Please describe the problem you are having without using the phrase "it does not work" as that tells us nothing about what is wrong. Heavy forwarders parse data exactly the same way indexers do so any props and transforms you would use on an indexer should work on a HF.  If the data passes through more than one HF then only the first one does the parsing.  Also, data sent via HEC to the /events endpoint is not parsed at all. Make sure the props are in the right stanza (the stanza name matches the incoming sourcetype or starts with "source::" and matches the source name or starts with "host::" and matches the sending host's name).  Be sure to test regular expressions (I like to use rege101.com, but it's not perfect) before using them. ... View more

The values are *supposed* to be the same in the new field, except with commas added. Please share sanitized examples of what results you have now and what you want. ... View more

  | eval newField=mvjoin(host, ",")   ... View more

Did you use the Windows uninstaller to remove the programs?  That's the preferred method on Windows systems. It's not necessary to install both Splunk Enterprise and a Universal Forwarder (UF) on the same system.  The installers don't event allow it, IIRC.  Everything the UF can do Splunk Enterprise can do. ... View more

What problem are you trying to solve?  What is meant by "total of messages on a source"? ... View more

Consider using the Least Privilege feature.  It allows a forwarder to read any file on the system.  See https://www.splunk.com/en_us/blog/learn/least-privilege-principle.html and https://docs.splunk.com/Documentation/Forwarder/9.3.2/Forwarder/Installleastprivileged ... View more

You can do that using a shell script in the CLI.  Look for "XYZ" in $SPLUNK_HOME/etc/apps/*/*/savedsearches.conf, $SPLUNK_HOME/etc/system/local/savedsearches.conf, and $SPLUNK_HOME/etc/apps/*/*/data/ui/views/*. ... View more

How did you solve it? ... View more

Are you able to see the UF's internal logs in Splunk?  If not, then that problem must be resolved first. Please share the WinEventLog inputs.conf stanza(s). Please also tell how you are trying to search for the events. ... View more

It would help to know what you've tried already so we don't waste time on that. Consider these props settings [mysourcetype] DATETIME_CONFIG = current SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\{ TRANSFORMS-parse_mysourcetype = parse_mysourcetype with these transforms: [parse_mysourcetype] REGEX = "([^"]+)":"([^"]+) FORMAT = $1::$2 ... View more

@jwv wrote: I've tried this a few ways with no success, I tried to just append the where condition on the end of my query so it looks something like this    index="my-index" | search "http 404" | stats count | where count => 250 AND count <= 100   but this still just returns the number of matching events and I run into the same problem trying to set up the alert. That the search "just returns the number of matching events" is to be expected since that is all it is told to do.  The where command should cause the search to return a result only if that result is a number between 250 and 500; otherwise it should say "No results found".  That is what will trigger the alert - if there is a result (Number of events > 0) it's because the search criteria were met. ... View more

Location information for cyber data tends to be very inaccurate, especially if we're talking about mapping IP addresses to physical ones.  One may be able to narrow an IP address to a state or city, but a ZIP/postal code is too fine-grained.  If you try, you may find the postal code at the center of the city/state gets used the most because of the way iplocations are assigned much the same as how the city in the center of a state often is used for any IP addresses in that state. ... View more

That is the nature of the set diff command - it will tell there's a difference, but doesn't say what it is.  See https://docs.splunk.com/Documentation/Splunk/9.3.2/SearchReference/Set An alternative would be to count the members of each group and show those with only one member. | multisearch [ search index=db_assets sourcetype=assets_ad_users $user1$ | dedup displayName sAMAccountName memberOf | makemv delim="," memberOf | mvexpand memberOf | rex field=memberOf "CN=(?<Group>[^,]+)" | where Group!="" | eval User=$user1$ | table Group User ] [ search index=db_assets sourcetype=assets_ad_users $user2$ | dedup displayName sAMAccountName memberOf | makemv delim="," memberOf | mvexpand memberOf | rex field=memberOf "CN=(?<Group>[^,]+)" | eval User=$user2$ | where Group!="" | table Group User ] | stats values(User) as Users by Group | where mvcount(Users)=1   ... View more

The cluster/manager/info endpoint should have what you want.  See https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTcluster#cluster.2Fmanager.2Finfo ... View more

How long has it been?  Sometimes it takes a day or two. ... View more

Move the trigger condition from the alert to the search.  IOW, put this on the end of the query | where count => 250 AND count <=500 ... View more

That's called throttling.  When you edit the alert, click the "Throttle" box and specify how long alerts should be silenced.  Splunk will not send an alert for the same conditions during the throttle period. ... View more

That information is in the same manual. ... View more

You can find out about how to create and use authentication tokens in the Securing Splunk Cloud Platform manual. ... View more

This thread is resolved.  For betters chances of a reply, please post a new question. ... View more