Hi tamduong16, Refer this you will get some idea.. trylog.php : <?php $data = '{"received":"2018-02-01 19:58:36","ipaddress":"127.0.01","response_text":"To know more about this rest api"}'; $usr = "admin"; $psw = "password"; $username = '$_REQUEST[username]'; $password = '$_REQUEST[password]'; //$usr == $username && $psw == $password //print_r($_REQUEST); session_start(); if ($_SESSION['login']==true || ($_REQUEST['username']=="admin" && $_REQUEST['password']=="password")) { print $data; $_SESSION['login']=true; }else { echo "incorrect login"; } ?> Rest-api-modular-input configuration : Endpoint URL * : http://localhost/trylog.php URL Arguments : username=admin,password=password Polling Interval : 10 ... View more

Can you share sample API output data and configuration details. ... View more

So, in this case for proper output you can create three drop-down input .. 1)index=active_directory | dedup username | table username 2) index=active_directory username=$username$ | table user_id 3)index=active_directory |username=$username$ | table email_address ... View more

Hi MikeElliott, You can depend other three panels of dashboard on the "AD_User_Search" panel. Or Create drop-down of user_id and email_address from "AD_User_Search". ... View more

Hi, There is issue with your peer URl : Try this : with https https://10.90.20.237:8089 Also make sure you are putting correct user name and password of indexer. ... View more

Modifications to xml of dashboard is also very easy. ... View more

refer this, you will get some idea. http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Findingandremovingoutliers ... View more

Hi randy_moore, You can try this. earliest=-30m <Base search> | where [search earliest=-5m <Base search> | where Fraud_Flag == "TRUE" | return 10000 Site] | table Date Time Site Amount Fraud_Flag ... View more

Hi, Try This run search anywhere | makeresults | eval data="Field1|Value1|Field2|Value2|" | rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|" or base search | rex field=data "Field1\|(?<Field1>\w+)\|Field2\|(?<Field2>\w+)\|" ... View more

Hi zealvora, Your are not seeing that record could be because of records are merging. Are you using props.conf for this if not then you can try this. props.conf: [your sourcetype] BREAK_ONLY_BEFORE_DATE = true ... View more

Hi k_harini, Can you share sample data. ... View more

Hi atulitm, You can try transaction command here index= "neighbor" | transaction startswith="neighbor is up" endswith="neighbor is down" | eval duration = (duration/60) | where duration > 14400 | table host _time ... View more

Hi MoermansM, You are not getting output because the ip you are getting from firewall is without subnet and your csv contain ip with subnet so can not map the column. So in this case the alternative solution for this is to add one more column to your iprange.csv as below: if you are doing this modification then there is no need of transforms.conf. src, clientip, zone, areacode 127.0.0.1, 127.0.0.1/24, home, 255 then try this .. sourcetype=firewall area=* | dedup src | lookup iprange.csv src OUTPUT src clientip zone area |table src, clientip, zone, area ... View more

Hi neiljpeterson, Can you share sample output data. if your sample data or query output something like as below then you can refer below query. Sample Data : source,count /opt/splunk/var/log/splunk/splunkd.log,7 Query: earliest=-5m index="_internal" source="/opt/splunk/var/log/splunk/splunkd.log" | stats count as "Current_Count" by source | eval Last_alert_count = [search earliest=-10m latest=-5m index="_internal" source="/opt/splunk/var/log/splunk/splunkd.log" | stats count by source | return $count] | where Current_Count > Last_alert_count also if your first column (x axis) has multiple values and same then you can try this. earliest=-5m index="_internal" | stats count as "Current_Count" by source | join source [search earliest=-10m latest=-5m index="_internal" | stats count as last_count by source] | where Current_Count > last_count ... View more

Hi bcyates, Are you looking for something like. CommittedBytes(MB) = CommittedBytes/1000000 = 1610014720/1000000 = 1610.01472 MB ... View more

Hi ramkilku, You can use ''Splunk Add-on for Microsoft IIS". Refer below link link text ... View more

Did you confirm your ldap user 'splunktest' credentials are working properly by logging to your domain machine as domain user. ... View more

Can you share sample data. Also try this.. index=A number=RU status=SUBMITTED | dedup x_requestid| table x_requestid | join x_requestid [search index=A status=INELIGIBLE | rename request_id as x_requestid | dedup x_requestid | table x_requestid] Or index=A status=INELIGIBLE | rename request_id as x_requestid | dedup x_requestid | table x_requestid | join x_requestid [search index=A number=RU status=SUBMITTED | dedup x_requestid| table x_requestid] ... View more

Hi dkeck, Are you getting that error message while configuring LDAP for your splunk environment. And you have already tested that your generic user credential are working fine by logging as domain user. if this is the case then: Make sure you have all the correct details required for this configuration. You can get this by contacting your AD administrator. Host: AD server IP/Hostname OR Load balancer URL. Bind DN: distinguishedName of that Generic ID/user. in your case i think your user is "splunktest". Bind DN Password: Confirm Password: User Base DN: This is nothing but distinguishedName of container under which all domain users are listed. Group Base DN: This is nothing but distinguishedName of container under which all your groups are listed. Share your configuration details if you don't mind. ... View more

Hi maxmillianr, Check if this is working for you. Make sure you have all the correct details required for this configuration. You can get this by contacting your AD administrator. Host: Bind DN: distinguishedName of that Generic ID/user. in your case i think your user is "splunktest". Bind DN Password: Confirm Password: User Base DN: This is nothing but distinguishedName of container under which all domain users are listed. Group Base DN: This is nothing but distinguishedName of container under which all your groups are listed. LDAP Strategy Name: Splunk LDAP Host: AD server IP/Hostname OR Load balancer URL. Port: 389 Bind DN: cn=splunktest,cn=users,dc=domain,dc=local Bind DN Password: password Confirm Password: password User Base DN: dc=domain,dc=local User Base Filter: User Name Attribute: samaccountname Real Name Attribute: displayname Email Attribute: mail Group Mapping Attribute: dn Group Base DN: cn=Splunk Admins,ou=splunk,ou=apps,dc=domain,dc=local Static Group Search Filter: Group Name Attribute: cn Static Member Attribute: member Advanced Settings Search Request Size Limit: 1000 Search Request Time Limit: 15 Network Socket Timeout : 20 ... View more

Hi CCTSplunkster, You do not need to do any configure changes for accessing Splunk web through LAN IP instead of local IP. You have to just make sure Splunk is properly installed on your machine then you can access it with your LAN IP easily. ... View more

Above search represent Left join so as per your requirement you can manipulate your search or change join type=[Left|outer] for more information refer splunk join command doc. ... View more

Hi, Try this. index=A number=RU status=SUBMITTED | table x_requestid | join x_requestid [search index=A status=INELIGIBLE | rename request_id as x_requestid | table x_requestid] ... View more

| makeresults | eval created_at="2017-10-06 12:31:30",Ticket_no="101" | append [| makeresults | eval created_at="2018-03-06 11:31:30",Ticket_no="102"] | eval epoch = strptime(created_at,"%Y-%m-%d %H:%M:%S") | eval diff = (now() - epoch)/60 | where diff < 131400 | stats count(Ticket_no) as Ticket_count run above anywhere search you will get some idea. Or you can test your search by changing < or > operator of where clause also make sure time-format in the strptime() is proper. ... View more