Taking a chance on answering an old question here since I got stuck with the same issue.....  It now worked fine on my Universal forwarder. You just need to add this line to wmi.conf: namespace = root\wmi I also noticed that when doing the splunk cmd test query you need to pay attention to the case of -namespace  -Namespace triggers an error while -namespace works fine. ... View more

If you want to have the deleted data reappear for searching without actually re-indexing the data, you can do the following: Stop Splunk In the folder for the index, find the buckets by UTC timestamp where you want to recover the deleted data. Within the bucket's rawdata folder you will find a folder called deletes containing one or more csv.gz files. Remove the deletes folder.  Start Splunk A side effect of this is that ALL deleted data will then reappear - not just your sourcetype=db_demo. Since you now have access to all the data that was present in the index, you can use any other export / re-index methods on the data. By exporting _raw records to a CSV file you can also use monitor / file upload again if you need to test your indexing process.  I recommend making a copy of your original index demo to work on rather than working on the original. If something during this process fails you can always return to start.  Also - do this in a lab before working on the real dataset. I am not sure if this causes any issues around the tsidx files or the .bucketmanifest, but this worked for me when I needed to restore some "lost" data. Regards, H. ... View more

Looking through all the comments, it is obvious that some don't understand there may be other objectives of moving events from one index to another than creating a plain summary. There are two objectives that I clearly see here - and there could be more: You want to create a summary of events so it is easier to search through a subset of data (hence summary index) You want to preserve certain _raw events as is before freezing / deleting old buckets (example configuration audit changes) I have mainly looked into the last item on this list - preserving configuration audit logs for a Cisco ASA beyond the freeze/delete point of 1 year I have set on my index of the original events. The collect command will just ourput the _raw record to the stash file, it is then useful to get the timestamps correctly added to each.  I used this search: host=1.2.3.4 message_id=111008 | eval eventtime=strftime(_time,"%Y-%m-%dT%H:%M:%S") | eval _raw=eventtime + ": " + _raw | collect index=config_change You may add host= and sourcetype= to the collect command to preserve it, but it will then be counted in  your license.  Regards H. ... View more

This is an old thread, but maybe someone gets some help from this.... It looks like you can't search in the _raw record of the data, however it is possible to filter on host or some of the other fields created at index time.  If you look in a non-filtered CSV you will see the syntax for host. The filter for export_search would then be 'host::<hostname>' Note that exporttool is unsupported, so a better alternative may be ./splunk export which may filter on other terms. ... View more

Ended up with the same challenge as listed here and none of the suggested replies on this article helped in any way.  Here is my solution:  <my search> | rex field=New_Time mode=sed "s/[^ -~]//g"  | rex field=Previous_Time mode=sed "s/[^ -~]//g" | eval time_drift = (strptime(New_Time, "%Y-%m-%dT%H:%M:%S.%9QZ") - strptime(Previous_Time,"%Y-%m-%dT%H:%M:%S.%9QZ")) | table _time New_Time time_drift Problem: The field with the Windows timestamps includes non-printable character - I thinks it's a x80, but it doesn't really matter.  I use the rex mode=sed to remove anything that is not in the printable range. [^ -~] matches all non-printable character, and mode=sed will just remove them from the string. After this replacement, the strptime() function works correctly.    ... View more

Taking a chance on replying to this old thread.... there are probably a lot of you out there with the same issue. I am running the free license for learning and lab purposes at home feeding it whatever that could be interesting.  After numerous times getting this hit by free license violation due to some system decided to send a lot of data to Splunk after a reconfiguration or change in traffic pattern, I have learned how to rebuild it.  Email forwarding and alerts are not available with the free license, we have to connect every day and check messages for any license violations. Since this was not too practical I decided to write a script using the CLI and sendmail. This is now added to crontab running each day shortly after midnight.  It will send me an email with the last 4 days of license usage like below: time usage ---------- ----- 2020-06-11 41.02 2020-06-10 32.18 2020-06-09 20.99 2020-06-08 16.44 Here is my script: #!/bin/bash # Email last days of Splunk license usage - file: license-check.sh # Emails settings # From is optional - will use hostname if not specified FROM=my_from_address@example.com TO=your_email_address@example.com BODY_FILE=/root/mail.txt # run splunk search /opt/splunk/bin/splunk search 'index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-3d@d | eval usage=round(100*b/poolsz,2) | eval time=strftime(_time, "%F") | table time usage ' > $BODY_FILE # send the report with sendmail (cat - $BODY_FILE)<<HEADERS_END | /usr/sbin/sendmail -i $TO Subject: Splunk License usage To: $TO From: $FROM HEADERS_END Add the file to crontab: 10 0 * * * /root/license-check.sh Modify your postfix install to use a relay host /etc/postfix/main.cf ... and that's all.  Although not the best practice to run under root, but it works.... ... View more

We have the ASAs sending to TCP port x and routers/switches sending to udp port y. This was done since the ASA is more chatty with number of messages and we ended up loosing some events. Make sure you add this line to the ASA if using TCP : logging permit-hostdown This will allow the ASA to continue passing traffic despite that the Splunk receiver is down. By using different ports, you don't have to rely on the props and transforms to detect the sourcetype, and you can put data into the index of your choice right away. We use different index' for network and ASA data due to different retention requirements. I don't see the reason why you need to blend them into one app. ... View more

You need the Cisco Security Suite app to support the Cisco ASA. https://splunkbase.splunk.com/app/525 (Sorry I posted my answer in the wrong place) ... View more

You need the Cisco Security Suite app to support the Cisco ASA. Since this is an "umbrella" type app, you will also get support for WSA, ESA, ISE, IPS and sourcefire. You have to install all the Add-ons required for those too. See https://splunkbase.splunk.com/app/525 ... View more