Please share the props and transforms as well as the SPL you're using to access the lookup. ... View more

We in the community can't help with that.  Try contacting Splunk at [email protected] ... View more

You have an established connection between the forwarder and the indexer on port 9997 so there's no need for port 8889. The search query (index=_internal ...) should be entered in the Splunk UI (use the "Search & Reporting" app). The add monitor command is entered in the CLI, but the "/path/to/app/logs" argument is a placeholder (like "foo") that must be replaced by the actual file to file you wish to monitor. ... View more

Use a field name that uniquely identifies the specific alert you wish to throttle.  In this case, that field would be Account_Name since you don't want repeated alerts for users. ... View more

If the data is not getting into Splunk then there should be a log message, either on the Splunk or Tenable side, explaining why. Is the add-on installed properly? On which instance type(s) is it installed?  Is it configured? Have you confirmed network connectivity between Splunk and Tenable? ... View more

What you want is to throttle the alert.  Throttling prevents the alert from firing too often.  To turn on throttling, edit the alert and check the box labled "Thottle" then specify how long you want Splunk to wait before firing the alert again. ... View more

Yes, that is normal.  The rest command does not search for events - it returns information. ... View more

The query displays Splunk's internal log so you can try to determine why your inputs are not producing data. ... View more

If UFs always forward through HFs then only HFs need the Cloud credentials app. Are the UFs successfully connecting to the HFs?  Anything in the logs (UF or HF) that might explain what is happening to the UF data? ... View more

Documentation assumes you are in the directory where the command resides.  If you aren't then use the commands appropriate for your platform/shell to get to the correct file system location. ... View more

If nothing is being extracted then either data is not getting from AWS to Splunk or the sourcetype doesn't describe the data well enough for Splunk to extract fields. Start with splunkd.log to confirm the input is working and to see if there are any problems reported about the input or the data itself.  You can view the log with this query (assuming you have access) index=_internal source=*splunkd.log ... View more

If two sourcetypes use the exact same settings then perhaps they should be a single sourcetype.  Also, copying lines to make another sourcetype takes less effort than you've expended so far.  🙂 I've never seen anyone use a regular expression in a props.conf stanza, but it does work in inputs.conf so should work in props.conf.  The catch is the regex engine is only invoked when a wildcard is detected.  I believe that is not documented. ... View more

It's a Best Practice to send inputs to specific indexes rather than allow them to default. It's a poor practice to use index=* in a query.  Anything other than a dev/test query should use specific index names. Are the timestamps being extracted correctly? Have you checked the logs? ... View more

There is the join command, but performance of that is even worse than append.  Multisearch would be an option if the searches didn't contain non-streaming commands (stats). Perhaps someone else will have a suggestion. ... View more

Sourcetype is only one factor for finding indexed data.  You also must look in the right index(es) and in the right time window. The AWS input should have specified an index name for the data.  If it doesn't then change it to do so.  You'll use that name to search for the data.  An input without an index specified will put data into the Last Chance index (usually "main" on-prem or "lastchanceindex" in Splunk Cloud).  If you search without specifying an index name then Splunk will search your default indexes (if any), which may or may not include the AWS index. All Splunk data is time-sequenced.  If data is onboarded with the incorrect time then you'll have a difficult time finding it.  Verify the sourcetype's TIME_FORMAT and TIME_PREFIX settings match the data being ingested.  Expand the time window of your search using earliest=0 latest=+10y to see if the data is coming in with the right timestamps. Of course, check the logs to make sure there are no errors getting the data from AWS. ... View more

Understand that Splunk primarily is a  Linux product that also runs on Windows.  Most documentation you will see is written for Linux users.  Windows users need to translate "./splunk" to "splunk.exe". ... View more

Adaptive Response Actions use the same SPL as other search queries. ... View more

Check out the examples in GitHub (https://github.com/splunk/splunk-sdk-java/tree/master/examples/) ... View more

There were a few problems with the regular expression that caused it to fail to match the desired text .  Try the query below. | makeresults | fields - _time | eval _raw="<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3xxxxxxxxx}'/><EventID>4662</EventID><Version>0</Version><Level>0</Level><Task>12804</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-09-01T07:00:18.999999800Z'/><EventRecordID>35xxxx65</EventRecordID><Correlation ActivityID='{5xxxxxxxx-b61d-0004-afc0-ac531db6d901}'/><Execution ProcessID='1520' ThreadID='1628'/><Channel>Security</Channel><Computer>XXXXXXXXXXXXXX.riv</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>XXXXXXX$</Data><Data Name='SubjectDomainName'>XXXXXXXX</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>WMI</Data><Data Name='ObjectType'>WMI Namespace</Data><Data Name='ObjectName'>ROOT\CIMV2\Security\MicrosoftTpm</Data><Data Name='OperationType'>Object Access</Data><Data Name='HandleId'>0x0</Data><Data Name='AccessList'>%%1552 %%1553 </Data><Data Name='AccessMask'>0x3</Data><Data Name='Properties'>-</Data><Data Name='AdditionalInfo'>Local Execute (ExecMethod)</Data><Data Name='AdditionalInfo2'>ROOT\CIMV2\Security\MicrosoftTpm:Win32_Tpm=@::GetOwnerAuthForEscrow</Data></EventData></Event>" | rex mode=sed "s/.*(\<EventID>4662\<\/EventID>).*(\<\Data Name='SubjectUserName'>.*?\<\/Data>).*/\1\2/g"   ... View more

This thread is two years old with an accepted answer.  For better chances at getting an answer, please post a new question. ... View more

Usually, when an app takes you to its Configuration screen it's because the app is not yet configured and needs to be before it will work properly.  Have you completed the configuration?  Configuration instructions are in the Details tab of the splunkbase page. ... View more