Hello! Trying to collect Google Workspace Alert Center events using this app https://splunkbase.splunk.com/app/5556   Input for the alert center successfully connects to the API but it is a very strange significant delay (few hours) between alert entry in Google and its ingestion to the our Splunkcloud. From what I can see in app logs - app works correctly and successfully querying API each 300 seconds. Now I've enabled debug logging, maybe it will help to understand what goes wrong. Any ideas on troubleshooting are appreciated. Second question, there is an ADDON-61892 issue (GWS Alert Center: 'Gmail Phishing' source inputs not working as expected) mentioned in the release notes. Is it possible to get more information on this issue or Splunk issue tracker is private? ... View more

Hi! I'm using Splunk cloud. Trying to create alert to catch event when someone disabling alert. Need advice on the search for this alert, since has no luck with digging into `index=_* disbled_alert_name` ... View more

Hello! I'm using the full-feature AWS Organization. It allows to create an aggregator that contains Config data from all accounts and regions in the organization. Is it possible to get this data into Splunk using Splunk Ann-on for AWS? I can't find a good option for it. Of course, I can create a bucket with all the config data from all accounts, but it requires a lot of effort and seems unreasonable. Maybe it is possible to create an input which utilize  get-aggregate-resource-config  method? It looks much easier to query a single API endpoint than set up data collection from different sources to one place. BTW, it can be a good substitution to Describe with Assume Role inputs.   ... View more

Hi everyone, I am new to Splunk and still learning. Can someone please help me on the below query? My log file: 2020-03-30 12:21:45,075 INFO com.www.yyy.MyClass[ - ] - screen changing to [Select] 2020-03-30 12:25:31,574 DEBUG com.www.yyy.Manager[ - ] - Service- checking 2020-03-30 12:25:31,574 DEBUG com.www.yyy.Manager[ - ] - Service- found 2020-03-30 12:25:31,663 DEBUG com.www.yyy.Manager[ - ] - All Service took 89 milliseconds my requirement: I want to get the screen name and service took time. in the above example I need like this: "Select" screen services took 89 milliseconds Please help me to get the query. I would really appreciate it! Thank you! ... View more

We are using splunk enterprise in our organization. Is it possible to view the alerts created by another user? I went to Reports and Dashboards -> Alerts Clicked on All. Searched for the other user's name in the searchbox but no results come up. Thanks for reading. ... View more

Does Splunk provide measures protecting against / detecting the tampering of the Splunk logs/data? The only thing I could find are the hash values for integrity: https://docs.splunk.com/Documentation/Splunk/8.0.1/Security/Dataintegritycontrol For example, a malicious administrator could add, change, remove or reorder events afterwards. I search for techniques related to tamper-evident logging like forward integrity (by key evolution), hash chains, Merkle tree and linking hash values to public media (blockchain, ...). ... View more

I need to eval time in hours between now and earliest time from timepicker to use it in search. e.g. if timepicker set to “last 24 hours” - evaluated time should be 24h, for “last 2 days” - 48h, etc. Thank you! ... View more

So, I have been using Splunk out of the box for a while, but now I would like to do some data massaging before I push the logs to the Splunk server. Let's say I have a string "12345678" in the log /var/log/apache.log, is it possible to replace it with "CCNUM" while forwarding itself? In other words, can the string manipulation be done on the Apache web server itself and not on the indexer/splunk server? Thanks ... View more

On an end node, how do I rotate introspection.log? I see splunk can do it for its own logs like stdout and stderr via https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Serverconf#Log_rotation_of_splunkd_stderr.log_.26_splunkd_stdout.log Is there a way to do the same for introspection logs too? ... View more

Use stats results columns of table formatted as progress bar similarly as in Monitor console I am trying to create my own dashboard where I am getting results as a table and one of the columns is in the format: "number / number", example: 2021.78 / 3991.24. Is it possible to have it formatted in table results with a progress bar to see visually how much disk space is left? I saw these progress bars in Splunk monitoring console, but was unable to find out how to do it in my own dashboards. See picture attached and column: (Volume Usage (GB)) ... View more

Suppose my log indexed in splunk looks like: 1 ... 50 abracadabra ... Now, I do a search for abracadabra. splunk will show me 1 event i.e. line number 50. How I see the lines before and after line 50 to get more context. Can I 'jump' to line 50 like we can jump to any line in vim. Thank you. ... View more