could you paste here a sample of the data you're looking at? ... View more

If this field is not created, it's one of two cases: 1 - either Creator_Process_ID or New_Process_ID fields do not exist 2 - Creator_Process_ID is never equal to New_Process_ID In any of the two cases, Creator_Process_Name will be null for all the events, and so the field doesn't event get "created" (shown). Please check those cases. P.S. This is how I'd put the query anyway. index=wineventlog hostname1 |eval Creator_Process_Name=if(Creator_Process_ID=New_Process_ID, New_Process_Name,null()) ... View more

welcome. don't forget to upvote the accepted answer 😉 ... View more

In the indexer indexes.conf of the Indexer only If you want 2 months then convert it to seconds: 60*86400=5184000 [] frozenTimePeriodInSecs = ... View more

You can send logs to Splunk and configure any available port to listen to those syslog messages: [tcp://<remote server>:<port>] * Configures the input to listen on a specific TCP network port. [udp://<remote server>:<port>] * Configures the input to listen on a specific UDP network port. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf Usually sending syslog directly to Splunk is not a best practice but you could instead use an intermediate Syslog-NG or Rsyslog to write it to disk, and have a Splunk UF monitoring those files. If your Polycom can send HTTP data, you can also enabel HEC on Splunk Indexers and listen to that stream of data directly into Splunk: https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/UsetheHTTPEventCollector ... View more

The REST modinput would obey to the same parsing principles. What data are you trying to parse? ... View more

You can try it yourself but that should be the fastest way from my experience ... View more

You may be getting events arriving later into the instance, what could explain the variation in numbers you;re seeing Check the _indextime field in those events to verify that ... View more

I'd start by checking which are the sourcetypes that are being badly distributed between the two sites. What about connectivity between the log sources and each of the sites? ... View more

Maybe you're missing escaping the ? | rex field=_raw "(?<url>https[^\?]*)" ... View more

Seems what you're looking for is a straight comparison between the two fields, not one field compared to a string: index=wineventlog hostname1 |eval Creator_Process_Name=if(Creator_Process_ID==New_Process_ID, New_Process_Name,NULL) What do you think ? ... View more

The installer is not exclusive, you can reuse it as many times as needed. The specific things (like splunk_secret) for each machine are generated at installation time and they are transparent to you, no action required You have a tar.gz or an .rpm with you, so why not keep that file in a orchestration machine to use it later? Could you have an ansible server that could push the installer to other machines? ... View more

Why aren't you trying the | lookup command on that ? index=windows | lookup default_user_accounts.csv OUTPUT user ... View more

Yes, with batch you don't get that possibility ... View more

CRC settings belong to the monitor::// stanzas, not the batch ones. It seems you need to take care of the deleting permissions of the files for Splunk user to be able to delete them. ... View more

| makeresults | eval volume=10, app="app_A", _time=relative_time(now(),"-1h") | append [ | makeresults | eval volume=200, app="app_A", _time=relative_time(now(),"-2h") ] | append [ | makeresults | eval volume=90, app="app_A", _time=relative_time(now(),"-3h") ] | append [ | makeresults | eval volume=30, app="app_B", _time=relative_time(now(),"-1h") | append [ | makeresults | eval volume=600, app="app_B", _time=relative_time(now(),"-2h") ] | append [ | makeresults | eval volume=150, app="app_B", _time=relative_time(now(),"-3h") ] ] | append [ | makeresults | eval volume=40, app="app_B", _time=relative_time(now(),"-1m") | append [ | makeresults | eval volume=12, app="app_B", _time=relative_time(now(),"-2m") ] | append [ | makeresults | eval volume=34, app="app_B", _time=relative_time(now(),"-3m") ] ] | append [ | makeresults | eval volume=10, app="app_A", _time=relative_time(now(),"-1m") | append [ | makeresults | eval volume=20, app="app_A", _time=relative_time(now(),"-2m") ] | append [ | makeresults | eval volume=30, app="app_A", _time=relative_time(now(),"-3m") ] ] | timechart span=1h sum(volume) as Total by app | addtotals fieldname=HourlyTotal | foreach app_* [ eval hourly_<<MATCHSTR>>=if(app_<<MATCHSTR>>>100,1,0)] | stats last(app_*) as last_hour_app_*, max(hourly_*) as hourly_max_app_*, sum(HourlyTotal) as Total Try this sample code and see if the logic works for you ... View more

The move_policy MUST be sinkhole for that to work as you want. move_policy = sinkhole * This setting is required. You must include "move_policy = sinkhole" when you define batch inputs. ... View more

I believe that's where aws was expecting the http request so I'm not sure there's a way around that ... View more

But wait, you changed the RF and SF before finishing the decommission? Every bucket needs to have a primary. That's the premise for you to have all your data searchable If your SF is 1 and it is not met, you'd need to later rebuild the tsidx files for that bucket later from the raw data (RF data) ... View more

No, you need to wait for the decommission to finish. Let it keep running for longer and that should be fixed ... View more

system/local has the maximum level of precedence ... View more

The default password is "password" ... View more

Use rex to extract only the number part of the field and then use Boot_Duration>1000 ... View more