Hi Team, We have 1 Cluster master, 1 Deployment Master, 8 Indexers and 6 Search Head servers in our environment. In which Licensing is deployed in our Deployment master server and we have bought license for 700 GB per day, for which I am able to see the same in GUI by navigating to Licensing page from Settings in Deployment master GUI. And also, I am able to get the information, such as how much it has been utilized and how much it's still having for the day, and so on. But we got information stating that we have already have 380 GB of License dedicated for Enterprise Security, but where can I see the License usage per day for ES and how much it's getting utilized and so on in GUI? Kindly note we have deployed Splunk Enterprise APP separately in a search head server. So, I need your help to know how can we find a way to show up the ES license used and so on. ... View more

Hi Team, I need to extract the fields from the JSON format in my Search Head GUI so kindly let us know how to proceed further. { [-] id: message: 2018-10-11 10:33:46,879 [44] |INFO|Access=abcdef|Max=(abcd)|Data=(xyz)|Fox=(ghi)|Mach=(pqrs)|Bend=(uvw)| http://amazon.com.local:098765/dam/healthchecks/band severity: INFO } Need to extract fields in the form of Regex: Date:2018-10-11 10:33:46,879 Level=INFO Access=abcdef Max=(abcd) Fox=(ghi) Mach=(pqrs) Bend=(uvw) Message=http://amazon.com.local:098765/dam/healthchecks/band Once the fields are extracted if we click Max on the left hand side it needs to show abcd So kindly help on this to make up a regex so that i can able to implement the same and extract those fields. ... View more

I want to integrate the artifactory with Splunk to see the artifactory logs. Is there any way to do that? I got a basic idea of installing the Universal Forwarder on the box and pulling the logs into Splunk. Or is there another way, like is it possible to pull the logs with an app or with the HTTP Event Collector? Since i believe Sumo Logic has a dedicated app to pull Artifactory Logs into Splunk... So if you any procedure kindly let me know ... View more

We have configured around 700+ Searches and Reports (Saved searches) in our Search Head server and, for most of those, we have enabled email. We want to replace a few of the email ids which no longer exist and also we need to add additional email DLs into it. But we aren't able to go and check each and every saved search, whether the existing email id is present or not, and its a tedious process. So, is it possible to pull a report, with the help of Search query, stating something like: if we search with the email id or DL. and it needs to show the Saved Search name, and all configured with the existing email. Then, I could go ahead and replace them quickly, which would be really helpful. So, is it possible to fetch this information? If yes, kindly help on the request. ... View more

Is it possible to change the admin account password which we used to login in Splunk Cluster Master, Deployment Master, Search Head & Indexers? ... View more

I want to check what are the searches which are running currently or which are finalizing or which is done via our back-end Search head server which is an Unix machine. So Is there any back end command to pull those sort of information? ... View more

Is there a way to see in GUI when dashboards in Splunk were first created and also who edited and viewed the dashboards. ... View more

We are planning to pull the Azure Audit logs into Splunk so we want to know which one be the recommended solution. Is this App (Splunk Add-on for Microsoft Cloud Services) can be installed in a Search Head or an Indexer or a Heavy Forwarder? Kindly provide us with the recommended solution so we will install the same and pull the logs into Splunk. ... View more