If you are posting to the JSON endpoint not the raw, there is no processing on the data for transforms to work. Best solution is don't send the password to begin with. Edit the sending source's send code to exclude it. ... View more

You cannot get features of a lookup definition if you reference the filename.csv. Create the lookup definition then use that name in the lookup command. ... View more

don't use table in combination with base search with large event count. table is not a streaming command. use fields or a stats. ... View more

https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourevents ... View more

don't do that. use a lookup as a lookup and make it a wildcard match type. index=web | lookup HighRiskWords web_Search outputnew web_Search as isFound | where isnotnull(isFound) | stats count by web_Search, web_User, _time ... View more

better to batch post the data https://github.com/georgestarcher/TA-SyncKVStore/blob/master/bin/input_module_kvstore_to_kvstore.py ... View more

as mentioned many ways | makeresults | eval fieldA="12345" | eval fieldB="1234" | where !like(fieldA,fieldB) ... View more

Depending on your exact version of splunk only recently shared data model accelerations became a feature. Even with that you will have to be responsible for ensuring all configurations are replicated on the stand alone for parsing lookups etc. Otherwise as stated above check compatibility matrix between versions to ensure the SH can talk to older indexers. I expect it should be ok. ... View more

You need to do several things. 1. configure a lookup definition which cidrmatching 2. reference the lookup definition name in the lookup command NOT the filename.csv. When you reference the file directly you bypass the lookup definition features and break your cidrmatching Optional 1. Why are you using a custom table instead of updating the geolocation database and using the iplocation command? https://github.com/georgestarcher/TA-geoip https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation ... View more

You should write python and use the rest API to update the lookup in that situation. Look into the python sdk and kvstore examples. ... View more

If you mean sending logs in. Look into HTTP Event Collector. https://github.com/georgestarcher/Splunk-Class-httpevent ... View more

Agreed you are likely greatly exceeding your search dispatch capacity doing that. You should consult your splunk admin on what the available capacity is in your SHC with ES/Data model accelerations/User interactive search patterns etc are to decide remaining capacity. ... View more

Because there are times you want to dedup without using stats. So both commands are valid. If you are going to stats then you would be redundant to also use dedup. ... View more

Short answer is don't edit the stock DMs. JSON files do not stack like regular conf files. Once you choose to edit you are in the commitment of hand reviewing and updating DM JSON files for your "branch". This was a very unfortunate development choice in file behavior for the JSON DM files vs regular conf files. Your options are maintain non stock versions, being sneaky and being more creative with your onboarding such as merging contextual information into fields like signature so they make it through the stock data model or just live with the stock DMs if you use them. ... View more

https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/BackupKVstore ... View more

Set kv_mode=JSON on the sourcetype definition in props. Do not rely on kv_mode=AUTO ... View more

If JSON is that big you should use code outside of Splunk to parse it into reasonable events and send those in. Also when sending in properly formed JSON use kv_mode = JSON on your sourcetype definition in props. ... View more

Best practice for syslog is use a syslog server. Then use a UF to pickup the log files it writes. ... View more

Best practice is do your data onboarding into an app then put that on both deployers and deploy to both clusters. there is no inter SHC replication feature. ... View more

You shouldn't run a heavy forwarder to pickup syslog. You should use a universal forwarder. Configuration of either install can do it, however inputs and getting data in can be found at https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Getstartedwithgettingdatain You may want to consult your splunk administrator or professional services if you have not used splunk at all before. ... View more

The standard solution is to run a syslog collector with a UF as stated. You could make a new one and redirect syslog there. ... View more

https://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Ports https://www.aplura.com/cheatsheets/splunk_network_ports.html ... View more