if you don't have ip filed in raw data and want use rex to take out IP address , plus want know how much data coming from that ip for a day. index=<YourIDXname>earliest=-1d@d sourcetype =<"if any"> |rex "^[^\t\n]*\t(?P<srcip>[^\t]+)" | eval size=len(_raw) | stats sum(size) as bytes by srcip | eval KB=round(bytes/1024,2) |lookup iptest.csv local=true ManagementIP as srcip OUTPUT SiteIdentifier HostName DeviceManufactorer DeviceType | search HostName=* | dedup srcip | table SiteIdentifier HostName DeviceManufactorer DeviceType srcip KB | rename srcip as "Matched IPAddress" |sort by SiteIdentifier DeviceManufactorer ... View more

i need to do same thing like DavidHourani asked and thank to  lguinn2   index=cg| rex "^\S+\s+(?<cgSYSlogIPAddress>\S+)" | stats count by cgSYSlogIPAddress | eval active_host="T" | append [ inputlookup cgIP | eval active_host="F" ] | dedup cgSYSlogIPAddress |where active_host="F" ... View more

in clustering setup can we have mix between old and new version? We are planning to upgrade from 7.0.1 to 7.3.1 but we have search and index cluster . Can we just upgrade just index master ? how about search head cluster? ... View more

I had this problem n fix it . looks like you already doing it right but my mistake was type ..\ , should ...\ (3 dots) [monitor://C:\inetpub\logs\LogFiles...*.log] ... View more

i am in a same boat , getting same error for access_300day.log and i have lots of space. splunk running in a Linux box and i am try to upload the file from my laptop , is any port needs to be open ? ... View more

is that mean , if indexer have the UI enable, i not able to setup ldap? caz i notice problem ldap setup in indexer ui Access controls » Authentication method » LDAP strategies - ldap strategy but i cant Map groups under Actions in Searchhead/Deployment server all working but not in indexer ui. ... View more

thanks yes i was looking for that value , my college help me , i did a install splunk uf in a box so from PowerShell we can run this get-wmiobject Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize | findstr Universal or regedit , search Splunk or Universal under productlcon the value c:\Windows\Installer{xxxx}\WixSplunklcon ... View more

This steps worked on version 7.0.2 , i am new to Splunk and implementing in AWS , excellent help ' The problem bucket will stand out like a sore thumb ' ... View more