When a CLI command asks for credentials, it expects a Splunk local account name with admin privileges.   If you do not have the admin password then you should reset it. Except for indexers and universal forwarders, just about any Splunk instance may be using KVStore.  It's also possible a new app will be installed that uses KVStore so it should be running. ... View more

Have you tried removing '/bin' from JAVA_HOME and the config file? ... View more

Splunk does not delete individual events - it removes entire buckets when either the size or time limit is reached. When deleting by time, because the whole bucket is deleted, it's important that all of the events in that bucket be old enough to delete.  If any event is too new then the bucket will not be touched.  Every bucket has two dates (for our purposes, anyway) associated with it - the start date (_time of the first event added) and the end date (_time of the last event added).  The end date is one that determines when the bucket can be deleted/frozen. I've seen sites where data is poorly onboarded and has _time values in the future - sometimes by years.  When that happens, the bucket will remain in the system until frozenTimePeriodInSecs after that future date passes. ... View more

This is fairly common and easy to correct. Stop Splunk Change the ownership of all Splunk files using the command (as root) chown -r splunk:splunk /opt/splunk Start Splunk ... View more

Did you restart Splunk after changing $JAVA_HOME? The info is stored in $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/dbx_settings.conf,  See https://docs.splunk.com/Documentation/DBX/3.18.0/DeployDBX/settingsconfspec for a description of the contents. ... View more

One problem with transferring $SPLUNK_HOME from one Splunk instance to a newer one is you will be taking the old Splunk built-in apps with you, which would not be a Good Thing. Another potential problem is you will miss out on the migration actions taken during upgrades.  If you've upgraded Splunk before, have a look at $SPLUNK_HOME/var/log/splunk/migration.log.* to see what is done behind the scenes during an upgrade.  Without that work, you may be carrying useless (or even harmful) cruft to the new version and may miss out on important changes. ... View more

@jessieb_83 wrote: I understand that maxTotalDataSizeMB takes precedence over frozenTimePeriodInSecs. You understand incorrectly.  Both have equal precedence.  The first limit reached is the one that will be applied.  If the size limit is reached then the oldest buckets will be deleted first. If maxTotalDataSizeMB is not specified, it defaults to 500000 (see indexes.conf.spec). Use the dbinspect command to examine your buckets.  Make sure the oldest ones don't have an earliest_time latest_time (endEpoch) that is newer than the frozenTimePeriodInSecs setting.  Buckets will not age out until *all* of the events in the bucket are old enough. ... View more

Change the Java home setting in DB Connect and/or correct the $JAVA_HOME environment variable. ... View more

The gzip'd files are index under their own source names.  They come in the query because their names match the pattern source="/var/log/nginx/access.log*".  Remove the asterisk and only the one file will appear. ... View more

Since the new sample events don't have a method field (GET, POST, etc.), we can get rid of that part of the regex. | rex "\/rest\/(?<field1>[^\/]+)\/(?<field2>.*)" ... View more

The existing props are discarding the End Time value because of the LINE_BREAKER setting.  LINE_BREAKER always throws out the text that matches the first capture group. Try these settings. [nk_pp_tasks] SHOULD_LINEMERGE=false LINE_BREAKER=End Time:[^\*]+?() NO_BINARY_CHECK=true TIME_FORMAT=%Y.%m.%d.%H%M%S TIME_PREFIX=\*\*+ BREAK_ONLY_BEFORE_DATE = false   ... View more

Summary indexes are no different from other indexes so the code you use to access one should work for the other. How does the existing code fail?  What error messages do you see?  Have you checked search.log? It's possible the query is being caught by the "risky code" trap because the collect command is considered a risky one.  To avoid that, add the following lines to a command.conf file (not system/default) [collect] is_risky = false ... View more

Try this (index="wpg" host=*pz-pay*) (OrderSummary OR (OrderSummary AND "Address is invalid, it might contain a card number")) | eval is_invalid=if(searchmatch("Address is invalid, it might contain a card number"), 1, 0) | stats count AS "Total", count(eval(is_invalid=1)) as Failure | eval result = (Failure * 100)/Total ... View more

