Getting data in guide http://dev.splunk.com/view/dev-guide/SP-CAAAE3A Splunk has no integrated office doc parsing and extraction method. You need to extract the data and submit it using another method. ... View more

Oh and the reference card http://www.splunk.com/content/dam/splunk2/pdfs/solution-guides/splunk-quick-reference-guide.pdf ... View more

And the older but classic free SPL eBook http://www.splunk.com/goto/book ... View more

Try to never run as root if you can. https://github.com/MattUebel/splunk_UF_hardening ... View more

Assuming the field is called guid: | rex field=guid "^ComputerName-.[^-]+-(?P[^\$]+)" ... View more

This? I think your logical grouping may be off. (A AND B) OR (C AND D) vs A AND B OR ( C AND D). ( source="*playbackinit.log" s=139) OR (source="*playbackevent.log" s=139 e="start") ... View more

Just to recap. Make sure you are getting the valid session key. Print it out. You could also test your code by substituting a connect by a static username/password combo temporarily You might try changing your sessions to the following. Since you are getting the storage password list, app is going to be irrelvant. service = client.connect(token=session_key) Confirm what user context the knowledge object is running under (input/alert etc), I suspect that nobody or your session key is causing you the issue. http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6#currentuser Ensure that user has the list_storage_passwords capability. Use something like this to grab just the credential that matches the desired realm and username retrievedCredential = [k for k in storage_passwords if k.content.get('realm')==realm and k.content.get('username')==username][0] ... View more

All knowledge objects still have owners. The session key is going to auth as whomever that is. That will determine the permissions/capability by role. This shows you how in your code to tell which user you are. http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6#currentuser ... View more

It runs as whomever (splunk user) owns the search that fired. That is not the same thing as what splunkd runs as. You are confusing OS vs Application users. ... View more

The documentation for the Splunk Add-on for AWS can be found at https://docs.splunk.com/Documentation/AddOns/released/AWS/Description The Splunk app is the gui portion. The add-on pulls data. ... View more

You might also want to do something more like the following to get a specific credential matching the desired realm and username. just a little more compact that the typical for loop structure. retrievedCredential = [k for k in storage_passwords if k.content.get('realm')==realm and k.content.get('username')==username][0] ... View more

Does the user firing the alert have the capability: list_storage_passwords ? ... View more

True though technically one that gets around the append command susbearch/limits is 'more correct' for larger data sets 😉 ... View more

It is a valid solution. I just failed to paste the copy with the append=t in the search example though I mentioned it in the comment. I have fixed the example. ... View more

I had originally pasted the actual command without the append=t. That has been fixed. ... View more

using the append command runs into sub search limits. You should use the prestats and append flags for the tstats command. | tstats prestats=t summariesonly=t count from datamodel=DM1 where (nodename=NODE1) by _time, nodename | tstats prestats=t summariesonly=t append=t count from datamodel=DM2 where (nodename=NODE2) by _time, nodename | tstats prestats=t summariesonly=t append=t count from datamodel=DM3 where (nodename=NODE3) by _time, nodename | stats count by _time, nodename ... View more

We also tend to recommend using a third party cert if you have no easy trust management of your user systems. https://wiki.splunk.com/Virtual_.conf April 2016 section for materials on SSL and Splunk. ... View more

Using lookups as a subsearch filter works. It can be limiting if the table is large. Granted it might not be in your case but this is a handy pattern. change isnull to isnotnull if you want to flip the results. index=scanner | stats count by dvc | lookup test_lookup.csv name AS dvc OUTPUTNEW name as isFound | where isnull(isFound) ... View more

A time based lookup would allow for historical searches. ... View more

Sourcetype like time, line breaking, source etc are index time fields not search time. Bro is a high volume data source. I would not recommend index time rewriting of sourcetype. Just set the sourcetype correctly at inputs. ... View more

If you use that in a cluster you should make it shared storage all the indexers can see that has a LOT of room. Use a sub folder per indexer. You will get duplicate buckets this way. That is why it's complex. You then have to come up with some programatic way to dedup the frozen buckets that get dumped from multiple indexers to reduce your storage consumption after they land. ... View more

Are you using index clustering? If not clustered then coldtofrozendir is easiest way. If clustered it is a lot more complex and likely involves a professional services engagement. ... View more