The error indicates that the port 8089 is already used by another process. Pls check that and you can use any other port OR use 8089 if no process is running on that [ its possible, a previous or orphoned process can still use that port. So, check and kill as needed] ... View more

To access sys.fn_get_audit_file you need, at least, CONTROL SERVER role ... View more

Something like - | inputlookup <lookupA> | join type=left <common field name> [ | inputlookup <lookupB> ] | join type=left <common field name> [ | inputlookup <lookupC> ] ... View more

In the latter case, what do you think it should say instead? ... View more

@abdullahalhabbash Please use the below link which can help you better: https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Applytimezoneoffsetstotimestamps ... View more

@abdullahalhabbash -- To be honest there is not enough information in your Post to provide insight to the issue that you are experiencing. There could be a couple of different types of Causes to this issue and without further details in regards to Errors being seen or steps that have been taken in an attempt to resolve this OS Level issue. Now with that being said, while working with a Co-Worker on this very issue we were able to identify a cause and wanted to provide the potential Solution for the issue that you have experienced: 1) While attempting to run: $SPLUNK_HOME/bin/splunk enable boot-start -user splunk The following Error is produced service splunk does not support chkconfig 2) In an attempt to troubleshoot this issue at the OS Level we reviewed the following: A) Completed an Strace Against the following Splunk Command to see what the command was actually doing: strace $SPLUNK_HOME/bin/splunk enable boot-start -user splunk From the Output of the Strace completed it was noticed that one of the C Library Calls that Splunk makes to complete the "Enable Boot-Start" Process appeared to be using an Older Library Call. As such this caused us to run the following command set on the PhotonOS Instance: tdnf update -y During this Update process the following System Process was updated: SystemCTL (systemD) and this was updated to Version 228. Once this Package update was completed we were then able to re-issue the following Command Set without any issues: $SPLUNK_HOME/bin/splunk enable boot-start -user splunk This completed as expected and as such the issue that was being experienced was directly due to the version of SystemCTL (systemD) that was in use. It appears that this Instance might be using a "Non-Mainstream" branch of the systemD Libraries and as such this could potentially cause all sorts of different issues around Permissions at the OS Level. This issue is not a Splunk Product issue but the OS itself. The OS appears to be using a set of Linux OS Libraries that is not considered "Mainstream" and as such Your Millage May Vary with this Minimal Linux Installation Distro produced by VMWare. Hopefully this information helps others that experience an issue when attempting to Enable Boot-Start for Splunk Forwarder running inside of the PhotonOS. ... View more

Pls look at the drill-down from the 'Incident Review Audit' dashboard under 'Audit' navigation menu. So, you can setup a token for your rule_name and pass that back using incident_review?form.source.... pls check that. basically, you need to pass the rule_name to form.source... https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/DrilldownLinkToDashboard ... View more

Rather than a dashboard, perhaps you just need a report scheduled to run at 6am each day. If you really want a dashboard, don't use in-line searches. That is why the dashboard updates automatically. Instead, create a scheduled search that runs each day at 6am. Your dashboard would then use the loadjob or savedsearch command to load the most recent results of the scheduled search. ... View more

Ok, is I can do that by use the search. Thank you ... View more

if this is in a dashboard you should be able to use the charting.seriesColor option for your chart in the simple xml https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference For example: <option name="charting.seriesColors">[0x6a5c9e, 0x31a35f]</option> ... View more

Thank you for your reply. Ok, after created user, how I give him permission for access the audit logs from SQL window server? Regards. ... View more

@renjith.nair Thank you for your reply, I will do that. If appear the message another time I will tell you ... View more

Thanks Mr; can I monitor this file which exist in url by script curl? ... View more

abdullahalhabbash, [EDIT: I realized that I was coming off inappropriately negative, so I reworded to make it more fair] The Splunk Add-on for Tenable should do what you need. NOTES: Your concern about it having a public address and your own Splunk server having a private address is of no concern. Think of it like your PC/Mac having a private address, yet you can still go to Google or Amazon. There are instructions for setting up the connection here, but you may need to read through this answer about getting data from tenable.io, too. While this app really should work OK, it is under development right now. There have been some issues in the past that are mostly resolved, but if you get it sort of working but it's flaky or failure prone, make sure you are on the latest version and if the problem still persists open a ticket with Splunk. They can often help get it working, as long as you've done due diligence with your configs and things. I hope this helps! Happy Splunking! -Rich ... View more

You can set alert mode as "once per result" ... View more