There are few events already indexed the sensitive info in Splunk SaaS cloud. how to mask those sensitive data in the events. or events delete option to restrict user not to view those events. Please advise. Splunk SaaS cloud. Example event:  {"@timestamp":"2023-05-14T15:32:07.449Z", "log.level": "Msg", "labels.message":"system Authenticate customer :dda9c1ad-2df1-ehetiokhnergiwre453644836-sgnreg346893 PAN1 123456789 request AuthVerificationRequest(authRequest=null, accountNumber=null, pan=123456789, pin=0987654321pcw/5, txnsubtypcde=Full_pan_Lookup)" , "ecs.version": "1.2.0","process.thread.name":"http-nio-8080-exec-150","log.logger":"com","labels.appId":"IVR-BEE","labels.appVersion":"1","labels.channelId":"ACIVR","labels.correlationId":"ujb6678879-2df1-4a32-83e5-4198dbcfe913","labels.flow-id":"AUTH-PIN","labels.interactionId":"5646540-8a2c-4893kr-58434","labels.tenantId":"lll","labels.url":"/digital-auth/engineering/authenticateuser/v1/auth"} ... View more

I want to ignore few keyword contained events at forwarder level NOT at indexer.  Below are the sample log: to Ignore if it finds "INFO OR WARN" messages in log file. what it would be the file name & config  in UF to tell UF to ignore those events. Please let me know the settings in UF level to ignore. Ignore Contained "INFO/WARN" 2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 INFO STEPDEFINITIONS 2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 WARN STEPDEFINITIONS Index only Error:- 2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 ERROR STEPDEFINITIONS ... View more

I need to set GMT +1 timezone for the logs. Please let me know what would be the value set in TZ=? in props.conf. ... View more

I have 20+ data sources  in a server and each data source is over 500MB so splunk is not indexing all the data sources. Please advise what config that i should add to parse all the 20+ data sources in a server. [monitor:///var/opt/*/logs/*/mlogging/*/*/*/*/ProxyLog/Proxy.log] sourcetype = middlewarelog index = prd initCrcLength = 512 ignoreOlderThan = 7d _TCP_ROUTING=if disabled = false The above input is not parsing all the data sources, it just parsing only one data source and skipping all others in the server. Thanks. ... View more

For an index the job are getting queued when ever the users runs the searchs. Please let me where to increase/tweak the quota.     ... View more

We need to use HTML tags in alert email body, right now whatever the tag we pass, they are considered as text and displayed in the email as it is. As per below suggested solution we need to update sendemail.py file in splunk server. https://community.splunk.com/t5/Alerting/How-to-add-HTML-markups-to-alert-email/m-p/524453 Is there any other way to achieve this? Need help on this. ... View more

We re-routed data from Splunk SaaS cloud to On-perm but we see event mismatch between these two instances, if I route the date to Splunk cloud all the sudden the event count increases but when I re-route the same data source to on-perm drastically the event count comes down for the same time period but don't see any error in the FW.  Fw-->Splunk SaaS more count. Fw-->Splunk On-Perm less count.  Please find the screenshot and let me know what would be the issue and troubleshoot to fix this count mismatch. Thanks.    ... View more

how to create a props.conf for the below data..Need to break the line from ### endwith    ######################################## 20220815.011001: ========================= 20220815.011001: Cron dummy started by dummy1. 20220815.011001: ========================= 20220815.011002: 20220815.011001: Checking processes on Prod SEATTLE server seat1 20220815.011001: 3 critical processes run on seat1 20220815.011001: 1 non-critical processes run on seat1 20220815.011001: 208 processes are now running on seat1 20220815.011001: 10 processes owned by dummy1 20220815.011001: SEATTLE Authentication_Process is running (581). 20220815.011001: SEATTLE is running (1709). 20220815.011001: PS Pmeter_Server is running (1886). 20220815.011002: PS Pmeter_Server is running (2000). 20220815.011002: All critical processes are running. 20220815.011002: ========================= 20220815.011002: dummy complete. 20220815.011002: ========================= 20220815.011501: ... View more

Actual log:- [{area: "CU", subid: "M", slgdattim: "2022022109515500", slgproc: "1362100032D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "jhuytvfghju789", slguser: "r4uhjk8", slgtc: "SE38", dummy3: "Z0097TORRENT_INBOUND", term_ipv6: "167.211.0.9", sal_data: "Jump to BAP Debugger by user C7C2QC(200): SourceLine:233->228, ByteCode(offset):MOVL(433)->mvqk(423) (Prgm:Z0097TORRENT_INBOUND, Meth:READ_DATA, Incl:Z0097TORRENT_INBOUND_M01, Line:228)"}, {area: "CU", subid: "M", slgdattim: "2022022111111200", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "PS2WVV212651CF", slguser: "C6W7RZ", slgtc: "VKM1",dummy2: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:48->63, ByteCode(offset):cmpr(2588)->cmpr(2603) (Prgm:PDB, Form:USER_EXIT_FUELLEN, Incl:ffujlkk_ADD_FIELDS, Line:63)"}, {area: "CU", subid: "M", slgdattim: "2022022111122600", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "PS2WVV212651CF", slguser: "C6W7RZ", slgtc: "VKM1", dummy1: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:63->77, ByteCode(offset):cmpr(2603)->cmpr(2650) (Prgm:APDB, Form:USER_EXIT_FUELLEN, Incl:hgguytol_ADD_FIELDS, Line:77)"}] I want the above log break into three events like below & pls let me now the props.conf Event1:- [{area: "CU", subid: "M", slgdattim: "2022022109515500", slgproc: "1362100032D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "jhuytvfghju789", slguser: "r4uhjk8", slgtc: "SE38", dummy3: "Z0097TORRENT_INBOUND", term_ipv6: "167.211.0.9", sal_data: "Jump to BAP Debugger by user C7C2QC(200): SourceLine:233->228, ByteCode(offset):MOVL(433)->mvqk(423) (Prgm:Z0097TORRENT_INBOUND, Meth:READ_DATA, Incl:Z0097TORRENT_INBOUND_M01, Line:228)"}, {area: "CU", subid: "M", slgdattim: "2022022111111200", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "PS2WVV212651CF", slguser: "C6W7RZ", slgtc: "VKM1",dummy2: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:48->63, ByteCode(offset):cmpr(2588)->cmpr(2603) (Prgm:PDB, Form:USER_EXIT_FUELLEN, Incl:ffujlkk_ADD_FIELDS, Line:63)"}, {area: "CU", subid: "M", slgdattim: "2022022111122600", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "jhuytvfghju789", slguser: "C6W7RZ", slgtc: "VKM1", dummy1: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:63->77, ByteCode(offset):cmpr(2603)->cmpr(2650) (Prgm:APDB, Form:USER_EXIT_FUELLEN, Incl:hgguytol_ADD_FIELDS, Line:77)"}] ... View more

