If you are looking only for number of events within index, metadata command would be better option. ... View more

I agree with @smoir. In case you are upgrading from earlier version of ES try to reload the IR page after clearing cache of your browser. ... View more

Yes you can do that. One of the way is Modular Inputs. ... View more

Throttlling under Trigger Conditions. There are two fields time window and fields to group by. ... View more

You can do it by adding search time extraction in props.conf. i.e EVAL-temprature= substr(DevEUI_uplink. payload_hex,0,4) You can also write REGEX as well. Please refer docs at http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles ... View more

@dajomas, Did you find a solution ? If it has worked, can you accept the answer so that we can close this thread? In case you have used any other solution , would you mind posting it here for helping others? ... View more

All these are valid keys in saved searches.conf. Can you check savedsearches.conf.spec file under $SPLUNK_HOME/etc/system/README/ contains these values like dispatch.latest_time, dispatch.earliest_time, enableSched? ... View more

You can use same method, as you were doing with single test instance https://answers.splunk.com/answers/226482/splunk-rest-api-data-input-receiverssimple-informa.html In case you can modify header of the HTTP Post, you can also have a look at HTTP Event Collector. http://dev.splunk.com/view/event-collector/SP-CAAAE73#scen1 ... View more

There have been major upgrade in the UI framework with 6.5. In earlier version it was allowed to write elements as <input id="user_id" token="user_form" type="text"> <label>User</label> <default/> </input> But with 6.5 , you must write it as follows: <input id="user_id" token="user_form" type="text"> <label>User</label> <default></default> </input> This can be one of the reason if your dashboard was working fine with Splunk <6.5 ... View more

You need to pass the values on drill down to next dashboard so they are preserved. Also should name your time range token as follows: <input id="time_id" type="time"> <default>Last 24 hours</default> </input> On drill down pass values as search?q= sourcetype=bash_history | search $category$ $pci_domain$ host="$row.host$" | table _time, host, bash_command, host_bunit, host_ip, host_category, host_pci_domain, host_city, host_country&earliest=$earliest$&latest=$latest$&auto_pause=$auto_pause$ ... View more

No thats not the right practise. Ideally data collection should not happen on Search Head Node. It should take place on Heavy Forwarder. If you use Heavy Forwarder, you will need to give that host name to your customer to configure data inputs on Jenkins server. ... View more

I agree with @adonio ... View more

You are right don't have passwords field in that app, you can use it in same way as setup page. for example: Occured Time (epoch) <div class="controls"> <input type="password" name="action.demisto.param.occured" id="occured" value="$trigger_time$" /> </div> </div> ... View more

If I understood your requirement correctly, you want to override username / password from a alert action. This can definitely be done from custom alert action page. ... View more

You can do it similarly as you do on a setup page using REST endpoint. You need to add following parameter in your alert_actions.conf. alert.execute.cmd = demisto_alert.py From the python file you can use code as follows: postArgs = { "name": user_name, "password": self.callerArgs.data['AUTHKEY'][0], "realm": "TA-Demisto" } splunk.rest.simpleRequest("/servicesNS/nobody/TA-Demisto/admin/passwords/?output_mode=json", self.getSessionKey(), postargs = postArgs, method = 'POST') If you want more information refer demisto_setup.py file from https://splunkbase.splunk.com/app/3448/ for /storage/password REST endpoint. This also have example for attaching custom page with your alert. Hope it helps. ... View more

I agree with @Somesoni2. One other option is you collect data into particular index with specific sourcetype. Every time you run a script, first query the splunk, if you get the values that means script had already run don't run it again. ... View more

Try with this. | tstats summariesonly=true count from datamodel=Authentication where nodename=Authentication.Failed_Authentication by "Authentication.src","Authentication.dest", "Authentication.src_user",_time | rename "Authentication.src" as "Source_Device", "Authentication.dest" AS "Destination" | timechart span=5s dc(Destination) AS Total_Dest, values(Destination) AS List_Destinations | where Total_Dest >1 ... View more

Yes it works. Thanks for sharing. ... View more

I meant _internal. You can search through this index index=_internal ... View more

You can create correlation search as per your requirement, however there aren't any data models which you can use for this. For admin activities you should be able to get data from _internal index. ... View more

Putting this for everyone's information. In SHC, Splunk recommends using same value for splunk.secret in all the nodes. This ensures that password encrypted at one node can be decrypted on another node. After Splunk version >= 6.3 it does this automatically when you enable Search Head Clustering on your node. However we don't have a setup page on SHC nodes. We need to push this applications from Search head deployer node. The search head deployer node will have different splunk.secret. In order to ensure that encryption works correctly we should have same splunk.secret in Search head deployer node as we have on SHC nodes. Also copy following items in server.conf file from search head node into search head deployer node pass4SymmKey under general stanza sslKeysfilePassword under sslConfig stanza pass4SymmKey under shclustering stanza After doing this changes, restart your Search Head deployer node. Complete the setup of the application from the Search Head Deployer UI. Splunk will generate passwords.conf file in your app /local folder. Move this applicaiton to shcluster/app folder. Then fire deploy command to push this bundle to all the search head. $SPLUNK_HOME/bin/splunk apply shcluster-bundle -target https://10.0.1.1:8089 This will ensure that you have encrypted passwords on all the nodes. ... View more