Perhaps the NE is being suppressed.  Check by going to Configure->Incident Management->Notable Event Suppressions ... View more

Data ingested using DBX is indexed.  You should be able to run a search and export the results.  That's probably the best you can do as I doubt Splunk will give you a copy of the buckets. ... View more

The "id" attribute in the [package] stanza must be the app's directory name, in this case the app would be stored in $SPLUNK_HOME/etc/apps/SplunkforAccuKnox.  If the directory name in the tarball doesn't match the "id" attribute then the app will not be installed. Also, the install_source_checksum setting must be removed before installation. ... View more

What information does the client want?  Some may be available via the UI, but most will have to come from Support.  Other information may not be available at all. Be aware the Splunk Cloud makes regular backups of each stack. ... View more

Yes, you can mix SSDs and HDDs on the same server.  Splunk doesn't care as long as the IOPS meet the minimum requirements.  The recommendation is the fastest disk(s), usually SSDs, be used for writing (hot buckets) and the most-frequently used data.  Everything else can go on slower disks, usually HDDs. The details about buckets are good to know, but aren't much of a factor in the hardware, aside from the above. Do keep your Splunk directories on separate mount points from the OS. The SH does not have the same I/O demands as the indexers. ... View more

Enable the inputs in an app.  Inputs in etc/system/local cannot be changed by the Deployment Server (DS).  Using a DS is another best practice. ... View more

Indexers do not use KVStore so there are no steps. ... View more

Try this.  It cycles through each report class and uses eval to compute the MSUs used. index=z* MFSOURCETYPE=SMF030 Subtype=2 `calccpusecs` | where Rptcls IN("RHOTBAT","RPDBATLO","RPDBATMD","RSAGBAT","RTSTBAT") | eval MSUFactor=(37209.3023/5/216000) | timechart span=1d sum(cpusecs) by Rptcls | foreach RHOTBAT RPDBATLO RPDBATMD RSAGBAT RTSTBAT [ eval <<FIELD>>_MSUs=<<FIELD>> * MSUFactor ] | addcoltotals   Note that <<FIELD>> is literal, not a placeholder.  ... View more

Yes, you can.  Splunk recommends you use SSD for hot/warm buckets and HDD for cold buckets. ... View more

FWIW, I also see version 1.0.4 for ThreatConnect App for Splunk (https://splunkbase.splunk.com/app/6486).  I see version 1.0.5 for TA ThreatConnect Intel (https://splunkbase.splunk.com/app/6485). It's possible the app had a version 1.0.5 that was later removed, but clearing the browser cache should cause 1.0.4 to be shown. I know of no way to submit issues about Splunkbase other than to report it at https://ideas.splunk.com ... View more

There's no one from support here. Did your colleague clear their browser cache? FWIW, there are multiple splunkbase entries with "threatconnect" in their name, including one with version 1.0.4 and one with 1.0.5.  Are you sure you're both looking at the same app?  Compare app IDs (4-digit number in the URL). ... View more

Log files have no formatting rules.  You just need to define a sourcetype that can parse them. ... View more

I'll add to what @yuanliu said by pointing out that Splunk cannot ingest Excel files because they are not text.  You would have to save them as CSV files to load them into Splunk. ... View more

Verify you have the right name configured in web.conf.  Check that DNS is working correctly and that the firewalls allow connections to that address. ... View more

Thanks for sharing.  Do you have a question? The message says "search head cluster", but the screen shot is of an indexer cluster.  Obviously, the indexer cluster is borked.  Are you also having problems with the SHC? Tell us more about "joined a different domain".  What exactly did you do and how did you do it? ... View more

Check the Monitoring Console to see if it has a query that comes close to what you want. As for accounting for weekends and holidays, you probably should look at the Machine Learning Toolkit (MLTK).  It has algorithms that can detect trends in your data and help find when the trends break. ... View more

If the query will run every hour then it should look only for new logins in the last hour.  That means comparing the event timestamp to the current time and triggering an alert if the event is new. index=aws sourcetype=aws:cloudtrail (eventName=ConsoleLogin OR eventName=CreateImage OR eventName=AssociateAddress OR eventName=AttachInternetGateway OR eventName=AttachVolume OR eventName=StartInstances OR eventName=StopInstances OR eventName=UpdateService OR eventName=UpdateLoginProfile) | stats count, latest(_time) as time by userIdentity.arn, eventName | where (count==1 AND time > relative_time(now(), "-60m")) | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time) Also, it may not be necessary to search all time since that can be expensive.  You may only have to search back as far as the life of an inactive account (perhaps 90 days) under the assumption that everyone has signed in since then or the account would have been removed. ... View more

Hosts do not "belong" to an index.  Data is stored in indexes ("belongs" in the index).  Host is just one piece of metadata associated with an event.  It's possible for a given host to be in many events and, possibly, in many indexes. ... View more