I'm sure you are stuck, as expected. The current tstats command produces only one field: count.  You can get some (and maybe all) of them using the list or values function, but any association between the fields will be lost. For example,. | tstats count, values(analysis.threat_score) as ats, values(analysis.metadata.sandcastle_env.analysis_start) as start, ... from datamodel=Cisco_Security.Secure_Malware_Analytics_Dataset where nodename=Secure_Malware_Analytics_Dataset index=* status IN ("*") sourcetype="cisco:sma:submissions"   ... View more

Is the Endpoint DM accelerated?  If not, then setting indexes won't accomplish anything.  Also, the data in the wineventlog index must be CIM-compliant.  See the CIM Manual for the field names expected by the DM.  Use field aliases and EVALs in props.conf to create the fields. ... View more

I need some clarification.  Are the HFs acting as deployment clients (DCs) or deployment servers (DSs)?  You can't have 2 DSs in the same environment prior to Splunk 9.2. If the HFs are DCs then where is the DS? Is the MC a separate instance? You set up HF2 using "the same method".  What exactly was that method?  We can't tell where you went wrong without knowing what you did. ... View more

This query appears to be unsuitable for conversion to  tstats.  It uses too many fields that must all be indexed for tstats to supply them.  Also, the query is doing its own analysis of the events, but tstats provides aggregated values, not events, which would break the calculations done in the query. What problem are you trying to solve?  Perhaps tstats is not part of the answer. ... View more

Have you tried the "Patterns" tab?  That can show patterns in your results if you have enough events for Splunk to analyze. If you have a finite set of events then you may be able to group them using a case function and the stats command. ... | eval warn = case(match(_raw, "ConfigurationLoader - Deprecated configuration detected in path .*?. Please update your settings to use the latest configuration options.", "ConfigurationLoader - Deprecated configuration detected in path. Please update your settings to use the latest configuration options", match(_raw, "QueryExecutor - Query execution time exceeded the threshold .*", "QueryExecutor - Query execution time exceeded the threshold. Query:", match(_raw, "MemoryMonitor - High memory usage detected: .*? of allocated memory is in use. Consider increasing the available memory.", "MemoryMonitor - High memory usage detected: of allocated memory is in use. Consider increasing the available memory.", 1==1, _raw) | stats count by warn Of course, this requires you to know which warnings are of interest and becomes impractical when there is a large number of them. ... View more

Splunk has a multi-day class on how to get data into Splunk so I won't be able to cover the whole subject here. Every sourcetype ingested into Splunk should have a props.conf stanza that specifies at the "Great Eight" settings.  They are: SHOULD_LINEMERGE LINE_BREAKER TIME_PREFIX TIME_FORMAT MAX_TIMESTAMP_LOOKAHEAD TRUNCATE EVENT_BREAKER_ENABLE EVENT_BREAKER You can read about each of these in the Admin Manual. Often, the time zone associated with an event is included in the timestamp (for example, "8/30/2024 10:52:00Z" or "8/30/2024 10:52:00-0700").  When that's the case, adding "%Z" or "%z" to the TIME_FORMAT setting is all you need.  If the timestamp does not include zone information then adding the TZ setting to props.conf will help. TZ = America/Los_Angeles   ... View more

Installing add-ons is not enough to populate a datamodel.  You must have indexed data that matches what the datamodel looks for and is tagged appropriately. None of the listed SE content uses a macro called `summariesonly_config`.  Creating one is likely to be the easiest way around this error.  I would set the definition to 'summariesonly=true'. ... View more

What version of the app are you using?  Does the vulnerability tool report a CVE?  What is it? ... View more

Your settings look good to me. The first problem may be with the documentation.  Submit feedback on the docs page telling them that btool doesn't match the documentation and they should update the docs. I'm not sure what can be done about the second problem other than ignoring it. ... View more