Change the drilldown for the "Logins by Country" panel to direct to the correct search. ... View more

Thanks for info, honestly I was afraid about it, but it is good to get confirmation from someone well experienced. Just for clarification - it means, that all records related to particular search are deleted from search.log file 10 minutes after search was performed (with default setting)? ... View more

You don't find it, you make it up.  Splunk will create the file as part of the backup process. ... View more

Really helpful thank you. ... View more

There are multiple potential issues here, how many of the users are you seeing/missing? With that tech note I recently experienced the issue and created a search to detect in Alerts for Splunk Admins  Or github link there is an alert : "SearchHeadLevel - authorize.conf settings will prevent some users from appearing in the UI" So that can find if you did hit that particular issue. Other potential issues might be the query limit of the LDAP, you can enable paged queries from Splunk *or* it could be the ldap users to precache limit... ... View more

Is there a way?  Probably.  If it was easy, though, Splunk wouldn't have bought UBA. ... View more

That format is fairly straightforward to parse with rex as long as the field order is constant. | rex "duration\\\":(?<duration>\d+),\\\"type\\\":\\\"(?<type>[^\\\"]+)\\\",\\\"direction\\\":\\\"(?<direction>[^\\\"]+)\\\",\\\"action\\\":\\\"(?<action>[^\\\"]+)\\\",\\\"result\\\":\\\"(?<result>[^\\\"]+)" The "extra" backslashes are there to escape the embedded quotation marks. ... View more

Co-locating the DS and CM is something you may be able to get away with, but it's not a good practice.  As the Splunk environment grows and becomes busier, the DS and CM will compete for resources and the indexer cluster will suffer for it.  See "Management / Utility Tier Recommendations" in the Splunk Validated Architectures manual (https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf) ... View more

https://docs.splunk.com/Documentation/Splunk/8.1.3/Updating/Howdeploymentupdateshappen ... View more

Yes, I always include something in the Message field. ... View more

Have you already read those read me first etc. instructions where is told what you must do and ensure before updates? And have you fixed those blockers and preferably also warnings give by platform upgrade readiness app? r. Ismo ... View more

Contact your Splunk account/sales rep.  He or she will have the tools to make that calculation for you. ... View more

There is no built-in function to do that so you'll have to do it manually.  Start with a simple replace: | replace "+" with " days " in Total For something a little more complex, try rex: | rex field=Total "(?:(?<days>\d+)\+)?(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval Total = if(isnull(days),0,days)." days ".hours." hours ".minutes." minutes ".seconds." seconds"   ... View more

DB Connect has its own logs named splunk_app_db_connect_*.log. The network said "outgoing to 1433 is opened for all Splunk instances", but that's only half the story.  Does the DB server accept incoming connections from the Splunk servers? From the Splunk server running DBX, try running traceroute to the DB server to see what it reports. ... View more

I can't help with the transform.  Try posting a new question with the transform in it. ... View more

The time picker looks only at the _time field, not sys_created_on or any other.  Any filtering on other time fields has to be done manually.  If sys_created_on is in epoch (integer) form then this may help. SEARCH | dedup dv_number | addinfo | where (sys_created_on >= info_min_time AND sys_created_on <= info_max_time | table sys_created_on dv_number dv_u_username_id assignment_group_name dv_assigned_to dv_u_workstation_ci dv_cmdb_ci dv_u_location_1 description dv_close_notes u_last_3_worknotes dv_close_notes | rename sys_created_on AS "Created On", dv_number AS "Incident Number", dv_u_username_id AS "Username", assignment_group_name AS "Assignment Group", dv_assigned_to AS "Assigned to", dv_u_workstation_ci AS "Workstation ID", dv_cmdb_ci AS "CI" dv_u_location_1 AS "Location", description AS "Description", dv_close_notes AS "Closing Notes", u_last_3_worknotes AS "Last 3 Work Notes", dv_close_notes AS "Closing Notes" | sort by "Incident Number" desc If sys_created_on is a text field ("04/21/2021", for example) then it must be converted to an integer using the strptime function.  That's left as a exercise for the reader. ... View more

Try adjusting the  time_before_close and  multiline_event_extra_waittime settings in inputs.conf for that file. ... View more

My intent is to use the contents of the lookup file as part of a general text based search against all events that fall in line with the index and sourcetype I've defined. For example: If the string "cookie1" appears anywhere in an event (regardless of field), I want that event reflected in my table. The table should reflect all events that contain "cookie1", "cookie2", etc. My use of the special sub-search field "query" comes from this Splunk community post: https://community.splunk.com/t5/Splunk-Search/Subsearch-fields-quot-query-quot-quot-search-quot-How-do-I-know/m-p/62422 I'm able to use "query" to successfully perform the search I've detailed above (my table shows _time, field1 and field2 for all matching events as expected), but I'm unable to show the lookup entry that matched the event in my table as a result.  So, I suppose the question is: How can I perform the text based search I need and still be able to reference the lookup entries in my table?  The use of "query" seems to be restricting my ability to do that. ... View more

I didn't know the coalesce command. Works perfectly now with that. I just had to modify my dashboards.   Thank you very much! ... View more

Python could be a completely practical programming language that will do something virtually the other language can do, at comparable speeds. Python is capable of threading and GPU processing just like the other language. Most of the information process modules are literally simply Python wrappers around C/C++ code. Python Training in Pune ... View more

Thank you so much! 10/10 ... View more