A new issue should be in a new question. ... View more

Assuming you have a "domain" field in both the lookup file and an index, this should get you started. index=foo [ | inputlookup denieddomains.csv | field domain | format ] The subsearch (inside square brackets) fetches the contents of the lookup table (I made up a name - replace it with your own), extracts only the "domain" field, then formats the results into a search string which is then returned to the main search for execution. ... View more

SmartStore has no effect on your license.  License use is determined by the amount of data written to disk, regardless of the storage method used. ... View more

The stats command will not return results for a groupBy field that is empty or null.  Use the fillnull command or enhance the eval statement to ensure the joiner field always has a value. ... View more

I assume you're referring to your splunk.com account.  I went through the same thing a few years ago.  You have to create a new account and ask the certification ([email protected]) and education ([email protected]) teams to transfer your records to the new account. ... View more

The Splunk Universal Forwarder does not need any additional software installed.  Everything it needs is in the package. ... View more

Splunk can index data locally and forward it to another system.  The assumption, however, is that the other system is Splunk. Splunk indexers can forward to non-Splunk systems, but only as raw TCP or syslog.  See https://docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Outputsconf#TCP_Output_stanzas and https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Forwarddatatothird-partysystemsd for more information. ... View more

The packet field appears to encoded or encrypted.  You would have to get with the vendor to determine how to make the field legible , if it can be done at all.  It's possible this is data straight off the wire and that you would need the SSL certificate to process the data - not something one can do in SPL. ... View more

It depends on the type of Excel file.  A .xls file is binary and so will not be ingested by Splunk.  The UF's splunkd.log file should confirm this. Newer Excel files are .xlsx, which is XML format.  That can be ingested by Splunk, but may be of limited utility if you can't interpret the XML. There's also .xlsm files, which contain macros, but I'm not sure how they're stored. Again, the UF should log a message when it's unable to monitor/ingest a file. ... View more

No changes need to be made to the data.  Just configure the HF as described earlier.  there is an app you must download from your Splunk Cloud search head. Go to the "Universal Forwarder" app and click the green download button. Install the downloaded app on the HFs. Despite the name, the app can be used on either UFs or HFs. ... View more

It would help to know what results your query returned and why those results aren't good enough. I prefer the rex command for extracting fields.  The regular expressions below look for the given keyword then extract what's between the following square brackets. | rex "Namespace \[(?<Namespace>[^\]]+)" | rex "ServiceName \[(?<ServiceName>[^\]]+)" | rex "Version \[(?<Version>[^\]]+)" | stats latest(Namespace) as Namespace latest(ServiceName) as ServiceName latest(Version) as Version by host | sort -Version   ... View more

See https://community.splunk.com/t5/Splunk-Enterprise/%E4%B8%AD%E9%96%93%E8%BB%A2%E9%80%81%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6-About-intermediate-transfer/m-p/655756#M17221 ... View more

The indexed events are not combined.  Indexed data is never changed so the events will forever remain separated.  All we can do is correlate data from the indexes and display it in an appropriate format.  You can, however, write the correlated data to a summary index using the collect command then fetch the events in the summary index to see a combined event. ... View more

The join command should produce the format you seek, but you'll be unhappy with the performance.  That's why the previous method I suggested is preferred. <<query 1>> | join <<common fields>> [ <<query 2>> ]   ... View more

There's no such thing as index-time search or script execution.  You can use transforms or Ingest Actions to act on the data before it is indexed, but there are limits to what can be done.  If you use Splunk Cloud then Edge Processor may be a solution.  There also are third-party products that may be able to help. Depending on how that data is ingested, you may be able to use a scripted or modular input instead.  That script can do anything you like to the data before it's indexed. Keep in mind that the more you try to do to the data in the indexer the slower indexing will be. ... View more

Saved searches can run as a real-time search, which means they will process events as soon as they arrive.  There is no equivalent for scripts. That said, real-time searches should be avoided.  Every real-time search is pinned to a CPU so no other searches will use the CPU (that applies to the SH and *all* indexers). Chances are a requirement for "real-time" processing doesn't mean "0 seconds delay".  A search that runs once each minute often can satisfy most requirements. ... View more

Check out the timewrap command. ... View more

Please explain what is meant by it "won't work".  What results did you expect and what did you get? The OP says "this is due to the sub-search runs before the main search, so the TotalFoo field does not exist", but none of the sample queries contain a subsearch.  What is missing from the OP? It shouldn't matter, but try removing the quotes from around the TotalFoo field.  Also, the chart command will produce unexpected results if Field4 doesn't exist (it's not referenced elsewhere in the query). ... View more

Getting the first part of the URL is pretty easy using rex. | rex "https?:\/\/(?<domain>[^\/]+)" | where domain="bar.com"     ... View more

I'm not aware of a step-by-step tutorial for creating apps, but it's pretty simple.  The hardest part may be getting the app to pass vetting by Splunk Cloud. Start by creating a directory for your app.  For example, $SPLUNK_HOME/etc/apps/my_app/default.  You can change "my_app" to anything you like, but leave the rest of the path unchanged. Create a props.conf file in the directory.  Add content to that file as necessary to parse your data.  If you add any transforms, be sure to create a transforms.conf file in the same directory. Create an app.conf file in the directory.  Populate it as specified at https://dev.splunk.com/enterprise/reference/appinspect/appinspectcheck#Appconf-standards Package the app using tar (or equivalent command) to create a .tgz file.  Do not perform this step on Windows because the file permissions will not be saved correctly. Upload the app to Splunk Cloud and review the vetting results.  Update the app to correct any failures reported.  Repeat this step until there are no reported failures. Install the app. ... View more

Splunk should not be trying to find a timestamp when DATETIME_CONFIG=CURRENT is used.  Perhaps, however, the TZ setting is overriding that.  Try removing the TZ setting. ... View more