@antoniomarongiu  Is your back fill range also same as summary range? In that case make your allow_old_summaries  false and rebuild and test ... View more

@antoniomarongiu  earliest_time controls how far back the summarization search runs each cycle, but it does not automatically purge older summary data once it exists. Because you have allow_old_summaries = true Also what's your summary range settings?(This is the actual retention horizon for summaries) Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@PONAS  General users can only see OS/software details if admins have ingested and exposed that data in dashboards or indexes. Otherwise, the Web UI won’t show it by default. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@deepthi5  As @gcusello  mentioned, you can check on your license server. Also you can try below query, index=_internal sourcetype=splunkd source=*license_usage.log* type=Usage | eval GB = round(b/1024/1024/1024, 2) | stats sum(GB) AS "Total GB" by s, st, idx | sort - "Total GB" | rename s as Source st as Sourcetype idx as Index Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@Nawab  Have you modified any of your query? Can you specify more details. The error highlights here can be of multiple reasons  {"text":"Invalid data format","code":6,"invalid-event-number":15} Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@maheshnc  You can use rsyslog or syslog-ng based on your comfort and your system setup. Personally i have seen rsyslog is giving better performance for high volume environments and syslog-ng is more user friednly and easier to maintain the configs. To your question, basic structure looks something like this for syslog-ng # 1. Source: listen for UDP 514 source s_cisco { udp(port(514)); }; # 2. Destination: write logs to a dedicated file per device destination d_cisco { file("/var/log/cisco/$HOST/ios.log" perm(0644) create_dirs(yes)); }; # 3. Filter: accept from cisco switch IP's filter f_cisco { host("10.10.10.1") or host("10.10.10.2"); }; # 4. Log path log { source(s_cisco); filter(f_cisco); destination(d_cisco); };   Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@EMDEEEEE  As others mentioned you need provide more context. If its for Windows Logs in Splunk, you can use below, Password reset event id's are 4723 and 4724   index=YOUR_INDEX sourcetype="WinEventLog:Security" (EventCode=4723 OR EventCode=4724) | eval Action=case(EventCode=4723,"Password Change Attempt", EventCode=4724,"Password Reset") | table _time user Account_Name Target_Account_Name Action host | sort - _time   Interactive & Non-interactive Successful logons are EventCode 4624. The Logon_Type field tells you the type. Interactive: 2 (console), 10 (remote desktop), 11 (cached) and rest you can normally mention as non-interactive Account Disabled - Use EventCode 4725 index=YOUR_INDEX sourcetype="WinEventLog:Security" EventCode=4725 | eval Action="Account Disabled" | table _time Target_Account_Name user host Action | sort - _time   Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@NanSplk01  Minor tweak to @gcusello  given to fetch all indexes.   | tstats count WHERE index=* earliest=-30d latest=now BY index | append [ | rest splunk_server=* /services/data/indexes count=0 | rename title AS index | eval count=0 | fields index count ] | stats sum(count) AS total BY index | where total=0 AND NOT match(index,"^_")   Also as alternative, you can try directly from the metrics logs as well.   index=_internal source=*metrics.log group=per_index_thruput earliest=-30d@d latest=now | stats sum(kb) as total_kb by series | eval total_bytes = total_kb * 1024 | where total_bytes=0 | rename series as index | table index total_bytes     Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@maheshnc  General best practices are, Backups & Config Safety first -Back up $SPLUNK_HOME/etc (configs, apps, knowledge objects). -Back up critical KV Store collections -VM snapshots or system‑level backups in case rollback is needed. For Indexer Cluster: -Put the cluster into maintenance mode. -Better patch one peer at a time. Post Checks Service Validation -Confirm Splunk service is running -Verify web UI(Applicable ones) and CLI access Cluster Health -Indexer Cluster - all peers should be Up and In‑Sync. -SHC - all members should be Up and Ready -Disable maintenance mode once all peers are patched Data Flow -Perform simple searches (index=YOUR_INDEX | head 5) to confirm indexing is happening. -Check forwarders are still connected (Settings → Forwarder Management) Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@BlueHelix  Which version of splunk are you using? The error says display.visualizations.chartHeight must be a plain integer. Can you find your xml code and search for chartHeight and see if any value is set or not. But check if you are seeing any warning messages next to your display.visualizations.chartHeight. I think it's bit old property, if it's not supporting on newer version, you might need to remove it and save. