It's more efficient to filter before dedup.  It means fewer results are returned to the search head for processing. I believe you do not need to escape backslashes in strings.  | where username!="NAM\OT00564" should be sufficient. ... View more

Make a copy of $SPLUNK_HOME/etc using your favorite tool. ... View more

The in function used with the where command has a very different syntax from the IN operator used with the search command.  An additional complication is neither in nor IN work well with the multi-value fields returned by stats.  For that, you probably want mvfind or do the filtering before stats. index IN ("pisupport", "pisupport-np") sourcetype=PIMessage ("procbook" AND "Successful Login") | rex field=_raw "Identity\sList:\s(?<identity>[^.]+)" | rex field=_raw "Username\s:\s(?<username>[^.]+)" | stats count AS Total_Connections, latest(_time) AS Latest_Timestamp, values(identity) AS Security_Mapping, values(host) AS Connected_Hosts, values(username) as LanID by username | eval discard=if(isnull(mvfind(LanID, "NAM\\OT00564|NAM\\CHawki5")),1,0) | where discard=1 | sort - Latest_Timestamp | eval Latest_Timestamp=strftime(Latest_Timestamp, "%Y-%m-%d %H:%M:%S") | table Latest_Timestamp, Total_Connections, LanID, Connected_Hosts, Security_Mapping   ... View more

There is an interim upgrade required before 10.0.2.  See https://help.splunk.com/en/splunk-enterprise/administer/install-and-upgrade/10.0/upgrade-or-migrate-splunk-enterprise/how-to-upgrade-splunk-enterprise#upgrade-paths-to-version-10.0-0   ... View more

Make sure you have the correct URL for your platform.  See https://help.splunk.com/en/data-management/collect-http-event-data/use-hec-in-splunk-cloud-platform/set-up-and-use-http-event-collector-in-splunk-web#send-data-to-http-event-collector-on-splunk-cloud-platform-0 There is a prefix required (http-inputs-) and the endpoint should end with "/event" or "/raw". ... View more

Probably, but the supported approach is to upgrade UFs last. CM/LM/MC SHC Deployer SHC members Indexers Intermediate Forwarders Universal Forwarders ... View more

If the data has a different sourcetype from that expected by the add-on then the add-on's field extractions will not be used.  Changing the sourcetype to fortigate_log in inputs.conf should fix it. ... View more

There are a few ways to onboard data into Splunk. Install a universal forwarder on the server to send log files to Splunk Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog Use the server's API to extract data for indexing Use Splunk DB Connect to pull data from the server's SQL database. Have the application send data directly to Splunk using HTTP Event Collector (HEC). ... View more

Responses to what?  How high is the roof?  How are you measuring it? When did you upgrade to Splunk 10?  Do all hardware meet or exceed the Recommended Hardware specs? ... View more

Since the data is not structured as expected by the "default add-on", you will have to craft your own add-on to parse the fields. ... View more

That's worth trying. ... View more

Splunk has a host field that identifies the sending server, but there is nothing built-in that identifies the source location (site, IP, etc).  You would need to add fields to include that information.  Use INGEST_EVAL in transforms.conf to do that. ... View more

What are looking at to determine there is an indexing delay?  Another possibility is event timestamps are not honoring the correct time zone and so events just *appear* to be delayed. ... View more

A field that will only accept a standard email address certainly will not accept a PowerShell script. ... View more

Splunk probably expects a dot and TLD in the domain name of the email address.  Go to https://ideas.splunk.com to ask for support for local email addresses.  Until that is added, use a standard email address. ... View more

That you are ingesting Management events, but not Network Activity events tells me there is an input defined for the former, but not the latter.  Perhaps this is not the intent, but it is the effect. Can you share the CloudTrail input(s)? ... View more

You need an input to tell Splunk to ingest the Network Activity data. ... View more

Have you configured and enabled an input as described in https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudTrail/ ? P.S. It appears the version 7.10.0 is no longer available to consider upgrading to 7.11.0 or newer. ... View more

We need more information. Are you saying to want to send data collected by Splunk to GCP?  Is that all data or just some of it? Can you be more specific about the destination?  Saying "GCP" is like saying "AWS".  Both offer a large number of services with different requirements and capabilities. What is your SIEM? It may be necessary to write code that uses the API to fetch data and then ship it to GCP. ... View more

Does your Splunk Cloud stack have REST API enabled (it's off by default)?  If not, open a support case. Is the IP address of the server running the script on your stack's IP Allow List?  If not, get a Splunk admin to add it. ... View more

They are not "steps".  They're separate checks/measures to perform to try to alleviate delayed searches. See https://help.splunk.com/en/splunk-enterprise/get-started/deployment-capacity-manual/9.4/performance-reference/reference-hardware and https://help.splunk.com/en/splunk-enterprise-security-8/install/8.1/planning/minimum-specifications-for-a-production-deployment Enterprise Security is a very resource-intensive application.  Therefore, it is recommended to install ES on a separate Splunk instance.  It can, however, share indexers with other search heads. This should require no explanation. Real-time searches pin themselves to a CPU, preventing other searches from running there.  Don't use real-time searches.  See https://help.splunk.com/en/splunk-cloud-platform/search/search-manual/9.2.2406/search-and-report-in-real-time/about-real-time-searches-and-reports for more. Entire books could be written on making searches more efficient.  Splunk has one at https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.4/optimizing-searches/about-search-optimization Allow Skew gives the search scheduler permission to adjust the run time of a scheduled search to one with fewer other searches scheduled.  Search Windows allow the scheduler to delay the start of a scheduled search in the event that resources are not yet available.  See https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.0/report-management/offset-scheduled-search-start-times and https://www.splunk.com/en_us/blog/platform/schedule-windows-vs-skewing.html There is a strong tendency among Splunk users to run their scheduled searches at the top of an hour.  At most of the customers I've visited, this accounts for about half of all scheduled searches and is a source of most of their delayed and skipped searches.  It also doesn't account for the 30-90 seconds of delay between when an event is generated and when it is searchable by Splunk.  It's far better to use a cron schedule to have the search run at 2-3 minutes after the hour.  Other peak search periods to avoid are 15, 30, and 45 minutes into any hour of the day. Splunk's Workload Management feature gives Splunk admins some control over how resource contention (CPU and memory) is handled.  It also can be used to stop long-running searches, prevent real-time searches, and prevent users from running searches during peak times.  See https://help.splunk.com/en/splunk-enterprise/administer/manage-workloads/9.4/workload-management-overview/about-workload-management for details. I've seen plenty of instances where a reports run once a day or even every week at 8 or 9 in the morning.  This usually is unnecessary and takes away "slots" from other searches.  Instead, these types of "batch" reports should run in less busy times of day such as 3am or on weekends.   ... View more

If there were no events in the last 24 hours then there is no last timestamp to display. The only way to get the timestamp would be to join the current search with one that scans the logs for the most recent entry for each sourcetype in some larger time window (perhaps 30 days). ... View more

It's not clear if you want to correlate Splunk data in your ITSM product or ITSM data in Splunk. There are a few ways to onboard data into Splunk. Install a universal forwarder on the server to send log files to Splunk Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog Use the server's API to extract data for indexing Use Splunk DB Connect to pull data from the server's SQL database. Have the application send data directly to Splunk using HTTP Event Collector (HEC). There are REST API calls available for getting data out of Splunk. Let us know which you are trying to do and we'll point you toward to relevant docs.   ... View more