excuse me I did not read what was written above. I will extract this data and test. thank you Amir ... View more

hello @elliotproebstel, I have a table with uid and user which are correlate but i don't have the name of the USB key in the field usb_key. amir ... View more

my problem is solved thank you ... View more

Hello davpx, How can read the /etc/passwd file to correlate the uid with the user because the "lookup" function uses only KML, KMZ and CSV and I want to use the "/etc/passwd" which isn't a KML, KMZ or CSV file. Thank you amir ... View more

@kamlesh_vaghela, This request display me a table which list all eventcode"4663". So i want just merge the eventcode"4663" which are between the eventcode"7036". I just read the different evencode'4663' and I noticed that the eventcodes "4663" were not identical because the application that executes is different. So much for me and thank you for your help. If you know a function or a way of answering the original question even if my problem is solved it would not be a refusal, so it will be useful for me in the future. Thank you Amir ... View more

@kamlesh_vaghela, i put a sample in my first post. i have 3 eventcode"4663" and i want to merge them. Maybe, i must do something before to do the "transaction" but i don't know any function which merge similar events. thank you ... View more

Hello @kamlesh_vaghela and everybody, The solution you proposed to me does not work. I want to merge the same events which are between eventcode="7036", i want to merge all duplicates so that only one eventcode = "4663" remains. But i want to do a difference between eventcode="4663" there are message where the eventcode is 4663 but the message is different and i want to merge duplicate and only display a message of each. for example 1: eventcode"7336" eventcode"4663" -> message A eventcode"4663" -> message A ---> here i want to merge eventcode"4663"so that there is only one left because these events are the same. eventcode"4663" -> message A eventcode"7336" example 2: eventcode"7336" eventcode"4663" -> message A eventcode"4663" -> message A ---> here i want to merge eventcode"4663"->message A so that there is only one left because these events are the same. eventcode"4663" -> message B ---> here i want to remove one eventcode"4663"->message B so that there is only one left because these events are the same eventcode"4663" -> message B eventcode"7336" thank you Amir ... View more

thank you for your help and happy holidays of the end of the year ... View more

sorry to insist like that but do you have any leads to give me to understand how to facilitate indexing? Amir ... View more

So from what we said before there is no optimal way to index a datum of the same type because I have not had a precise answer on this subject apart from putting different sourcetype to filter the incoming data. ... View more

Ok thank you this is very important and I just learned at the moment I did not know that splunk removes frozen data so it's important to set up before setting up a platform. ... View more

The problem is that I have no different data, it is only the OS or the hardware that changes so set the sourcetype following the data is not very interesting. I think that making different indexes for each OS and hardware is the best solution since the queries I'm going to run will not affect all machines but machines following their OS or hardware (cisco) ie before each request I will make a filter following the index linux or windows I do not filter by machines because I want a global view of the platform. But you do not think that it is the same because the more we will advance in time and more index windows to fill it for example and if I run a query in an index containing millions of logs it will be slow too. Can we configure Splunk to archive data that is 1 year old for example? so the searches would be faster and we would get rid of data that is no longer relevant. Amir ... View more

Hi, In the prototype that I put in place I put the logs Linux and Windows in the same index but the search is very slow and I have for the moment only 300000 logs approximately. But if I do the following search for windows hosts for example search is faster, that's why I thought to separate indexes depending on the operating system or hardware. Is this interesting? With respect to security and data backup then what is most relevant? an index that contains all or more indexes depending on the operating system or hardware. Amir ... View more

Hello @woodcock, Thank you for you response. Amir ... View more

thank you @mbagali If I understand correctly, I can not do anything without splunk intervention so I will have to wait 30 days to be able to analyze my data again and even if I solve this problem of quota exceeding it will still have to wait until the delay Of 30 days elapses. Thank you Amir ... View more

Thank you for your response @lfedak. As I said above I checked this via the monitoring tool there is a tab provided for this in tab: "indexing" -> "use of the license" -> "use of the license Last 30 days ". I do not think splunk has created a tool that does not take the right information into account. What I want to know, I prefer to solve the problem that to reinstall a splunk, is how to solve this problem of poolsize = 0? What do I need to configure so that it disappears? I have since yesterday cut off any data entry time to solve this problem but the 3 messages are still present. thank you Amir ... View more

Hello niketnilay, It is true when i want to display something in the tab event, it is very low whereas with statistic it comes more quickly. Cordially Amir PS: i cannot accept the @pyro_wood's message because it is a comment but i upvote his comment. ... View more

Hello niketnilay, Here is what I get after using the command "transaction" and the parameters "startswith" and "endswith":(This is a event) Command: host="ccst" session (open* OR clos*) sourcetype!="linux_audit" NOT (kernel OR "gdm-launch-environment") | transaction pid startswith="session opened" endswith="session closed" Result: 28/06/17 11:10:13,000 Jun 28 11:10:13 ccst sshd[4444]: pam_unix(sshd:session): session opened for user splunker by (uid=0) Jun 28 11:11:05 ccst sshd[4444]: pam_unix(sshd:session): session closed for user splunker host =ccst source =/var/log/messages sourcetype =syslog user =splunker I have the 2 session logs that are grouped together with the same PID because it is the same session. Thank you Cordially Amir ... View more

Hello niketnilay and pyro_wood, Thank you for your answer. @pyro_wood, that's exactly what i want to regroup events with the same PID and with the key word "opened" and "closed" together because i want to do a log wells. @niketnilay, your proposition it is very interesting, it is another way to supervise its logs and i will use this method too. Thank you very much for your help. Cordially Amir ... View more