I have put few IP's in the filter and have created filed for those IP's but when they die in the statistics not returning as zero rather its showing nothing, its showing only the IP's that has count. Please advise. Please find the below search and attached screenshot. It shows only the filed has value. Not showing as zero event count the fields does not have events. index=blu cs_host="collector*.abc.com" c_ip=10.xx.xx.233 OR c_ip=10.xx.xx.234 OR c_ip=10.xx.xx.248 OR c_ip=10.xx.xx.250 OR c_ip=10.xx.xx.42 OR c_ip=10.xx.xx.43 |stats count by c_ip|fillnull ... View more

I have forwarder not forwarding any input data other than _internal. Checks performed: splunk version - 6.4.2 Forwarder is up and running. Checked the $SPLUNK_HOME/etc/system/local/inputs.conf . -- Checked the host name Checked the $SPLUNK_HOME/etc/system/local/deploymentclient.conf Checked the $SPLUNK_HOME/etc/system/local/server.conf I don't see any error/warning in splunkd.log. File path for the log files. I have restarted the forwarder several times but no luck. The inputs in the /etc/app are not forwarding. Please advise. ... View more

I have built a props.conf but when I upload the log file manually it works fine but when the app writes the log the line break is not working. Please advise how to make this props.conf working when the app writes log file. Complete Log file:- INFO:SESSION TOKEN = A5BD11D7B2BB200B5FB893C120333044:2018-08-28 15:12:03,991 INFO:REQUEST:2018-08-28 15:12:08,456 INFO: version="1.0" encoding="UTF-8"?> <web:CreateRecord> <web:sessionToken>A5BD11D7B2BB200B5FB8C120333044</web:sessionToken> <web:moduleId>433</web:moduleId> <web:fieldValues><Record><Field id=&quot;17471&quot; value=&quot;sri_id&quot;/><Field id=&quot;16109&quot; value=&quot;result.count=1&amp;#x3C;br /&amp;#x3E;result.index=amt&amp;#x3C;br /&amp;#x3E;result.sourcetype=AMT-n-AGA-SystemErr&quot;/><Field id=&quot;16108&quot; value=&quot;##This is test Alert## - Testing the Line breaking rule&quot;/><Field id=&quot;17343&quot; value=&quot;15:12:03&quot;/><Field id=&quot;25310&quot; value=&quot;85040&quot;/><Field id=&quot;17339&quot; value=&quot;15:12:03&quot;/></Record></web:fieldValues> </web:CreateRecord> Line Break from this line(INFO:SESSION TOKEN = A5BD11D7B2BB200B5FB893C120333044:2018-08-28 15:12:03,991) Props.conf [wsa] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(\w+\:\w+\s\w+\s\=\s\w+\:\d+\-\d+\-\d+\s\d+\:\d+\:\d+\,\d+) NO_BINARY_CHECK = true TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TIME_PREFIX = (?i)info\:session[^=]+\=[^:]+\: pulldown_type = true disabled = false MAX_TIMESTAMP_LOOKAHEAD = 30 ... View more

I have a props.comf that is not working for TIME_FORMAT and TIME_PREFIX for the below log structure. Trying to break the LINE_BREAK from the first line. Please help. Error when i try to upload the log: ( "Could not use strptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime) Log:- INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 INFO:REQUEST:2018-08-27 14:28:15,000 INFO: Props.conf [ wsa:splunkalert:log ] CHARSET=UTF-8 LINE_BREAKER=([\r\n]+)(\w+:\w+\s\w+\s=\s\w+:\d+-\d+-\d+\s\d+:\d+:\d+\,\d+) MAX_TIMESTAMP_LOOKAHEAD=30 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_FORMAT= %H-%m-%d %H:%M:%S,3N TIME_PREFIX=\s disabled=false pulldown_type=true ... View more

Have been getting "Could not use srptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime. Please advice. Log:- INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 INFO:REQUEST:2018-08-27 14:28:15,000 INFO: <web:CreateRecord> Props.conf [ wsa:splunkalert:log ] CHARSET=UTF-8 LINE_BREAKER=([\r\n]+)(\w+\:\w+\s\w+\s\=\s\w+\:\d+\-\d+\-\d+\s\d+\:\d+\:\d+\,\d+) MAX_TIMESTAMP_LOOKAHEAD=30 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_FORMAT= %H-%m-%d %H:%M:%S,3N TIME_PREFIX=\s disabled=false pulldown_type=true ... View more