I don't know who told you that "connecting Splunk to the Internet is a bad idea". Depending on your setup, your Splunk environment might have many different components some of which must be somehow connected to internet (for example - because they need to pull events or update other data from the Internet). Apart from that - in production environment the decision about whether some host should be allowed to connect to some other host(s) should generally done on a case by case basis following a more or less formal risk assesment. So there is a general rule of thumb that unless needed (and unless it's "safe enough") hosts shouldn't be connected to anything. Not just the internet. Having said that - the options you have available will differ depending on your architecture. If you have an all-in-one installation, you can relatively safely open the outgoing traffic to Splunk update servers (you might want to disable telemetry if you're paranoid) and you can usually update the add-ons straight from Splunk's webui. But it won't work in case of apps deployed via Deployment servers (in this case you have to upload a new version onto the DS, reload its config and let the forwarders pull the updated app). Or in clustered environment (both indexer clusters as well as search-head clusters). In those scenarios you have to manually download updated versions and put them in apropriate directories on the managing components (cluster manager and search-head deployer respectively). If you have other types of data (like threat intel), well, it will depend on what kind of data it is and how it's configured. There is no general "fit for all" answer. Often just opening outgoing traffic to needed hosts will suffice. ... View more

Hello @isoutamo, I know this is the best we can do for now. Thank you so much, truly appreciate your support. ... View more

Hello @gcusello  I posted a new question here (in following link), would it be possible to have your recommendation when you get a chance, thank you so much. Re: Field Extraction -Key/ Value Pairs with Specia... - Splunk Community     ... View more

@SplunkDash - The recommendation is to first find the different format that is causing the issue (or find all the different formats) and then based on that we maybe able to suggest something. * Also it is unusual for a single system to generate two different timestamp formats for the same data. * It could be either a different host, or different source. ... View more

The bolded text, Y10212022, is not even close to the format specified in TIME_FORMAT. %Y%m%d%H%M%S needs 14 characters, but only 9 are bold.  Based on the format string, I expected to see "2023" somewhere in the event, but that's not the case.  What's more, the highlighted text is 3 fields (m,n,o) rather than the one or two fields we usually see for timestamps. ... View more

Not sure what you mean by incorporate.  If you want the two extra field Account_no and No_Acccount, simply add the search to your search.  Here's an alternative method:   | rex "(^)(?i)(?<DeprtCode>.{1})(?i)(?<mode_no>.{2})(?i)(?<StudentId>.{9})(?i)(?<BuildingCode>.{5})(?i)(?<Code>.{2})(?i)" | rex "^.{19}(?<Account_no>\d{6})" | eval no_Account = if(isnull(Account_no), replace(_raw, ".{19}", ""), null())   Either way, you get Account_no BuildingCode Code DeprtCode StudentId mode_no no_Account 770977 BMFTH 77 t 225256009 R3   779977 BMFFT 77 f 225256009 R6     BMGHL 70 g 225256004 R1 804833EDAR   ... View more

@gcusello  I posted a new question.  How do I Compare field values between Lookup Table... - Splunk Community Your recommendation will be highly appreciated if you get a chance. Thank you so much ... View more

Hi @SplunkDash, These are drivers provided by IBM, you should be able to download them using IBM id. And yes they will work with Splunk DB Connect.  ... View more

Hi @SplunkDash , as always, I hint to open a new question instead using an old one to have more quickers and probably better answers from more people. Anyway, the only difference is the format, to use in the TA: there are some tAs that use only CEF format, other that use other formats and some that use both formats. See in the TA that you need to use (releted to the technology) which format it waits for. Ciao. Giuseppe ... View more

@PickleRick , Yes, I agree with you. I will reach out to you and @ITWhisperer it needed. Thank you so much both of you again, truly appreciate your support in these efforts.    ... View more

@PickleRick  I submitted a question @ REST API to send Data to Third Party Server - Splunk Community would be highly appreciated if you can join that discussion. Thank you!   ... View more

@SanjayReddy  I submitted a question @ REST API to send Data to Third Party Server - Splunk Community   if you like to participate, would be greatly appreciated. Thank you. ... View more

Hi @SplunkDash, Using windows, you have to specify the drive you're using: [monitor://F:\servername\comm2\Audit\Logs\*.log] Anyway, you can test the path to insert in the monitor stanza header using the "dir" command in cmd window.  Ciao. Giuseppe ... View more

@bowesmana It was just an example, there might be more events. In our last example, we only need to see, events 4,5, and 6, since info/content of events 4,5, and 6 are not the same what we had yesterday. Thank you again! ... View more

Hello @SanjayReddy  Thank you so much for your quick response. This is working and gives me the list of the apps and their corresponding indexes in my indexer cluster. But I have some apps in Deployment Server, how I would implement this and find the apps for corresponding indexes/source types. Thank you again. ... View more

HI @SplunkDash, thank you for your consideration! I haven't any experience on this environment, the only general hint I can give is to read with attention the documentation before to start and to find the correct Ad-On to use because there are three different ones. Have a good day and see next time! Please accept one answer for the other people of Community Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

If there is any, I haven't found it. (And not for lack of trying.)  You can still extract individual fields automatically as jdunlea suggested. ... View more

Fixed.  Thanks for letting me know. ... View more