You're welcome. If you need more assistance in this, please feel free to reach out or put a new question in the community. Happy Splunking and best wishes. ... View more

Are you using Victoria experience or classic experience in Splunkcloud. If you are using classic experience, please file a Splunk support case to check and get SOAR's IP address whitelisted. If you are using Victoria experience, you can go to Settings -> Server Settings -> IP allow list for doing the same. Please note that this requires a user with sc_admin role assigned to it. ... View more

Updating the thread: HTML dashboards have been deprecated and must be converted using Splunk dashboard studio as Splunk has moved away from them. They cannot be fixed or used. ... View more

The problem is in your query (and possibly your lookup definition).  Generally speaking, using inputlookup as subsearch is not a solution in cases where you really mean a lookup match. Splunk's lookup definition allows you to specify match type, one of them is CIDR.  You'll need to check "Advanced options" to add it. Suppose your file match_cidr.csv contains the following subnet known_network 10.100.0.0/16 mine 10.16.5.0/24 friends 10.16.205.0/24 enemies and the lookup name is also match_cidr.csv.  Instead of inputlookup, the correct command is lookup. | lookup match_cidr.csv subnet AS src_ip | where isnull(known_network) This will find all src_ip's that are not your own, not your friends', and not your known enemies'. ... View more

Hi Shiv, I tried to update the request_timeout = 300 but still getting the similar error. ... View more

2022-10-31 09:41:14,147 ERROR pid=14783 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/ta_ms_log**bleep**ytics/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/log_**bleep**ytics.py", line 96, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/input_module_log_**bleep**ytics.py", line 72, in collect_events response = requests.post(uri,json=search_params,headers=headers) File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/ta_ms_log**bleep**ytics/requests/api.py", line 110, in post return request('post', url, data=data, json=json, **kwargs) File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/ta_ms_log**bleep**ytics/requests/api.py", line 56, in request return session.request(method=method, url=url, **kwargs) File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/ta_ms_log**bleep**ytics/requests/sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/ta_ms_log**bleep**ytics/requests/sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "/opt/splunk/etc/apps/TA-ms-log**bleep**ytics/bin/ta_ms_log**bleep**ytics/requests/adapters.py", line 473, in send raise ConnectionError(err, request=request) ConnectionError: ('Connection aborted.', error(104, 'Connection reset by peer')) ... View more

I have the same issue. Any solution here? Seems that something is missing in the app for on Prem ... View more

Hi 1st you need to understand what are those events which amount have decreased. Is there some special type which have vanished or are all types decreased equally? Based on that you could have better understanding what has happened and where. You didn't say how you are collecting those events. Have you a separate syslog based service which receive those and then those are collected by splunk or are you sending those directly to splunk UF/HF/indexer? If last one then it's not a best practices and it shouldn't use ever on production! r. Ismo ... View more

This is the update of the first search.   ... View more

Yes you can.   Here is the doc that shows the configs to do so.  https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Configuremulti-clustersearch https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCandindexercluster   ... View more

My question is if it's possible to backfill data with the the splunk add-on for vmware as far as my research goes it's not possible maybe will add it as a feature request ... View more

I've updated the regex above. Please try that. Should extract the sentences that you listed as examples. If it needs more modification, kindly share some sample data to create an accurate regex. ###If it helps, kindly consider mark as accepted answer###     ... View more

Thank you, because it's  streaming command, so i need to but things back to the result. And I found the way 😄 thanks. ... View more

I think this should be reported to Splunk with a support ticket since its Splunkcloud. They can take a look at the rollback problem. ... View more

Yeah, I suppose rejoining the cluster would probably solve it. I'm scheduling an upgrade so I'll be restarting all indexers anyway. 🙂 Was thinking about where did the problem come from in the first place. There might have been some interminnent communication issues (but connected more with the general splunkd "freeze" due to storage problems than network problems). But as the message says - I'd expect the problem to correct itself after a while. Well, we'll see. Thanks for hints. ... View more

