thanks for replying. I believed this would be the answer but any suggestions for below xml ? for the time range changes in dashbaord for the saved report. where _time >earliest AND _time ... View more

Thanks, with just a few modifications I have exactly what I was looking for. This is what I now have: (index=ldap_csv) OR (index=syslog_main AND sourcetype="linux_secure" AND source=/var/log/secure AND vendor_action="Accepted") | eval user=if(index=="ldap_csv", uid, user) | eval host=if(index=="ldap_csv", extracted_host, host) | stats count AS total_logins, min(_time) AS first_login max(_time) AS last_login dc(index) AS index_count values(index) AS indexes BY host user | search indexes="ldap_csv" | fieldformat first_login = strftime(first_login, "%m/%d/%y - %I:%M:%S:%p") | fieldformat last_login = strftime(last_login, "%m/%d/%y - %I:%M:%S:%p") | eval total_logins=total_logins-1 | eval first_login=if(first_login==last_login,"",first_login) | eval last_login=if(first_login=="","",last_login) | table user host first_login last_login total_logins index_count ... View more

One option is to update your inputs.conf with the new sourcetype name under the monitor stanza and also add the following and restart the forwarder crcSalt = reindex Really any unique value for the crcSalt will work You should get all data reindexed for that monitor rule One other option would be to remove the fish bucket on the forwarder and restart however that would reindex all sourcetypes on the host ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

I've heard rumors it will be released at Splunk Conf 2019. ... View more

Could you please provide an example ... View more

And , I see an ancient message on the splunkd.log, say: 05-09-2019 13:46:11.904 -0400 ERROR SHCMaster - Search not executed: The maximum number of historical concurrent system-wide searches has been reached. current=108 maximum=105 for search: admin;xxxxxxxxx But I don´t how obtained this value: 105 ?? ... View more

To load Windows system variables use %SPLUNK_HOME% But it does not recognize the blank. ex) C:\Program Files\Splunk So we need to change ex)C:\\"Program Files\"\Splunk or You use Windows system variables ex) set SPLUNK_HOME="C:\Program Files\Splunk" need double quotes ... View more

Hi Kamilo, I'm searching for that same diagram, are you able to forward at this point? Thanks! ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

I opened an enhancement request followed by a prayer 🙂 ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

I was able to work with our sales rep. It seems you can purchase additional Splunk Cloud search heads either connected to your existing Splunk Cloud indexers in Splunk Cloud or a standalone(all-in-one) Splunk Cloud instance. They require a minimum additional purchase of 5GB of Splunk Cloud license. ... View more

Without a sample, this is a bit harder. But try in general combining the two into one thing, grouping on ASSETID with a count, then just selecting those with a count of 1. The idea would be that if it had both items, count would be two, if it had only one, it would have one. I'm going to assume there's a field called, let's say "message" that is the contents of those strings, so a message of "Received the content for checking further" and one message of "Successfully completed the check and returned back the result". If this is not the case, you should create those extractions. Or you could built a tag for them. Or event type. Whatever, something like that. So, perhaps, again assuming the field message as described above: search index=storeapp (message="Received the content for checking further" OR message="Successfully completed the check and returned back the result") | stats count, list(message) BY ASSETID | search count>1 This may or may not work as is - probably not, but again we don't have sample events to really work with here. You give us pseudo-events, we give you pseudo-answers. 🙂 Anyway, I do hope that helps! Do write back with more detail if this isn't what you need, or if it's half of it but not quite perfect yet. Happy Splunking, Rich ... View more

Would be good to have a tentative release schedule for major Splunk Cloud versions i.e. 7.0, 7.x, 7.1, 7.2 if they are going to be different dates than Splunk Enterprise as certain apps do have dependencies based on Splunk version. I'm also not wanting to have any existing on-prem users use cloud until it gets to 7.1.x as I will have to detail why it's different than our on-prem release. Long term would likely have our on prem-release version follow the Clould version so I can keep them more or less in sync. Thanks, Rob ... View more

Nothing will happen to them. They will continue to function, but are not supported by Splunk. ... View more

Shared datamodels are available as of Splunk 8x https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Sharedatamodelsummaries ... View more

An http event collector (hec) is essentially a heavy forwarder with the special hec listener. You would use the same sort of outputs.conf that you would use on any search head or heavy forwarder to route logs to your downstream indexers. Example outputs.conf config: # BASE SETTINGS # TURN OFF INDEXING ON SEARCH HEAD OR HEAVY FORWARDER [indexAndForward] index = false [tcpout] # FORWARD ALL INTERNAL LOGS forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = forwardedindex.2.whitelist = # round robin to all indexers defaultGroup = all_indexers [tcpout:all_indexers] server = host500.acme.com:9997,host501.acme.com:9997,host502.acme.com:9997,host503.acme.com:9997,host504.acme.com:9997 ... View more

I would say the 6.6.x release is probably the most compatible release with apps and technical addons. You will need 7.0.x if you want to use the new metrics type indexes. Right now I have most of my instances running 7.0.2 and a few heavy forwarders still running 6.6.6 for compatibility of a few technical addons. As far as stability, I usually wait for the .1 release to come out before going to a new version in production. i.e. 6.6.1 or 7.0.1 or higher. 6.6.6 will have the latest patches for the 6.6 release. Rob ... View more

total_raw_size: essentially uncompressed bytes indexed on this indexer for this index total_size: essentially size on disk for after compression and indexing metadata on this indexer for this index On average it will be normal for total_size to be 50% of total_raw_size. ... View more

The specific point is that with systemd enabled, splunk stop and splunk start work just fine as a non-root user (the splunk user) on my servers. If you can describe the issue well then raise an idea on ideas.splunk.com/ and vote for it! The documentation for ideas is worth a read if you haven't used the site before ... View more

you can disable kvstore on your indexers...... don't delete the directory..... although I guess the one in /opt/splunk/var/lib/splunk would be okay, but the other one in your new SPLUNK_DB will most likely get re-created all the time.. The flat file dumps are in var/run/searchpeers in the bundles that are sent over. ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more