have to re-apply them. ... View more

Use the spath command in your search query to extract fields from JSON events. ... View more

It's the old name for the Splunk App for Lookup File Editing app (https://splunkbase.splunk.com/app/1724).  If you don't have it on your system, use the inputlookup command. ... View more

Normalize timestamps by using the strptime function to convert them into internal (epoch) form. ... View more

Examine the lookup file (Serveurs-applications-Document-travail.csv) using the Lookup File Editor app or the inputlookup command. Verify you have the correct field name in your query. ... View more

As (almost) always, start with splunkd.log. ... View more

In this context, "database" means "index". ... View more

As you said, there's no guarantee that one indexer will have a copy of all data.  Nor can you rely on the name of each bucket to determine which are primaries so only those are backed up.  I haven't done it myself, but consider creating a script that compares each indexer's GUID to that in the bucket name and back up only those that match. Be sure to roll hot buckets to warm before backing them up. When restoring a backup, put the indexes in the thawed directory (and follow the procedure for doing so) rather than back where they came from.  Using thawed prevents old data from being frozen before you can search for it. It's a good idea to back up $SPLUNK_HOME/etc.  You'll need that to restart the indexers.  ... View more

IMO, a new sourcetype should be a new TA.  Howver, it's reasonable to add to an existing TA if that TA is already doing work that would be hard to replicate - such as collecting data using an API. If you choose to add your props and transforms to an existing add-on, do so in the local directory of the add-on.  That will prevent overwriting of your changes when the TA is updated and avoid the need to merge changes. ... View more

I've seen lots of backslashes in savedsearches.conf.  The only special use for them is as a line continuation character and that's only when \ is the last character on a line.  Have you tried putting that query in the config file? ... View more

Answer #1 - The documented way is pretty quick.  What is it you feel needs to be streamlined? Answer #2 - Yes, sometimes an app or add-on needs to be installed on all instance types. Answer #3 - Only you know what is important to you and your environment.  Tell us what is important to you and we can suggest some apps.  In the meantime, check out this .conf talk for some suggestions: 10 Must-Have Apps and Why You Are Crazy Not to Use Them! (https://static.rainfocus.com/splunk/splunkconf18/sess/1520969498776001bolS/finalPDF/FN1072_10MustHaveApps_Final_15386660042410012oTj.pdf) ... View more

Make sure the add-on is installed on your indexers and search heads as well as on the UF.  The UF fetches the data, but it is the indexers and SHs that do field extractions so the add-on needs to be installed there, too. ... View more

By "remove" do you mean you want to get rid of that text or extract it into fields? What regular expressions (rex commands) have you tried so far? ... View more