Can you try adding -H "Authorization: Bearer <your_token>" instead of username password? I hope you will find out how we can do this in python or other script. ... View more

@jip31, Yes it is possible to implement this with Javascript but solution will be very long so, you should try considering ctrl+F in the browser as suggested by @493669. ... View more

Hi @jip31, Do you want to search panel by it's title from the dashboard? ... View more

Hi @silverlink34, Can you please share some of the sample of your events and what do you want exactly as result? ... View more

Hi @kleszczynski, Can you try max_count option while creating search (not while getting the result)? ... View more

@alex129, Can you explain with example what do you mean by similar url? ... View more

Hi @kleszczynski, Can you try adding count and output_mode=json into data option in curl? ... View more

Hi @viji261992, can you please elaborate what kind of report you want to show? ... View more

Hi @jcleary47, Can you try below query? Please make sure query before this is extracting message and server field. | search message="HW mode activated" | stats count by server | where count < 2 | eval message="HW mode activated" | table server, message, count eval statement is just added in case you want message to be displayed. Hope this helps!! ... View more

Hi @silverlink34, I'm assuming that msd_number is unique per email. ...<index-search-here> | stats list(Email_To_Address) as To, list(Email_From_Address) as From by msd_number Hope this helps! ... View more

Hi @chintu_jain, batch stanza of inputs.conf DELETES THEM IMMEDIATELY, and that is also mentioned in the documentation of inputs.conf, you can search and read that. ... View more

Hi @asimagu, You can use script to get data from QRadar and send them to Splunk. Here is how you get events from QRadar: Send a POST request to curl -X GET -k -u username:password https://?qradar-url?/api/ariel/searches --data-urlencode "query_expression=" If response is 201, obtain search_id from response Send a GET request to /ariel/searches/{search_id} to obtain the status of the search. While the response code is 200 and the status is not 'COMPLETED' or 'ERROR', loop. If the status is 'ERROR', you can use the error_messages response to obtain information. If the status is 'COMPLETED', you can get the results via GET /ariel/searches/{search_id}/results You can use python requests module instead of curl, if you want to code this script into python. Get more info about above steps: https://www.ibm.com/developerworks/community/forums/html/topic?id=d8d0c48b-825b-40b1-bedc-b3a08548c695 You can use HEC to index these events into Splunk. curl -k https://?splunk-url?:8088/services/collector/event -H "Authorization: Splunk HEC-token" -d '{"event": }' Here is the detail description how can you use HEC in Splunk and how can you generate HEC token from Splunk UI: http://docs.splunk.com/Documentation/Splunk/7.1.3/Data/UsetheHTTPEventCollector ... View more

Hi @alpsholic, No you cannot get access to Splunk with REST call without having username and password. But you can ask them for the Session key. Ask them to generate a session key and they can give it to you. curl -u admin:changeme -k https://localhost:8089/services/auth/login/ -d"username=admin&password=changeme" <response> <sessionKey>30774f9d502004b5c655c08b5362bdca</sessionKey> Hope this helps! There are some other authentication methods available in Splunk, but I don't think that will work with REST api calls - http://docs.splunk.com/Documentation/Splunk/7.1.3/Security/Setupbuilt-inauthentication ... View more

Hi @evinasco, Looks like you want to see size growth of particular index over the time, below approach may help. | dbinspect index=_internal | stats sum(sizeOnDiskMB) as size | eval index_name=_internal | collect index=main sourcetype=index_growth Change the _internal with your index name you want to monitor. Run above query in search bar, click on Save as Alert. Select alert type as "Scheduled", select schedule period from below drop-down based on your requirement. Click Save. In future whenever you want to see the index growth over time write below query to get the timechart. index=main sourcetype="index_growth" | timechart avg(size) by index_name Hope this helps! ... View more

Looks like firewall issue, check for port 9998 should be open from both the side, Splunk and DBX side. Port 9998 should be publicly open. Try this! Make sure you have configured Splunk DB Connect correctly - http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/ConfigureDBConnectsettings ... View more

Hi ADRIANODL, I think in my case it is working just by writing cont=false, nothing else is required. Can you tell me which Splunk version are you working on? ... View more

Hello @amulay26, You need to install TA_Windows on forwarder, indexer and search head all three layer. Forwarder - You need to configure inputs.conf file for the data collection ( Indexer and Search Head - It is required for different purpose then the data collection. You must require TA_Windows on search head and indexer for the purpose of index time and search field extraction, index creation and lot more. On indexer data collection won't start so that will not be dependent on OS. http://docs.splunk.com/Documentation/Splunk/7.1.3/Indexer/Indextimeversussearchtime (Field extraction) ... View more

Hi @madhufuture, Try starting Splunk with Administrator permission. If that does not work then try removing below file, chmod -R 400 $SPLUNK_HOME/var/lib/splunk/kvstore/mongo/mongod.lock Restart the Splunk, now hopefully kvstore will start. ... View more

Hi @ADRIANODL, Ideally your query should work fine and as expected as you have mentioned cont=false with timechart, but if you are using old version of Splunk then please check Splunk doc of timechart (http://docs.splunk.com/Documentation/Splunk/5.0.6/SearchReference/Timechart) with Splunk version are you using. If not work try another approach below with stats function, if you are sure you want your data month wise (as show in the attached screenshot of question) then following query may help. index=crypto CurrencyB="CND" OR CurrencyS="CND" | eval month=date_month." ".date_year | stats sum(eval(if(CurrencyB="CND",Buy,Sell*-1))) as Total, sum(eval(if(CurrencyB="CND",round(Sell/Buy,8),null))) as UnitPrice by month | streamstats sum(Total) as Gtotal Try above query!! ... View more

Hi @danielearangiomazza, I don't understand your question properly, if you can give query before foreach or sample input-output so I can help you. ... View more

Hi @MousumiChowdhury, If you need to download third-party library in your case pyMC and you need to put that within, $SPLUNK_HOME$/etc/app/ /bin , if you want to use throughout multiple apps you can use $SPLUNK_HOME$/Python-2.7/Lib/site-packages. Directory for third-party library needs to have __init__.py file, then you can import that with just writing import pyMC. I'm assuming directory library is having name pyMC and it had init file. ... View more

Hi @jadengoho, Here is the best example I found for what @kamlesh_vaghelahas suggested. https://www.hurricanelabs.com/splunk-tutorials/splunk-custom-endpoints-part-1-the-basics ... View more

Hi @kamlesh_vaghela, I work around your solution, this is amazing. I've also added something to make look it actually like predict function. See query below. index=_internal sourcetype=splunkd* | timechart span=1m useother=f count as Count by sourcetype where stdev in top1 | foreach "*" [ eval column_value='<<FIELD>>', column_name="<<FIELD>>" ] | predict column_value future_timespan=14 | filldown column_name | eval {column_name}=column_value, "prediction({column_name})"='prediction(column_value)', "lower95(prediction({column_name}))"='lower95(prediction(column_value))', "upper95(prediction({column_name}))"='upper95(prediction(column_value))' | eval _lower = "lower95(prediction(".column_name."))", _upper = "upper95(prediction(".column_name."))", _predicted = "prediction(".column_name.")" | fields - column_value column_name "prediction(column_value)" "lower95(prediction(column_value))" "upper95(prediction(column_value))" ... View more