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@imst27  Yes the lookup approach is much better. Its better to simplify giant cidrmatch() block into two clean lookup calls, one for src_ip and one for dest_ip. Eg: | lookup backup_subnets subnet as src_ip OUTPUT comment as src_match | lookup backup_subnets subnet as dest_ip OUTPUT comment as dest_match | where isnull(src_match) AND isnull(dest_match) | table _time src_ip dest_ip src_match dest_match Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@warden0  Solution here mention that, In your app.conf file you only need to mention your custom .conf file name only (don't put .conf stanza) [triggers] reload.inputs_templates = simple Additionally,  if you are developing via add-on builder, then addon_builder.conf might be adding to your default .conf list. So add below in your app.conf, [triggers] reload.addon_builder = simple Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@nabeel652  Unfortunately it doesnt support. Splunk treats the value you pass into the lookup as a literal string, not a pattern/wildcard. Its best to submit as feature request at #https://ideas.splunk.com/ Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@Bet1  -Stop Splunk Enterprise. -Find the passwd file for your instance ($SPLUNK_HOME/etc/passwd) and rename it to passwd.bk -Create a file named user-seed.conf in your $SPLUNK_HOME/etc/system/local/ directory. In the file add the following text: [user_info] USERNAME = admin PASSWORD = NEW_PASSWORD In the place of "NEW_PASSWORD" insert the password you would like to use. Start Splunk Enterprise and use the new password to log into your instance from Splunk Web. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@ikoto  What you meant by license key? Key generated from Splunk for your license? You should have a valid license file(.lic or xml). Log into Splunk Support Portal and download the actual license file associated with your key and follow  cli command or splunk web. $SPLUNK_HOME/bin/splunk add licenses Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@ShawnXie  Are you installing with root user? Also can you share your error details here. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!   ... View more

@lucacaldiero  If you want to clone all data from the Heavy Forwarder to both destinations, this should be sufficient. [tcpout] defaultGroup = newgroup,oldgroup [tcpout:newgroup] server = xxxx.xxxx.xxxx:9997 [tcpout:oldgroup] server = xx.xx.xx.xx:9997 Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@caschmid  Try subsearch to isolate the failed requestIds from log2, and then filter log1 entries. index=index env=env "This is log 1" [ search index=index env=env "This is log 2" reason=failed | rex field=_raw "requestId=(?<requestId>[^,}]+)" | fields requestId | format ]   Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@AlexIta95  As others mentioned, Splunk cannot start reading a single large file from a specific line or position. It always reads files sequentially from the beginning unless it has indexed that file before. But i would suggest to preprocess the file using a script or tool like awk(put filter for the dates you want) and write to a new file. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@mchoudhary  As others mentioned, specify your requirement. Do you want to track user activities from other systems(like OS, Network devices, security devices..) or from Splunk itself? If you use Splunk Enterprise Security (ES), the relevant data models(like Authentication, Change...) are available(if you configfure cim complaint data onboarding). for core Splunk, you need to onboard and normalize data accordingly and create dashboards/reports based on your requirements.  For Splunk audit activity - Latest Splunk comes with Splunk Audit trail App. It provides real-time visibility into user activity and knowledge object changes using data from the _audit index. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@Nrsch  I agree with @gcusello  , Splunk UBA is highly dependent on both the OS version and the packages installed. When setting up UBA on a laptop, especially in a virtual machine, it is essential to verify that all system requirements(especially resource allocation) are satisfied before starting the installation process. Most installation packages provided with UBA include automated checks to ensure your system meets these requirements before proceeding. You can refer below, system requirements - #https://docs.splunk.com/Documentation/UBA/5.4.2/Install/Requirements basic troubleshooting - #https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/install-and-upgrade/5.4.2/troubleshoot-your-splunk-uba-installation/troubleshoot-your-splunk-uba-installation Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more