About richgalloway

richgalloway · ‎04-22-2026

Use the splunk offline --enforce-counts command to take down each indexer one at a time. Splunk will handle moving data as necessary. Make sure the RF/SF is met and all indexes are searchable before moving on to the next indexer.

richgalloway · ‎04-21-2026

It looks like you researched it well. I like your plan. Yes, you will need an on-prem DS to manage your UFs unless you have a separate tool (like Ansible) for that. Replacing Cribl with Edge Processor is worth looking into as it may save you some money. EP cannot yet do everything Cribl can, however. I agree with putting EP nodes close to the data sources. I have not used EP for syslog so I can't comment on that. I found SC4S to be a good syslog solution, but it's been a few years since I've used it.

richgalloway · ‎04-20-2026

Perhaps this article will help. Also, you can get agent info from any SH by searching the _ds_* indexes.

richgalloway · ‎04-15-2026

We don't know what customizations Splunk may have made to postgres. Installing code from another source may introduce incompatibilities. Code not released by Splunk may not be supported by Splunk. Changing delivered files may trigger File Integrity Check warnings.

richgalloway · ‎04-13-2026

After configuring SAML, did you map group names to Splunk roles? Does your Identity Provider contain group names for each user that will have access to Splunk? Without both of those, Splunk has no way to know what permissions to grant the user.

richgalloway · ‎04-13-2026

Check https://advisory.splunk.com and install the version of Splunk that fixes that vulnerability. Do NOT attempt to patch postgres independently.

richgalloway · ‎04-13-2026

Mandate

richgalloway · ‎04-08-2026

Creating a scripted or modular input is difficult without some programming knowledge, but AI should be able to help. I understand Claude is good at programming. Splunk Support is for break/fix issues, not scripting. Splunk ODS can offer advice, but cannot create a script for you. Splunk Professional Services, however, can create it. Whether you choose a scripted or modular input, adding checkpointing is a good idea to protect against interruptions in the input.

richgalloway · ‎04-08-2026

See https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.2/get-other-kinds-of-data-in/get-data-from-apis-and-other-remote-data-interfaces-through-scripted-inputs or https://help.splunk.com/en/splunk-enterprise/developing-views-and-apps-for-splunk-web/9.4/modular-inputs/create-modular-inputs

richgalloway · ‎04-06-2026

I made an assumption about what field contains the 200 values. Please change "status" throughout to the correct field name for your data. Also, try changing "sum" to "count".

richgalloway · ‎04-06-2026

It would help you know what you've tried so far and how those attempts failed you. I would use something like the following: <your query for relevant events> | stats count as requests, sum(eval(status=200)) as success by cs_uri_stem | eval pct=success*100/requests | table cs_uri_stem requests pct

richgalloway · ‎04-03-2026

Check the props.conf settings for the sourcetype ingested by the inputs.conf entry. Chances are the time parsing settings are incorrect. Verify the TIME_FORMAT and TIME_PREFIX settings in particular. You may need to add a TZ setting.

richgalloway · ‎04-03-2026

Consider adding indexes to the SH. SPL2 may be another instance of app functionality that needs it.

richgalloway · ‎03-24-2026

Do you have the same indexes installed on both the indexer cluster and the search head? Not sure it matters, but it's possible SPL2 is trying to validate index names.

richgalloway · ‎03-19-2026

Check out the lastPhoneHomeTime field returned by that endpoint. It says when each client last connected to the DS. Use that value to determine if a client is disconnected or not (you can decide how old the value needs to be).

richgalloway · ‎03-17-2026

How are you searching for the text now? If you're using a regular expression, please share the regex. How would a five-year-old (a.k.a. a computer) know that "EDC5133I" is the text to find and not some other part of the TEXT field?

richgalloway · ‎03-16-2026

The admin credentials are used for certain CLI commands. You should be able to start Splunk without admin creds, but that means the CLI commands that require them will not work. It's pretty rare to need to use those commands on a UF.

richgalloway · ‎03-06-2026

You didn't answer the question. 🙂 Please tell us more about what you tried and how those trials worked. "A number" isn't something we can work with. Are you extracting the field at search time or at index time? What commands/settings are you using?

richgalloway · ‎03-06-2026

It would help to know what you've tried so far and how those efforts failed to meet expectations. Have you tried this regular expression? message":"(?<message>[^"]+) If you're extracting the string at search time then you will need to escape the quotation marks (\\\").

richgalloway · ‎03-06-2026

That's not a lot to work with, but you probably should install the script as a scripted input on the HF. Never change anything in a default directory - use local.

richgalloway · ‎03-05-2026

I would consider putting inputs.conf and the props associated with the sourcetypes in those inputs into the same app. I also would ensure all inputs are disabled by default. If multiple input.conf file reference the same sourcetype (like "syslog", to use a bad example) then I would move the props to a separate app. This should help future maintainers realize the props are not specific to any one input.

richgalloway · ‎03-05-2026

I vote in favor of maintaining the split - not as an input/props split, but as an on-prem/cloud split. Inputs that work on-prem probably don't work (at least not the same) in the cloud and props in one may not apply to the other.

richgalloway · ‎02-26-2026

That is exactly the solution. See https://advisory.splunk.com/advisories/SVD-2026-0206

richgalloway · ‎02-24-2026

If Cribl is sending to the HEC event endpoint then the data is treated as cooked by Splunk and index-time props will be skipped. If the data is sent to the raw endpoint then it is uncooked and normal pipeline processing applies.

richgalloway · ‎02-24-2026

Just because there not a fix available now does not mean Splunk won't issue a fix. Yes, you can remove the jar file, but do so at your own risk. At the very least, the file integrity checker will notice the missing file and alert you to it.

Posts	16795
Solutions	2991
Karma Given	2048
Karma Received	6739
Member Since	‎07-24-2012

Online Status	Online
Date Last Visited	3 hours ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: What are the steps to decommission half of the...

Re: Splunk Hybrid Cloud Architecture

Re: Agent management page is not loading

Re: postgres update

Re: Splunk UI Login Issue via SAML SSO – Assistanc...

Re: postgres update

Re: Add Enterprise Security to on prem clustered e...

Re: Python script deployment to pull logs

Re: Python script deployment to pull logs

Re: How to get percent of http 200 codes per file

Re: How to get percent of http 200 codes per file

Re: Correcting ingesting timestamp for Solarwinds ...

Re: SPL2 can access only a subset of available ind...

Re: SPL2 can access only a subset of available ind...

Re: List Universal fowarders disconnected from the...

Re: search past escaped characters for an alert

Re: Splunk Universal Forwarder - Linux Installatio...

Re: rex help - extracting string between quotes

Re: rex help - extracting string between quotes

Re: Python script deployment to pull logs

Re: Should I split inputs and props into distinct ...

Re: Should I split inputs and props into distinct ...

Re: How can I handle this MC access vulnerability?

Re: Does Cribl always produce cooked data?

Re: How can I take care of this vulnerability?

Join the Conversation