I think the issue is finding a way to accomplish this in splunkweb, instead of directly in .conf files. ... View more

You can use FIELDALIAS in props.conf to rename the auto-extracted field names into datamodel compliant (preferably CIM-compliant, if possible) field names: FIELDALIAS-<class> = (<orig_field_name> AS <new_field_name>)+ * Use this to apply aliases to a field. The original field is not removed. This just means that the original field can be searched on using any of its aliases. * You can create multiple aliases for the same field. * <orig_field_name> is the original name of the field. * <new_field_name> is the alias to assign to the field. * You can include multiple field alias renames in the same stanza. * Field aliasing is performed at search time, after field extraction, but before calculated fields (EVAL-* statements) and lookups. This means that: * Any field extracted at search time can be aliased. * You can specify a lookup based on a field alias. * You cannot alias a calculated field. ... View more

Are you having to use the UI to do this because it's Splunk Cloud? I've been unable to get this working without setting DEST_KEY in transforms.conf, which isn't possible via the UI that I can tell, so you may not actually be able to accomplish this in Splunk Cloud (though I'm going to keep trying, or maybe someone else already knows how). If it's not Splunk Cloud, you may need to send your transforms/props to the admin to put in place. Or, you could put said configurations in place via conf file on a heavy forwarder you maintain which sends the events to the indexers. ... View more

Can you add more context to your lookup file and/or indexed data that you are trying to create a search for? ... View more

You can add new fields to your results as you need. | eval subject="This is a test subject" You could then use $result.subject$ in your alert. ... View more

I don't have an answer as to why Splunk decided that a panel with no values would be of a larger-than-necessary size, but perhaps this recent answers post could help you mitigate that annoyance by hiding the panel when there are no results. ... View more

My search was intended to be run by itself, not as part of another search. To try it with your data instead try this: sourcetype=windowseventlog:security | rex field=user "(?<userminusdollar>.*)\$$" | where host!=userminusdollar The above assumes that the username is in a field called user . ... View more

Are your indexers part of a cluster? If so, you would add the app to etc/master-apps on your cluster master and apply the bundle. You will often find apps that require installation on the indexer (or heavy forwarder). You definitely need to have a means to apply apps to your indexers en masse. ... View more

To share dashboards the user must have write permissions to the app they want to share the dashboard in. Granting power user will do this, but as stated previously, it is almost certainly overkill. Instead, I'd suggest creating an app that members of a new role (which you also need to create, and add mentioned users to) has been granted write permission on. The default.meta for this app might look like: [] access = read : [ * ], write : [<newrolename>] ... View more

Mail logs are awful, and I'm sorry you are going to be stuck dealing with them. Seriously. While this example may be easily handled by the answer below, you'll find that the subsearch method for mail logs quickly becomes unscalable. My recommendation is to look into summarization for your mail logs. Something like: | stats earliest(_time) AS _time, values(subject) AS subject, values(sender) AS sender, values(recipient) AS recipient, values(attachment) AS attachment BY ID that gets written to a summary index, such that later you can search your summary index like: index=mail_summary subject="Invoice Number" | stats count BY subject sender recipient ... View more

This run anywhere example shows one possibility: | makeresults | eval host="Server_ABC", user="Server_ABC$" | rex field=user "(?<userminusdollar>.*)\$$" | where host!=userminusdollar The key to the above search is that the where command can compare two fields, whereas the search command can not. ... View more

I'm refining this response. It doesn't appear to work as currently stated. ... View more

You could rewrite _raw at index time. That would happen after timestamping, so it might be a viable solution for you. Your props.conf might look like: [<sourcetype>] SEDCMD-keepjson = s/^[^{]*// Edit: fixed SEDCMD line. Added answer with this info, since it's a different solution than the answer of which this comment is a child. ... View more

Glad to hear it worked. Do you mind accepting the answer so that this question doesn't still appear to be open? ... View more

Please reference a recent answers post that may provide what you need. ... View more

Based on previous answers post: <your base search> | rex "(?<json>\{.+)" | spath input=json ... View more

You do not need to change deploymentclient.conf at all. Your deployment server will still listen on 8089, and your deployment clients (your UFs) will still point to deploymentserver:8089 . All you are intending to change is the internal splunkd port that your UFs are running on (which won't really be used by anything other than themselves). To do this you simply need to deploy an app with the appropriate setting in web.conf (as shown above). This involves creating the app in deployment-apps and either using the UI to create the serverclass and assign the app to that serverclass, or makeing these changes it via serverclass.conf directly. There shouldn't be any need to change any other ports or configurations. ... View more

You need to make that change in an app that gets pushed to the UFs. To do that you'd create an app in etc/deployment-apps on your deployment server. You don't need to make any changes to the deployment server's ports. You only need to have it configure the UFs to use different ports. ... View more

What do you see when you try to search? A screenshot is probably very valuable to help troubleshoot. ... View more

Where is the issue occurring: on the UFs you're deploying to, or on the Deployment Server? It seems that you're stating the former, which wouldn't really make sense as deploymentclient.conf doesn't set a port that any service listens on. Instead it configures the port that the remote end (the deployment server) is already listening on. Please provide detail regarding where components are installed, and which are in conflict. ... View more

Despite @dspritz already having posted the better (and more definitive) answer, I'm wondering if you could detail what my answer didn't correctly handle, so that I can refine my own abilities. ... View more

But again, I haven’t been able to find documentation detailing this. But this is what I have witnessed as taking place. ... View more