We need more information. Are you trying to extract at search time or index time?  Are you trying keep the XML or discard it?  Please share a sanitized sample event or two. ... View more

Since the vt4splunk app uses the VirusTotal API, it will not work off-line. ... View more

Make sure you're running the search in Verbose mode.  In Smart mode, Splunk only extracts fields explicitly referenced in the query. ... View more

Thanks.  I don't have a lot of experience with the JSON functions, but I think this should help. index=index1 sourcetype=sourcetype1 hostname=* software != "" | eval software=mvexpand(json_array_to_mv(software) | rex field=software "cpe:\/a:(?<Vendor>[^:]+):(?<Product>[^:]+):(?<Version>.*)" | table hostname, Vendor, Product, Version | dedup hostname, Vendor, Product, Version  The idea is to convert the software field from a JSON array into a multi-value field so it can be split into separate events using mvexpand. ... View more

There is no one API that will return all of the KOs owned by a given user.  You will have to combine multiple API results to get the full list. | rest /services/saved/searches ``` Searches, reports, alerts ``` | rest /services/data/ui/views ``` Dashboards ``` | rest /services/data/macros ``` Macros ``` | rest /services/data/lookup-table-files ``` Lookup files ``` | rest /services/saved/eventtypes ``` Eventtypes ``` Those are some of the more common ones.  See other available API endpoints using | rest /services/data or | rest /services/saved ... View more

Either the data in the summary index is incorrect or it's being used incorrectly.  Was the data written using an si* (sistats, sichart, sitimechart, etc.) command?  If so, then it must be read using the same query and the non-si (stats, chart, timechart, etc.) command. Tell more about the two queries and we may be able to be more specific. ... View more

So, mvexpand may work, but it depends on how you got into this position to begin with.  What's the query? ... View more

Check out the filldown command. ... View more

Use the relative_time function to calculate time offsets. | eval new_time = relative_time(now(), "+1d@d+10h") The format string breaks down as follows: "+1" : this time tomorrow "@d": round off the time to 0:00 "+10h": add ten hours   ... View more

It's possible Splunk doesn't like the \b metacharacter.  Try this alternative. SEDCMD-redact_ssn = s/(\D)\d{3}-?\d{2}-?\d{4}(\D)/\1XXXXXXXXX\2/g I also modified the regex to preserve the characters before and after the SSN and to make the hyphens optional.   ... View more

Use the frozenTimePeriodInSecs setting in indexes.conf to control how long data lives in the index. [myindex] frozenTimePeriodInSecs = 604800   ... View more

If you're new to Splunk, I strongly recommend you NOT install multiple instances of Splunk on the same server.  Doing so is a tricky practice that requires more than just separate subdirectories.  You must also ensure each instance uses different ports and that those ports are configured on other instances correctly. If you install instance per server then you can keep the home directory as the default /opt/splunk and avoid the problem you are having. I suspect the problem stems from the home directory assigned to the user running Splunk.  Try changing that directory to /opt/splunk_sh. ... View more

When the servers reboot do they reload the Golden Image?  If so, they will not retain their GUID. ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

You do not need double parentheses.  Verify the parentheses and quotation marks match.  Share your exact query if you need an extra set of eyes to look at it. ... View more

Have you tried putting quotes around the group names? | eval GR=case(host=5087, "GR2", host=7750, "GR1", host=7751, "GR1", host=7752, "GR2") | stats count by GR ... View more

Yes, that could be a problem.  Did you upload a file? ... View more

Write a script that uses the REST API to pull a list of saved searches, filters on your name, then updates them with the new TTL.  See https://docs.splunk.com/Documentation/Splunk/9.2.0/RESTREF/RESTsearch#saved.2Fsearches ... View more

If a case function returns no value it's because none of the expressions matched.  Adding a default expression | eval foo = case(..., 1==1, "???") will help flag edge cases that don't match the other expressions. In this instance, it seems the first expression needs some wildcards unless you're looking for an exact match. | eval Status=case(like('message',"%Exchange Rates Process Completed. File sucessfully sent to Concur%"),"SUCCESS", like('TracePoint',"%EXCEPTION%"),"ERROR")   ... View more