Hi @senthild  More details needed from your side..  from AWS Cloud to Splunk Cloud or Splunk Enterprise? any recent changes to the HEC inputs?  get details from the user that which timeframe or logs are missing exactly.. pls check these logs yourself..   (may times the developers simply "think" something is missing) maybe, pls check these troubleshooting steps..  https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/Data/TroubleshootHTTPEventCollector   ... View more

Hi @splunkN00b  Pls copy paste the props.conf .. something got messaged up there..  Pls provide us some more details.. may we know what logs are these..  did you upload the logs manually or do you read these logs thru UF ... View more

Hi @Dallastek1  I assume this is about Enterprise Security Content management and i am not much sure of this task.  Chjekced the documentations and found this..  https://docs.splunk.com/Documentation/ES/7.3.0/Admin/Export hope this maybe helpful.. thanks.  ... View more

This is a known issue in versions before 6.2, where it is fixed. Until you're able to upgrade, you have a couple of options: Ctrl+A on the output so the output is all highlighted Change to light theme Click your username in the upper right Account Settings Change Them to Light Theme ... View more

Subsearches produces results like (field1=foo OR field2=bar), which not fit the syntax of the IN operator.  However, since IN maps to a sequence of ORs under the coverts, you can use the subsearch without using IN. | append [| tstats summariesonly=true allow_old_summaries=true values(All_Traffic.dest_port) as dest_port values(All_Traffic.protocol) as protocol values(All_Traffic.action) as action values(sourcetype) as sourcetype from datamodel=Network_Traffic.All_Traffic where (All_Traffic.src_ip [| inputlookup internal_ranges.csv ]) AND NOT (All_Traffic.dest_ip [| inputlookup internal_ranges.csv ]) AND NOT (All_Traffic.protocol=icmp) by _time All_Traffic.src_ip All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` | lookup ip_iocs.csv ioc as dest_ip OUTPUTNEW last_seen]   ... View more

Hi @inventsekar , Here is my SPL for Missle Map, | tstats `security_content_summariesonly` count from datamodel=Intrusion_Detection.IDS_Attacks where (NOT IDS_Attacks.src IN(192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 8.8.8.8, 0.0.0.0, 1.1.1.1, 0:0:0:0:0:0:0:1,"unknown",34.87.171.169 )) NOT IDS_Attacks.severity IN (low, informational) by IDS_Attacks.src | rename IDS_Attacks.* as * | eval animate="true" | iplocation dest prefix=end_ | iplocation src prefix=start_ | eval end_lat=if(isnull(end_lat),21.007647, end_lat) | eval end_lon=if(isnull(end_lon),105.807235, end_lon) | eval color = case(count <= 100, "#8fce00", count > 100 AND count <= 300, "#ed8821", 1=1, "#f44336") | eval end_City="Hanoi", end_Country="Vietnam", end_Region="Hanoi" | sort -count | dedup start_Country | table animate color count dest end_City end_Country end_Region end_lat end_lon src start_City start_Country start_Region start_lat start_lon ... View more

Only exception to don’t edit files inside default folder is, when you have created your own app. Then you must edit default files before deploying it to splunk. But then with gui you edit again only local files.  ... View more

Hi getting exact retention time for e.g. 1y in splunk could be almost mission impossible 😞 There is several parameters how splunk define when it removes those buckets, which has all events older than your defined retention time! You must understand than when splunk calculate retention in reality it's for all events in bucket! It's not event based, as a smallest storage unit is a bucket not an event. Practically this means that splunk can remove bucket, when all events in that bucket has older than your defined retention. In your case, you have quite low event volume, which means that you could have one bucket, which contains events from several months max(15GB divide 30MB divided by #hot buckets for that index ). Usually you have several (default is 3) active hot buckets (per search peer) at same time, where splunk can write new events. Default for keeping a bucket as hot is 90d or when it's come full or when you restart splunk. There are also some other parameters which could affect this! Here is some links where you could learn more how this is actually working: https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Bucketsandclusters https://community.splunk.com/t5/Splunk-Search/How-can-I-find-the-data-retention-and-indexers-involved/m-p/645365/highlight/true https://community.splunk.com/t5/Getting-Data-In/Indexes-configuration/m-p/564276 https://community.splunk.com/t5/Splunk-Enterprise/Splunk-shows-only-9-months-270-days-data-How-do-I-increase-the/m-p/624944#M14863 https://community.splunk.com/t5/Getting-Data-In/What-counts-for-Splunk-retention-time-if-events-come-in-with-a/td-p/601655 r. Ismo ... View more

AdLdapConnector :Saving state: { "app_version": "2.2.1" } {"identifier": "set_password", "result_data": [{"data": [{"user_dn": "cn=uba,ou=sec-user,dc=seclab,dc=lab", "samaccountname": "uba", "set": false}], "extra_data": [], "summary": {"set": false}, "status": "failed", "message": "unwillingToPerform: Make sure account in asset has permissions to Set\n Password and password meets complexity requirements", "parameter": {"use_samaccountname": true, "user": "uba", "password": "ubapass", "confirm_password": "ubapass"}, "context": {}}], "result_summary": {"total_objects": 1, "total_objects_successful": 0}, "status": "failed", "message": "1 action failed", "exception_occured": false, "action_cancelled": false} Traceback (most recent call last): File "/opt/phantom/apps/adldap_*.py", line 32, in <module> raise Exception("Action Failed") Exception: Action Failed ... View more

