Add the props.conf file to an app and upload the app to Splunk Cloud. ... View more

Access to an index is all or none.  Splunk does not have a means for selective access to data within an index.  In fact, one of the criteria for creating a new index is different security needs.  IOW, each customer's data should be in its own index(es). You can try defining a search filter (customer=foo, perhaps) for the end user, but that will apply to all indexes and so may not be a workable solution. ... View more

What do you have so far?  Do you have the two searches you want to combine? ... View more

No problem just removing .meta files. Correct. ... View more

MaxMind offer a database you download to map lat/long to time zone, among other fields.  The database can replace that used by Splunk for the iplocation command or you can use the CSV version of the DB as a separate lookup table.  A subscription may be required.  See https://www.maxmind.com/en/geoip-databases ... View more

The documentation is correct.  Once you go to SmartStore you can't go back; anything else would be a Science Experiment. Switching to SmartStore (S2) should not have caused the problems you listed. Search performance can be affected if the S2 cache is too small or users have a tendency to search over more than 30 days. Is SmartStore in the same environment as your indexers?  Using a cloud S2 with on-prem indexers is likely cause problems and be expensive. ... View more

With which part of the task do you need help?  What have you tried so far?  Have to seen the Website Monitoring app (https://splunkbase.splunk.com/app/1493)? ... View more

Restart the CM first. ... View more

Here's an untested idea.  Install an HF on the server and use Splunk's Ingest Actions feature to write the data to S3.  It's not clear if the HF will be happy only writing to S3 or if it also will want to send to an indexer. See https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/DataIngest#Heavy_forwarders_managed_through_a_deployment_server for details, including the need for a Deployment Server. ... View more

Please tell us more about the environment.  Can the server relay data to Splunk via an intermediate forwarder?  Why is an HF installed instead of a Universal Forwarder (UF)?  UFs have a much smaller footprint and attack surface. ... View more

Does it have to use an HF?  The Export Everything app (https://splunkbase.splunk.com/app/5738) can write to S3 ... View more

The syntax you gave is the right one for adding a new SH to a cluster, but you don't need it just to install ES on an SH.  Create a new SH and install ES on it using the instructions in the ES manual. ... View more

The ES SH should be kept separate and not joined with the existing SH into a cluster because: 1) you need at least 3 SHs to make a cluster; 2) SHs must be virgin to form a cluster; 3) ES doesn't play well with other apps and so needs to be on its own. ... View more

The appendcols command runs after the main search, but it's true the subsearch has no awareness of fields outside the subsearch.  Thanks for pointing that out, @bowesmana  ... View more

It would help to see the props.conf settings for that sourcetype, but these should get you started: [mysourcetype] LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d\d\dT EVENT_BREAKER = ([\r\n]+)\d\d\d\d-\d\d\d\dT EVENT_BREAKER_ENABLE = true SHOULD_LINEMERGE = false TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z MAX_TIMESTAMP_LOOKAHEAD = 30 TRUNCATE = 10000 ... View more

The RHS of arguments in the savedsearch command is expected to be a string rather than a field name.  You might try putting the value in single quotes to see if the forces it to be treated as a field. | appendcols [| savedsearch "Events_list" perc='Critical'] There's a wrinkle, however.  The Critical field is multi-value (because of the values function) and most commands don't work well with multi-value fields. ... View more

Subsearches produces results like (field1=foo OR field2=bar), which not fit the syntax of the IN operator.  However, since IN maps to a sequence of ORs under the coverts, you can use the subsearch without using IN. | append [| tstats summariesonly=true allow_old_summaries=true values(All_Traffic.dest_port) as dest_port values(All_Traffic.protocol) as protocol values(All_Traffic.action) as action values(sourcetype) as sourcetype from datamodel=Network_Traffic.All_Traffic where (All_Traffic.src_ip [| inputlookup internal_ranges.csv ]) AND NOT (All_Traffic.dest_ip [| inputlookup internal_ranges.csv ]) AND NOT (All_Traffic.protocol=icmp) by _time All_Traffic.src_ip All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` | lookup ip_iocs.csv ioc as dest_ip OUTPUTNEW last_seen]   ... View more