A support ticket to Splunk is the best option here for a quick and effective resolution. ... View more

Couldn't find any particular documentation, but this should guide you to the appropriate steps for the migration. The syslog setup seems pretty straight forward, if you are to use a linux machine for installing Splunk (Which is always recommended) https://help.sumologic.com/Manage/Data-Forwarding Hope this helps, ##Kindly consider accepting as answer/upvoting if it helps### ... View more

When you run a search, the index and time define the buckets to be considered to retrieve the data. Now, not all the buckets would have the data that you're looking for. Bloomfilter and metadata help to eliminate the buckets which are unnecessary for the search, making the data search faster (The number of eliminated buckets is what you see in eliminated_buckets in the job properties or audit.log). It then goes through multiple steps (Slices identification by querying tsidx, extract and parse data from slices,  more event elimination and then processing via SPL to give you the desired output). This is why its always recommended to include the metadata (index and source/sourcetype) and other key words in your search to make it more efficient. (Inclusion better than exclusion). Hope this helps, ###If this helps, kindly consider upvoting/accepting as an answer### ... View more

Edit the namespace value with the actual value as per your environment and add the value for transforms (If available for the lookup or leave it blank)   <option name="list.drilldown">full</option> <drilldown> <link target="_blank">http://myServer:8000/en-US/app/lookup_editor/lookup_edit?owner=nobody&namespace=myAppName&lookup=client_information.csv&type=csv&transform=</link> </drilldown>   ###If it helped, kindly consider an upvote/accepting as answer###   ... View more

Can be achieved via the magic of props, transforms and outputs.conf on a heavy forwarder. Here are the steps. Select the log source, find its metadata value (host, source or sourcetype) in props.conf (Under the app where your inputs is kept or under system/local), put the following   [yoursourectype/host/source] TRANSFORMS-routing=route_data_to_region1 TRANSFORMS-routing1=route_data_to_region2 TRANSFORMS-routing2=route_data_to_region3   In the same directory, under transforms.conf, please put the following:   [route_data_to_region1] REGEX=<Your regex to match the data that you want to send to this region> DEST_KEY=_TCP_ROUTING FORMAT=target_group1 #You can name the target group name mentioned in the outputs.conf of this region as well [route_data_to_region2] REGEX=<Your regex to match the data that you want to send to this region> DEST_KEY=_TCP_ROUTING FORMAT=target_group2 [route_data_to_region3] REGEX=<Your regex to match the data that you want to send to this region> DEST_KEY=_TCP_ROUTING FORMAT=target_group3   Now in outputs.conf under the same directory, you can route the data to your different SplunkCloud regions. Since its SplunkCloud, please add the certificate path and key like the one present in the certificate app.   [tcpout:target_group1] server=<ip>:<port> #Enter your indexers' IP address and details #Add more details like cert's path (Provided by Splunk for Splunkcloud) for TLS handshake, key's path and other configs as required. [tcpout:target_group2] server=<ip>:<port> [tcpout:target_group3] server=<ip>:<port>​   Restart splunk service on the HF and the data routing shall begin.   Hope this helps, ##If this helps, please consider an upvote/accepting as an answer### ... View more

I have reported this as a bug lets see what they say. ... View more

Well, Splunk related scripts are executed from $SPLUNK_HOME/bin/python to maintain the compatibility with the environment. You can specify the libraries inside the /bin directory of your app, if you have external libraries' dependency. If sys.append.path didn't work, then unfortunately you'll have to make do with Splunk's path. ... View more

Agreed. The term absolute time shouldn't have been used in the answer. I have edited it. Was thinking in a different direction, typed half of the answer and then the chain of thoughts changed. Since Splunk handles the missing %H:%M:%S gracefully, it should with the date too.  ... View more

index=other_index [ index=my_index | rex field=_raw "ID=\[(?<id>.*\]\[.*\]" | table id ] ... View more