It looks like your indexer is configured to check client certificates and their names, and the forwarder sending logs doesn't have a certificate which matches the indexer's allowed names. Check these configurations on your indexer's inputs.conf: requireClientCert = <bool> * Determines whether a client must present an SSL certificate to authenticate. * Full path to the root CA (Certificate Authority) certificate store. * The <path> must refer to a PEM format file containing one or more root CA certificates concatenated together. * Certificates with the same Common Name as the CA's certificate will fail this check. * Defaults to false for self-signed and third-party certificates. If using the default certificates, this attribute defaults to true and will override an existing false setting. sslCommonNameToCheck = <commonName1>, <commonName2>, ... * Check the common name of the client's certificate against this list of names. * If there is no match, assume that the Splunk instance is not authenticated against this server. * This setting is optional. * Defaults to no common name checking. * requireClientCert must be set to true for this setting to work. The fix may be as simple as adding this forwarder's common name to the list in sslCommonNameToCheck . ... View more

Thanks for the update! ... View more

EXTRACT and REPORT are search time objects, and need to be in place on the search head (not the forwarder). I'd also suggest setting KV_MODE = none to avoid potential conflicts. ... View more

The Symantec TA wants you to configure your inputs like this (according to the included inputs.conf.template): [monitor://<<path_to_temp_dump_file_directory>>/scm_admin.tmp] sourcetype = symantec:ep:admin:file [monitor://<<path_to_temp_dump_file_directory>>/agt_behavior.tmp] sourcetype = symantec:ep:behavior:file [monitor://<<path_to_temp_dump_file_directory>>/scm_agent_act.tmp] sourcetype = symantec:ep:agent:file [monitor://<<path_to_temp_dump_file_directory>>/scm_policy.tmp] sourcetype = symantec:ep:policy:file [monitor://<<path_to_temp_dump_file_directory>>/scm_system.tmp] sourcetype = symantec:ep:scm_system:file [monitor://<<path_to_temp_dump_file_directory>>/agt_packet.tmp] sourcetype = symantec:ep:packet:file [monitor://<<path_to_temp_dump_file_directory>>/agt_proactive.tmp] sourcetype = symantec:ep:proactive:file [monitor://<<path_to_temp_dump_file_directory>>/agt_risk.tmp] sourcetype = symantec:ep:risk:file [monitor://<<path_to_temp_dump_file_directory>>/agt_scan.tmp] sourcetype = symantec:ep:scan:file [monitor://<<path_to_temp_dump_file_directory>>/agt_security.tmp] sourcetype = symantec:ep:security:file [monitor://<<path_to_temp_dump_file_directory>>/agt_system.tmp] sourcetype = symantec:ep:agt_system:file [monitor://<<path_to_temp_dump_file_directory>>/agt_traffic.tmp] sourcetype = symantec:ep:traffic:file You said all the log files are in one location, but you didn't say all the different types were in the same file, so I think the above should still be feasible for you. ... View more

If the datamodel is accelerated, you can use summariesonly=t to only search the accelerated data: |tstats summariesonly=t count from datamodel=mydatamodel where (nodename=mydatamodel.logs) (mydatamodel.tag=prod) groupby "mydatamodel.transactionID" This should result in a faster search. ... View more

Can you include the details (name, search) of the jobs you noticed? ... View more

The temporal lookups in splunk assume that the timestamp is the earliest time that the lookup is valid (+/- the _offset_secs): max_offset_secs = <integer> * For temporal lookups, this is the maximum time (in seconds) that the event timestamp can be later than the lookup entry time for a match to occur. * Default is 2000000000 (no maximum, effectively). min_offset_secs = <integer> * For temporal lookups, this is the minimum time (in seconds) that the event timestamp can be later than the lookup entry timestamp for a match to occur. * Defaults to 0. Is it possible (based on the name of your field being Expiration ) that you expect the opposite to be true (that the lookup is before until the timefield, not after it)? ... View more

Where do you want that comment to go? ... View more

Looking at your use case, I wonder if you'd be better served doing something like: <base search> [| inputlookup triggers | eval search_fields="narrative=".alert_msg." OR alarm_type=".alert_msg | table search_fields | mvcombine search_fields | eval search=mvjoin(search_fields, " OR ") | table search] The last | table search isn't necessary, but by leaving it in the example it makes it easier for you to run as a standalone search to see what the subsearch returns. When a subsearch returns a field named search , that field's value is dropped directly into your search where the [] was. So this will result in a search like: <base search> narrative=A OR alarm_type=A OR narrative=B OR alarm_type=B ... View more

This seems like a prime case for summary indexing. Run this search every so often, save the results to a summary index, use the summary index on your dashboard. ... View more

I see I didn't really answer your question. I will revisit this in a few. ... View more

Do you see any results for just | rest /services/saved/searches ? And are you running the search on the splunk instance that has the alerts configured? ... View more

Add in a % on your valueSuffix line: <valueSuffix>%"</valueSuffix> And make sure your search uses | where $source$ ... View more

Universal Forwarders won't do the transforms the Palo Alto app requires. ... View more

| inputlookup <lookup name> WHERE <fieldname>=<value> Your | search version would probably work if you did | search <fieldname>=<value> , but it's better to include the filter in inputlookup itself. ... View more

Try this: | rest /services/saved/searches | search action.email.to="<email address>" | table title action.email.to ... View more

It looks like you're hoping the drilldown actions get performed sequentially, and I'm not sure that's how it works (I'm also not sure it's not how it works). Is there a reason you want to run your eval against a set token, when you could just run it against the value that token would be set to? <eval token="hetime">strftime("$earliest$", "%H:%M:%S")</eval> ... View more

Looking at this further on a run anywhere dashboard, you need to include config such as: <delimiter> OR </delimiter> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>source="</valuePrefix> <valueSuffix>"</valueSuffix> To fully craft your search to look like: (source="source1" OR source="source2") My entire input looks like this: <input type="checkbox" token="source" searchWhenChanged="true"> <label>Source</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>index=_* | stats count by source</query> <earliest>0</earliest> <latest></latest> </search> <choice value="*">ALL</choice> <delimiter> OR </delimiter> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>source="</valuePrefix> <valueSuffix>"</valueSuffix> </input> And in your search for the pane, your query would look like: <query>index=_* $source$ | stats count</query> Note it's not source=$source$ , as $source$ already addes the source= component to each selected option. ... View more