The problem here is in deciding on the proper logic for the alert. If you're supposed to get an event at the same time of the hour (like around XX:32) and then next one within 5 minutes, you can get away with scheduling a search at - for example each XX:08 and XX:38 and searching some 6-7 minutes into the past and checking if you have less than two results. That's the simplest solution and can often be enough. But if your case is more complicated (like the time the events are generated is more "floating" around the hour), you might need to schedule a search more often, search through data some 30+ minutes back and calculate the event lag as I mentioned. It's about defining a problem precisely 🙂 ... View more

Hi @abedcx  The issue is the timestamp. i believe you found out some details from @richgalloway 's replies.  the Actual issue.. when you are searching, there are sooo many events with same timestamp, so Splunk is not able to do the searching. May we know what your search query(SPL).. we can fine-tune it, so that the Splunk will need not look into sooo many events. please suggest, thanks.  ... View more

Great! Thanks @PickleRick , I'll give that a shot! ... View more

Hi @pmantri10  The golden rule is - Good questions will receive Good answers!  from the subject i assume you want to list out all HEC inputs you have in your Splunk instance(either Splunk onprim or Splunk Cloud). if yes, then Pls go to Settings --- >  Data --- > Data inputs on this page, look for "HTTP Event Collector" (clickable link).. when you click on it, you will get the list of HEC inputs you have configured in your Splunk instance.    PS - if any reply helped you, pls upvote/add karma points. if any reply solves your query, pls accept it as solution, thanks.  ... View more

Hi @Emre1  >>> i did a free trial 14 days for splunk You did a free trial of Splunk Cloud, right?   >>> If i want so access instance, it isnt even accessable on your email, did you get an email from Splunk Cloud, to access the Splunk Cloud instance? did you click and login? if yes, pls share the screenshot.    ... View more

Hi @jenniferhao .. i am not much sure of whether two windows or one window, but lets do troubleshooting... could you pls update us what output you get.. from the results, you can decide about next steps.. thanks.  | mstats count(os.cpu.pct.used) as c where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) by host_ip | join host type=left [| mstats avg(ps_metric.pctMEM) as avg_mem_java avg(ps_metric.pctCPU) as avg_cpu_java count(ps_metric.pctMEM) as ct_java_proc where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) sourcetype=ps_metric COMMAND=java by host host_ip COMMAND USER ] ```| fields - c commenting the above fields command for a testing``` | eval is_java_running = if(ct_java_proc>0, 1, 0)   ... View more

Hi @usej  on Splunkbase i see no apps for backbase and/or fintech, so no community developed apps/addons available yet.  Creating your own app and onboarding logs is a simple task, this may require some Splunk Dev experience, but we can help you with that. Let us know more details, thanks.  ... View more

OK. So modifications to Domain Admins group is reflected with different events that 4743. So you seem to have a different problem than just losing one particular eventid. ... View more

Hi @cooldude1812  >>>it looks like all versions of SPlunk (up to 9.1.2) will work on Linux 3.x and 4.x kernels.  Yes, right. in fact, 5x also good (All Linux x86 (64-bit) 3x, 4x and 5x are good with Splunk 9.1.2)   >>>My concern about the 8.2.x is that SPlunk clearly says this is no longer supported since 9/30/23.x Yes, you are right.  Splunk Enterprise version 8.2.x is no longer supported as of September 30, 2023. To have Splunk support and to avoid the security issues on older versions, the Splunk Customers should upgrade from 8.2.x to 9.x.x.  hope you understand the issue better now, thanks.  ... View more

@inventsekar  yes, when we put result = 0 it shows the result . But if we put greater than =0 it doesn't shows the result . ... View more

You can't replace the lat/long, but you can add country to the log_subtype, i.e. | iplocation client_ip | eval type=log_subtype." (".Country.")" | geostats count by type ... View more

@inventsekar The page below is likewise broken. I tried the URL you suggested. That indicates that the problem is with all the other folders where the macro is resistant, right?   ... View more

Hi @yvan-rostand  As per my understanding, you should use props and transform.conf as well.   Maybe could you pls try this idea - forward data to 3rd party systems: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd   ... View more

1. Please don't shout. 2. It depends on what kind of data you have. Without knowing that we can't help you. Properly deployed Splunk infrastructure should have some docummented inventory of the sources ingested, sourcetypes, destination indexes and so on. 3. Also just because you can log in to your Splunk server doesn't mean you have access rights to the indexes containing information you need. You have to consult with your local Splunk admin about it. ... View more

Hi @ArgyTheo  >>> WARNING: web interface does not seem to be available! 1) looks like the 8000 port is not available. pls check if that port is being used by some other processes  2) check the top command for any Splunk processes that are running  3) Maybe the old process id still running and binding that port number 8000, if its ok, try to do a system restart itself.  4) pls check the splunkd.log for more details.  5) are these certs you self generated or third party generated ... View more