It depends on how often bundles are rebuilt on your system.  Start with 4 hours and add or subtract as necessary. ... View more

If you have CLI access then you can get that by looking at $SPLUNK_HOME/share/splunk/3rdparty/Copyright-for-CherryPy-*.txt. ... View more

It may not be all-inclusive, but you can get lookup file sizes from the audit index. index=_audit isdir=0 size lookups action IN (update created modified add) | stats latest(eval(size/1024/1024)) as size_mb latest(_time) as _time by path ... View more

We've been through this exercise several times now.  Show us what you've learned.  What have you tried as a means of extracting fields from those events?  What were the results?  Have you at least identified what fields must be extracted? ... View more

The _raw field is where Splunk stores the raw event.  Many commands default to that field and a few work only on that field.  The spath command defaults to _raw, but you can use spath input=_raw, if you wish. The example event looks fine to me and passes checks at jsonlint.com. ... View more

Add the prestats option to the tstats command.  That will format the results for timechart to use. | tstats prestats=t count where index IN (index1, index2, index3) by _time , host | where match(host,"^.*.device.mycompany.com$") | timechart count by host   ... View more

I added data to the SPL because I don't have your data indexed in my Splunk.  Since you have the data indexed, you can skip that part of my example query.  You may need to change the spath command argument to match your events. ... View more

If you use an installer (as opposed to expanding a tarball) then the user was created for you and all files were given to that user. To be able to read local files, check out this document: https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Installleastprivileged . It's written for forwarders, but may work for Splunk Enterprise, as well.  If it doesn't work then you'll need to change file permissions or add user 'splunk' to a group that has read access to the file(s). ... View more

I like to use WinSCP for transferring files between Windows and Linux systems. ... View more

The process for upgrading standalone and distributed Splunk installation is the same.  For distributed environments, there is a prescribed upgrade order.  See https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/HowtoupgradeSplunk and https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/UpgradeyourdistributedSplunkEnterpriseenvironment ... View more

Nothing will happen.  Splunk will run just fine when installed as root.  Doing so, however, is not a good security practice.  Everything Splunk does will be as root - including any unknown vulnerabilities.  User scripts will run as root, which means they have the potential to cause great harm to the system. Install Splunk as a normal user.  User "splunk" is common.  If it's necessary to install using root (when using rpm files, for instance), then use the chown command to give ownership to 'splunk' afterwards. ... View more

I find it interesting that you claim the spath command does not work yet none of your searches use spath.  The command won't work if it isn't invoked.  See my example above. Once the spath command has extracted the fields, then you can reference those fields in other commands. ... View more

"topic" is not a recognized value for the SOURCE_KEY field.  Try using these transforms: [setindexHIGH] SOURCE_KEY = _raw REGEX = ("topic":\s*"audits") DEST_KEY = _MetaData:Index FORMAT = imp_high ... View more

What is incorrect about the first search? ... View more

Yes, but it is not recommended. ... View more

I left out an important step.  Please try my revised answer. ... View more

Please explain what you mean by "spath does not work".  It works for me in this run-anywhere example (escape characters added to satisfy the SPL parser).  What is your query?  What results do you expect and what do you get?     | makeresults | eval data="{\"time\":\"time_here\",\"kubernetes\":{\"host\":\"host_name_here\",\"pod_name\":\"pod_name_here\",\"namespace_name\":\"namespace_name_here\",\"labels\":{\"app\":\"app_label\"}},\"log\":{\"jobId\":\"job_id_here\",\"dc\":\"dc_here\",\"stdout\":\"{ \\\"Componente\\\" : \\\"componente_here\\\", \\\"channel\\\" : \\\"channel_here\\\", \\\"timestamp\\\" : \\\"timestamp_here\\\", \\\"Code\\\" : \\\"code_here\\\", \\\"logId\\\" : \\\"logid_here\\\", \\\"service\\\" : \\\"service_here\\\", \\\"responseMessage\\\" : \\\"responseMessage_here\\\", \\\"flow\\\" : \\\"flow_here\\\", \\\"log\\\" : \\\"log_here\\\"}\",\"level\":\"info\",\"host\":\"host_worker_here\",\"flow\":\"flow_here\",\"projectName\":\"project_name_here\",\"caller\":\"caller_here\"},\"cluster_id\":\"cluster_id_here\"}" | spath input=data | transpose   And the results   ... View more

The AND operator works within a single event.  To combine multiple events you need to use an aggregating command.  Assuming the customer number has been extracted into a field called "customer" then this will trigger an alert if any customer does not have all three events. <<some search for S1, S2, and S3>> | stats count by customer | where count < 3   ... View more

Using the mvexpand command twice breaks any association between the values.  Instead, combine the fields, use mvexpand, then break them apart again. | eval logMsgTimestampInit = logMsgTimestamp | eval ID_SERVICE= mvappend(ID_SERVICE_1,ID_SERVICE_2) , TYPE= mvappend(TYPE1,TYPE2) | eval pair = mvzip(ID_SERVICE, TYPE) | mvexpand pair | eval ID_SERVICE = mvindex(pair,0), TYPE = mvindex(pair, 1) | table ID_SERVICE TYPE   ... View more

The user context is the name of account under which the job runs.  In most cases, it's the name of user running the search, but some scheduled searches can be set to run as the owner.  In the specific case of user context = splunk-system-user, that is the name used when a search has no owner (owned by "nobody"). ... View more

It would help to know what you've tried so far, but perhaps this will help. | rex "] (?<field>.*?):" ... View more

From the Installation Manual Upgrading Splunk Enterprise directly to version 9.0 is only supported from versions 8.1.x and higher. Upgrading a universal forwarder directly to version 9.0 is supported from versions 8.1.x and higher. See https://docs.splunk.com/Documentation/Splunk/9.0.1/Installation/AboutupgradingREADTHISFIRST ... View more

How did you make the change?  If you used the GUI then it's possible the change never propagated (I've heard rumors about this happening).  Config changes on Splunk Cloud should be made in an app which you then upload and install. ... View more

Computer terms can be confusing since they often have several meanings. "source" is where the data comes from.  In Splunk metadata, the source is the name of the file from which the data originated.  "source" can also refer to the originating server or app. "endpoint" usually refers to a user workstation, but a specific REST command is also an endpoint. ... View more