If you're on a Victoria stack then you may be able to run DBX on your Splunk Cloud search head.  It cannot be run on a Classic stack. Making DBX queries from Splunk Cloud may not work properly, however, since it's unlikely your SQL database allows connections from the Internet (which it would need to do to for Splunk Cloud to query it). ... View more

Have you tried resetting the password? ... View more

The Upgrade Readiness App ships with Splunk and so should not be upgraded separately.  That Splunk allows it to be upgraded is a mistake, IMO. You can try downgrading the app or just live with the file integrity warnings. ... View more

Splunk doesn't care what flavor of Linux you use.  As long as the kernel is a supported version you'll be fine. ... View more

How can the servers be secret if they're logged in Splunk?  😀 Splunkbase may have add-ons that help parse the logs, but they're unlikely to be listed as "secret".  Use the vendor or product name to search for relevant add-ons. Chances are, however, that you'll need to build your own add-on.  It's not hard - an add-on is just a collection of .conf files (mainly props and transforms). The process can be made easier by exporting the problematic events to a file (use "raw" mode).  Use the Add Data wizard to upload the file and experiment with settings until you find the right ones to parse the events.  Then you can copy those settings into your add-on. Upload the add-on to Splunk Cloud and see how it improves parsing.  Iterate as necessary. ... View more

What have you tried so far?  Is the sAMAccuontName field already properly extracted (the complete value is present)? ... View more

The message pretty much says what you need to do. Login to the HF and open the Search & Reporting app.  Click on the Dashboards tab then select "Integrity Check of Installed Files".  That dashboard will list the files that failed integrity checks. To fix them: 1) Undo any changes made to the files or restore them from the download file that installed them. 2) NEVER change a file in a 'default' directory. ... View more

Alerts are automated.  That is their nature.  Configurations can be manual, but are a one-time action. Remember that each time an alert runs it is independent of other runs (context-free).  If you need context, other than what is provided by the throttling option, then you'll have to implement it yourself. Triggering users/devices can be saved in a lookup file, KVStore, or (as @ITWhisperer suggested), a summary index.  The alert would need to consult the saved list to see if a new alert should be triggered or not. ... View more

Throttling of alerts is not done using SPL.  To enable throttling, edit the alert and check the "Throttle" box. Enter the time between alerts and click Save.   ... View more

That cron schedule means the task will run every 10 minutes from minute 1 of each hour until minute 30 of the same hour.  IOW, it will run at :01, :11. and :21.  It will not run again until :01 of the next hour. See https://crontab.guru for a great website for checking cron expressions.  Click the "next" button to see how an expression maps to run times. ... View more

While Splunk has been a "cloud-first" company for a few years now, there are too many large customers who can't or won't switch to Splunk Cloud to make it worthwhile for Splunk to drop their non-cloud offerings.  But one can never say "never", hence the "foreseeable future" phrase.  I expect to be retired by the time Splunk goes cloud-only, though. Until then, skills around on-prem Splunk still are in demand.  Even Splunk Cloud customers have need to run on-prem instances so the need for people who know how to run them will be there for a long time. ... View more

There is no "query below" in the OP. There should be a 'reason' field in the events that explains the info field. ... View more

Your query is pretty close.  Try the where option to inputlookup and use the format command to put the subsearch results in the right format. | inputlookup lookup1.csv where NOT [| inputlookup lookup.csv | field fullname | format ]   ... View more

The rex command is for extracting fields using regular expressions.  What fields do you need to extract from those events? If you just need to find events with either of those strings then you don't need rex at all.  Just put the strings in your base search.   index=foo ( "appl has successfully completed all authentication flows." OR "Login complete" )   ... View more

Search your index of Windows event logs (often wineventlog or windows) for the event code corresponding to a user account deletion.  See https://ultimatewindowssecurity.com for the event code. ... View more

Compare lastseen to the current time (value produced by the now() function) before converting the format. | tstats latest(_time) as lastseen where (index=windows) by host | where lastseen <= relative_time(now(), "-24h") | convert ctime(lastseen)   ... View more

Perhaps, in the absence of maxVolumeDataSizeMB, Splunk is using a low value for the size of the volume and trimming data to "fit" that lower value. ... View more

There is no Splunk forwarder for iPhones.  However, you should be able to use your MDM solution to collect the information you seek. ... View more

The volume settings should include maxVolumeDataSizeMB so Splunk knows how large the volume is (or at least how much it can use).  Each index can use individual maxTotalDataSizeMB settings to control how much of the volume they can consume. ... View more

Splunk is free to use on your Windows workstation.  Just download it from splunk.com and install it. Use the Windows Command Prompt app for the CLI.  Remember to use ".\splunk.exe" instead of "./splunk" in commands. ... View more