Hi, I use the below curl command to disable the alert which works fine. curl -k -u admin:password https://<host>:<mgmt_port>/servicesNS/<user_context>/<app_context>/saved/searches/<search>/disable -X POST   But i am trying to hide the username and password in the below shell script but getting unauthorized exception,  SCRIPT_DIR=/tmp/ USER=$(cat $SCRIPT_DIR/.nonprodusr.txt) PWD=$(cat $SCRIPT_DIR/.nonprod.txt) curl -k -u $USER:$PWD https://<host>:<mgmt_port>/servicesNS/<user_context>/<app_context>/saved/searches/<search>/disable -X POST   ... View more

Hi, I have a report which is scheduled to run every day at 8 AM.  Is it possible to generate that report to email address X by executing a command via CLI ? ... View more

Hi,   i would like to give admin access to specific user 'Admin' access to specific app, how do i accomplish that? ... View more

Hi, I need some help with the regex, Currently we have below two paths, note the naming format is different for the log files \\path\\to\\my\\app\\folder\userx-test-cpuissue.log \\path\\to\\my\\app\\folder\usery-cpuissue.log   I wrote a regex to extract user and issue, but it is not able to pick userx since the log format is different i.e. userx-test-cpuissue.log. How do i wrote a single regex which could extract both the naming formats? \\\\(?<source>\w+)-(?<issue>\w+)\.log$ ... View more

Hi,   I am trying to update a app in our splunk environment, when i click on "install app from file" it gives a 500 error "The server encountered an unexpected condition which prevented it from fulfilling the request. Click here to return to Splunk homepage." i tried to update the app directly but still the same issue. Do we need to check on any settings? ... View more

Hi, We are setting up "Splunk Add-on for Microsoft Office 365" to pull the event logs from our global tenant. But this is a shared tenant and has data from multiple domains, we would like to pull data only relevant to our domain and restrict other domains. Please let us know if we could achieve this. https://www.ciraltos.com/use-splunk-to-collect-logs-from-office-365-and-azure-ad/ Thanks, Sai ... View more

Hi, We are working on setting up splunk 0365 addon. It looks like our tenant is used by multiple groups/domains, how do we filter to extract only specific group/domain of events to be indexed into splunk. I assume we have to filter out the data in step 2 or 3 from below steps but no idea around o365 side of things Add the Splunk Add-on for Microsoft Office 365 Turn on Office 365 Audit Logging Create the Application in Azure AD Configure the Splunk Add-on for Microsoft Office 365 Verify Logging Add the Microsoft 365 App for Splunk Add-on https://docs.splunk.com/Documentation/AddOns/released/MSO365/About     ... View more

Hi, I have this stats table Column1     Column2 400                  500   I want to have a bar chart which shows 2 bars side by side for column1 v and column2   ... View more

Hi, I have extracted 2 fields i.e. field1 & field2, while using the stats count command how do i use these extracted fields so that they show up in same table like below source     issue      _time userx       field1         12:00 usery        field1          13:00 userz         field2         14:00   Or should i use 2 different tables for  field1 and field2 below are the searches i am using index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field1| sort -_time| fields source,_time,field1 index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field2 | sort -_time| fields source,_time,field2       ... View more

Hi, I have below log files under path /path/to/app/ usera-x.log userb-x.log userc-x.log userd-y.log usere-y.log userf-z.log userg-z.log . . etc To extract *-x.log i am using below inputs.conf, but the data isnt being indexed into splunk. Is there any issue with my inputs.conf [monitor://E:\path\to\app\*-x.log] disabled = 0 index = test sourcetype = metric ... View more