Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)? ... View more

At a basic level, yes predict can be used: <base search where metric=cpu and value is integer>| predict value There are ways to tune predict with different algorithms: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Predict You can also take a look at the machine learning toolkit for some more advanced prediction: https://splunkbase.splunk.com/app/2890/ ... View more

inputs.conf [perfmon://Process] object = Process\(* counters = * instances = * index = perfmon interval = 30 disabled = 0 index=perfmon object=Process counter="% Processor Time" instance!=_Total instance!=Idle | stats latest(Value) as Value by host, instance Turns nicely into Trellis pie chart Edit: formatting to code to maintain backslash->paren ... View more

I haven't used this app before, but behind the scenes it's using python requests to make web calls to something. In it, it's going to try and do certificate verification on the remote URL (verify=true by default). You have two options 1) verify the endpoints it's hitting have valid certificates that your splunk server trusts or 2) modify Splunk_TA_mimecast_for_splunk_v2.py, making sure any line that says requests.post or requests.get has a parameter verify=False. (e.g. line 196: r = requests.post(url='https:...', verify=false). See: http://docs.python-requests.org/en/master/user/advanced/ ... View more

Oh woops, missed that part. ... View more

Are you trying to extract them via mvexpand (multi-value expand) or similar commands? Should be able to | transaction ... | mvexpand commonfield. Also know if you're looking for a faster way to search and build these transactions, you can use a combination of eval to create a common field for ones that match via if/case statement, then doing stats command after. ... View more

Can you walk through your automation? Is this automation on the universal forwarder level or on a splunk enterprise server? At what point do you need an empty directory for apps? ... View more

Sure they're not being set elsewhere? Do you have ssh access to the server? Try running: splunk cmd btool alert_actions list --debug | grep -i mailserver ... View more

Take a look through here. I had a similar issue years ago - maybe it still applies? http://blog.hortonew.com/splunk-ciscoips-app-no-longer-pulls-from-ips ... View more

I believe there are permissions that come with the app that have to be assigned to the user you're logged in as. Go to access controls and see if you can assign your user with any new roles since the app was installed. edit: actually looking at the app conf files, i'm not seeing anything new. Try logging in as the splunk admin user and see if it allows you to edit. ... View more

Also, what would your desired output look like? I imagine you're trying to group events together if either trans1 or trans2 match the previous one, but break into a new group should neither match. ... View more

I believe by default when using the collect command, your sourcetype becomes "stash" as seen in the documentation for the collect command. The Windows_TA that does search time field extraction by default uses the sourcetype as part of field extraction. Your old data probably has this sourcetype of stash which is why fields aren't being extracted correctly. The new data coming in will have the sourcetype specified at the inputs level. ... View more

You can do so by utilizing the transaction command. If you want something less processing intensive you can do so by evaluating a new field, maybe "status", and then use stats. For instance: A very simple example might look like eval status=if(EVENT_TYPE=="Trouble" AND EVENT_SUB_TYPE=="comRes", "Good", "Bad") | stats latest(status) as LatestStatus | where LatestStatus=="Bad" This would indicate all that are still bad and can be alerted on. Should get you started - will definitely need tweaking. ... View more

Seems KV_MODe won't work on data that isn't formatted as json. In this case, your timestamp is causing issues. Is there any way your system can output the timestamp as a k/v pair inside the json braces? for instance, every new event would be: {"timestamp": <timestamp>, other json data} ... View more

If there's no way for the system generating it to add the timestamp directly to the json, then you might look at doing search time field extractions. I believe you can add timestampping configs and KV_MODE=json to parse the rest of the event as json. ... View more

I see your sample json starts with a timestamp outside of the actual json data. Can you try the ingestion without that? I'm not sure if that affects what happens in the indexed_extractions Edit: It might make more sense to use the data ingestion tool through the GUI of Splunk to see how it's being handled. might be able to play with settings there to get extracted fields ... View more

So first thing: you never want to edit etc/system/default/props.conf. You should only be making changes to etc/system/local/*.conf, or a default/local entry in a custom app. Second thing: If it's coming from a remote Splunk Universal forwarder, it has already gone through the input queue and will hit the indexers at the parsing queue. This will not use those props.conf settings as INDEXED_EXTRACTIONS only works at the input queue. So you want to go to your Universal Forwarder where the json is ingested, and configure your props.conf there, in either a new app or etc/system/local/props.conf. ... View more

Are your indexed_extractions entries in props.conf on the forwarder that is sending the data? Check out this to make sure you're configuring your settings in the right location: https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F ... View more

You should only need to do so at the search layer. This is how I do it on standalone search heads: http://blog.hortonew.com/splunk-automatically-update-geoip-database-across-environment In a search cluster, you would probably want to keep the SH deployer file up to date, and schedule a push to the members once a month. I'm not sure the way you're doing it today, but if you're not updating the lookup through the GUI or SH Deployer, it's probably not getting propagated to the other members. ... View more

I'm on 6.4.4 making a custom generating command and this just helped me. Have to make [commandstanza] all lowercase. ... View more

The most likely cause of your issue is not trusting your APICs SSL/TLS cert. My bandaid/fix was to edit TA_cisco-ACI/bin/config.ini. I changed: ENABLE_SSL = True to ENABLE_SSL = False This setting description is: "Indicates whether SSL certificates must be verified" ... View more

I'm having the same issue on Splunk 6.6.1 with addon 4.0.1 If you want to call the script locally, you'll have to do something like what's in here: https://answers.splunk.com/answers/24319/using-a-scripted-inputs-passauth-token-for-cli-access-from-the-scripted-input.html As for the ConnectionError - I'm still troubleshooting that ... View more