@Andre_  Unfortunately no. Splunk doesn't have excel-style column filters directly inside table viz. You need to add dropdown/multiselect input controls for each column you want to filter. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@maheshnc  Where to Create the HEC Token (SH or HF?) As a best practice, Search Heads are built primarily for querying, searching, and visualization—not for data ingestion. However, in specialized environments, this behavior may depend on your architecture or requirements. A Heavy Forwarder is ideal for HEC-It can receive HEC data, parse it, and forward it to indexers. Create token and sourcetype - Settings > Data Inputs > HTTP Event Collector You can follow below doc, #https://docs.splunk.com/Documentation/Splunk/9.4.2/Data/UsetheHTTPEventCollector   Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@SabariRajanT  If you don't want to create new field, use simple rex mode=sed | makeresults | eval url="ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758" | rex field=url mode=sed "s:/.*::" | table url If you want to create new fields like domain/url for creating any visualization/reporting use below,   | makeresults count=1 | eval raw_log="ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758-CSPsqhWt%sdserere%2BJ7IesevE6CTs%3D,win-extension.femrerere.grammarly.io/batch/import" | makemv delim="," raw_log | mvexpand raw_log | rex field=raw_log "^(?<domain>[^/]+)" | table raw_log domain Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@Na_Kang_Lim  In your first blacklist modify with below, blacklist = (lastlog|anaconda\.syslog|nginx/access\.log) And for your second monitor, use direct path. [monitor:///var/log/nginx/access.log] sourcetype = nginx:access disabled = 0   Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@WorapongJ  As @isoutamo  mentioned, if you setup your SHC to send all the data to indexers then all search heads within the cluster utilize the same set of accelerated datamodel summaries stored on the indexers, preventing any duplication of accelerated files for the same datamodel. Splunk manages this automatically.   But if you want one designated search head to generate and store the acceleration summaries, while other members reference that shared data instead of creating their own copies, you can use shared datamodel acceleration. #https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.2/use-data-summaries-to-accelerate-searches/share-data-model-acceleration-summaries-among-search-heads Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@echojosh  You're getting an empty result because the lastChanceIndex may not have configured. If lastChanceIndex is not configured, Splunk will drop the data and log a warning like - "Dropping them as lastChanceIndex setting in indexes.conf is not configured.So far received events from 1 missing index(es)" Did you got any warning message like this? Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@elend  You can grab the MITRE ATT&CK data and bring it into Splunk as a lookup table or KV Store. That way, you can add MITRE TTP details to your detections or events in your searches and dashboards. You can also try out the Security Essentials app, which gives you lots of built-in detections already mapped to MITRE ATT&CK techniques and analytics use cases. #https://docs.splunk.com/Documentation/SSE/3.8.2/User/MITREFramework Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@Amit_Sharma1  Since Splunk doesn’t remember past alerts, it just fires based on current query results. If no results are returned, no alert is triggered. Can you try with single scheduled alert, send a “trigger” (error rate ≥ 30%) and a “resolve” (error rate < 30%) to PagerDuty with the same dedup_key.   | eval status=if(ErrorRate>=30,"triggered","resolved") | eval dedup_key="HighErrorRate" | table status, dedup_key, ErrorRate Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@CyberAar  Both answers are valid! There isn't a single official definition for your question. @Meett  gave you the general/common knowledge objects found in the CIM add-on (https://splunkbase.splunk.com/app/1621), but I also pointed out other knowledge objects that are included with it(some are least used). The best way to see everything is to go through your knowledge objects in Splunk one by one, set the App filter to the Splunk CIM, and set the configuration source to “Created in the app.” That way, you’ll get the full list of what’s built into CIM, and can explore them yourself. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@AkshayKrishna  PROCMON is not mandatory, its only to gather more info. Basically with windows admin help, you can perform following to remove any rrphaned MSI references Delete the splunk windows service (if still present) Delete residual files & folders (anything related to Splunk) Manually clean registry entries Remove installer cache files if any After removing all these references and reboot should fix orphaned msi reference issues. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@splunker2k24  Technically, yes you can use this app in production. Unsupported means Splunk doesn’t guarantee updates, bug fixes, or compatibility with future versions. If there’s no other option, most of us end up using 3rd party apps or add-ons based on what fits our needs. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@AkshayKrishna  You can follow below doc for clean up and try with fresh installation. #https://splunk.my.site.com/customer/s/article/Troubleshooting-Windows-Installer-MSI Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@kn450  Did you restart kafka-server? Also have a look at this, #https://splunk.my.site.com/customer/s/article/KAFKA-1-and-OML-2-errors Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@echojosh  Do you have a field called ComputerName in your events which should reflects the original machine that generated the event for events collecting from a WEC. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@jayv  Splunk does not have a minimum file size requirement for indexing files, so files in the 2KB–20KB range should be ingested-unless something in your configuration or environment is causing them to be skipped. How you are reading these files? With UF or full Splunk? Ensure files actually have new content or new lines. To test, Manually drop a small test file into the monitored directory and watch _internal logs and see what it says index=_internal source=*metrics.log OR source=*splunkd.log "*FILENAME*" Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@KJL  You mentioned seeing blocked=true in _internal logs with max_size_kb ranging from 500 to 10240. That’s a sign that Splunk is throttling because the queues are full. If your HF is set at 256KBps, which can be a bottleneck if you're forwarding a lot of data. To start with, try increase that to 2048 or 0(no cap) depending on your system’s/network capacity. Also verify your connectivity towards receiving end(intermediate HF/Indexer). If there is n/w latency or slow performance at receiving end, then queues will back up. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@CyberAar  Besides fields, event type, tags and field aliases, Splunk CIM Add-on also includes the following knowledge objects, Data Models, Field Extractions, Lookups, Commands, Macros, Workflow Actions, views, Reports. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@gmalandra  Looks like UI elements like Inspect and Clone are hardcoded into the interface for users with read access in Dashboard Studio. So I dont think it's possible with dasboard studio. Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@jni  As @livehybrid  mentioned, Splunk does not support dynamic variable expansion for $_index_name in coldToFrozenDir. Manually specifying coldToFrozenDir per index stanza is the only reliable method. Eg: [web_logs] coldToFrozenDir = $SPLUNK_DB/web_logs/frozendb Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

@b17gunnr  If you want Splunk to stop searching for timestamps, just go to your Indexer or Heavy Forwarder (whichever is doing the parsing) and update the props.conf for the relevant sourcetype Eg: [your_sourcetype] DATETIME_CONFIG = NONE SHOULD_LINEMERGE = false NO_BINARY_CHECK = true Tells Splunk not to attempt timestamp extraction. It will use the index time as the event time Note: Are you using any specific add-on for this? Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more