For Data Inputs option you need to modify your role i.e., need to add right capabilities. Below is the link, https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Authorizeconf ... View more

Then you don't have enough permission. So need to ask the right person to copy the scripts to $SPLUNK_HOME/etc/apps/splunk_app_for_unix through ssh to that server. ... View more

Don't want to restart if inputs.conf and scripts is already exists. Please execute below command on your browser https://localhost:8000/en-US/debug/refresh If you have created newly then yes. ... View more

ah, issue is because case sensitive. Use Defrag.exe instead of defrag.exe in lookup file. while searching text can be either lower or upper case. If you are using lookup case is important. ... View more

post one sample event. Guessing your regex is wrong. ... View more

Check simple_xml_examples app ::: link_switcher below is the example <form> <label>Link Switcher</label> <description>Toggle dashboard content using a list of links.</description> <fieldset submitButton="false"> <input type="link" token="unused"> <label>Choose a view</label> <choice value="table">Table</choice> <choice value="chart">Chart</choice> <choice value="map">Map</choice> <default>Table</default> <change> <condition value="table"> <set token="showTable">true</set> <unset token="showChart"></unset> <unset token="showMap"></unset> </condition> <condition value="chart"> <set token="showChart">true</set> <unset token="showTable"></unset> <unset token="showMap"></unset> </condition> <condition value="map"> <set token="showMap">true</set> <unset token="showChart"></unset> <unset token="showTable"></unset> </condition> </change> </input> </fieldset> <row> <panel> <table depends="$showTable$"> <title>Table</title> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>-24h</earliest> <latest>now</latest> </search> </table> <chart depends="$showChart$"> <title>Chart</title> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>-24h</earliest> <latest>now</latest> </search> </chart> <map depends="$showMap$"> <title>Map</title> <search> <query>| inputlookup geomaps_data.csv | iplocation device_ip | geostats latfield=lat longfield=lon count by method</query> <earliest>0</earliest> <latest>now</latest> </search> <option name="mapping.map.center">(30.810646,-10.556976)</option> <option name="mapping.map.zoom">2</option> </map> </panel> </row> <row> <panel> <input type="link" token="needed"> <label>Choose a sourcetype:</label> <choice value="link4">Internal Event Count</choice> <choice value="link5">Splunk Event Count</choice> <default>Internal Event Count</default> <change> <condition value="link4"> <set token="showInternal">true</set> <unset token="showSplunkd"></unset> </condition> <condition value="link5"> <unset token="showInternal"></unset> <set token="showSplunkd">true</set> </condition> </change> </input> <single depends="$showInternal$"> <title>Internal event count</title> <search> <query>index=_internal | stats count</query> <earliest>-24h</earliest> <latest>now</latest> </search> </single> <single depends="$showSplunkd$"> <title>Splunkd event count</title> <search> <query>index=_internal sourcetype=splunkd | stats count</query> <earliest>-24h</earliest> <latest>now</latest> </search> </single> </panel> </row> </form> ... View more

try don't use defrag.exe* true instead use defrag.exe true in lookup file i.e csv file ... View more

Try this index=whatever eventtype=whateversourcetype |table UserName, "B's fields", "A's fields" eventtypes.conf [whateversourcetype ] search = sourcetype=A OR sourcetype=B or From GUI: settings->Event types-> new Name=whateversourcetype Search String=sourcetype=A OR sourcetype=B ... View more

| makeresults | eval test="2017-07-11 11:51:46,740 tid:hhReD803VBtTqw2uFsQVhPI35r0 DEBUG [org.sourceid.servlet.HttpServletRespProxy] flush cookies: adding Cookie{PF=hashedValue :hhReD803VBtTqw2uFsQVhPI35r0 ; path=/; maxAge=-1; domain=null}" | table test | rex field=test mode=sed "s/cookies:\s(\S+.*)/cookies: =1XXXXXX/g" ... View more

you got the result. ... View more

I m getting results | rex field=Image_File_Name ".*\(?P&ltImage_File_Name&gt\S+)" | lookup isWindowsSystemFile_lookup filename as Image_File_Name OUTPUTNEW systemFile | search systemFile=true transforms.conf [isWindowsSystemFile_lookup] filename = isWindowsSystemFile_lookup.csv isWindowsSystemFile_lookup.csv filename systemFile defrag.exe TRUE I got output. ... View more

click on settings->Data Inputs->Scripts. Scripth Path-> $SPLUNK_HOME$/etc/apps/splunk_app_for_unix/bin Command -> your command or steps Interval Inputs -> seconds Interval -> Source name override : optional ... View more

splunk resync shcluster-replicated-config - is one option Caution: This command causes an overwrite of the member's entire set of search-related configurations, resulting in the loss of any local changes. ... View more

sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 Image!=Windows\System32 Image!=Windows\SysWOW64 | rex field=process .*\(?\S+)\s?$ | rename filename as event_filename | lookup isWindowsSystemFile_lookup filename as event_filename OUTPUTNEW systemFile | search systemFile=True | table _time dest host user Image ... View more

Try this, your search | lookup isWindowsSystemFile_lookup filename OUTPUT systemFile | search systemFile=True ... View more

| eval ts="580397" | convert rmunit(ts) as numSecs | eval stringSecs=tostring(numSecs,"duration") | eval stringSecs=case(stringSecs="00:00:00", "0+0:0:0", 0=0, stringSecs) | eval stringSecs = replace(stringSecs,"(\d+):(\d+):(\d+)","\1h \2min \3s") | table ts stringSecs ... View more

okay. You can use outputlookup command in your search query and save as report from GUI. so that it will save your report in corresponding apps folder. Then use scripted inputs to post that data in sharepoint. Below is the link for outputloookup command, http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/SearchReference/Outputlookup ... View more

try this, [ yoursourcetype] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none ... View more

Try below using dmc assets lookup, | inputlookup dmc_forwarder_assets| fields hostname os arch forwarder_type version last_connected status | rename hostname as Instance | eval now=now() | eval Duration_Not_Connected=now-last_connected | where Duration_Not_Connected<=2592000 | fields - last_connected now | sort Duration_Not_Connected | eval Duration_Not_Connected_Days = round(Duration_Not_Connected/86400,0) ... View more

Try using for less than use ampersand symbol followed by lt for greater than use ampersand symbol followed by gt ... View more

I don't know whether you can override SID. But you can sort SID | rest /services/search/jobs | where isSavedSearch=1 | table latestTime sid label Check below link, http://docs.splunk.com/Documentation/Splunk/6.6.2/RESTREF/RESTsearch#search.2Fjobs ... View more

https://regex101.com/ ... View more