For who search for time-picker options using stylesheet didnt work after upgrade to version 7.x. Here is the updated stylesheet (.css) to restrict time-picker selections . Edit as needed to hide time-picker options selectively.. Tested and working in Splunk version in 7.1.2 ! /* ------------------------------------------------- */ /* Hides or display specific portions of the */ /* Datetimepicker accordion */ /* ------------------------------------------------- */ /* OPTIONS div[data-test-panel-id^='presets'] div[data-test-panel-id^='relative'] div[data-test-panel-id^='realTime'] div[data-test-panel-id^='date'] div[data-test-panel-id^='dateTime'] div[data-test-panel-id^='advanced'] */ /*Hide advanced, realtime, real, and few presets - tested in splunk v7.1.2*/ button[data-test^='Business week to date'], button[data-test^='Week to date'], button[data-test^='Year to date'], button[data-test^='Previous week'], button[data-test^='Previous business week'], button[data-test^='Previous month'], button[data-test^='Previous year'], button[data-test^='Last 15 minutes'], button[data-test^='Last 60 minutes'], div[data-test^='real-time-column'], div[data-test^='past'], div[data-test^='other-column'], div[data-test-panel-id^='advanced'], div[data-test-panel-id^='relative'], div[data-test-panel-id^='real'] { display: none !important; } ... View more

Copy your required packages/files from /usr/local/lib/python2.7/dist-packages to /opt/splunk/lib/python2.7/site-packages/ ... View more

you can remove the "OTHER" from the results with "useother=f", e,g. | timechart span=1d sum(field_1) AS sum_field_1 by field_2 useother=f fixedrange=false ... View more

I couldn't attach image here, I posted a sample from the doc. since the log collection is from different sources its routed to different index - explanation is same since its different type of logs ... View more

the doc has the specifications like package name, inputs, etc ... View more

Utilized Indexes • oswin • oswinsec • oswinscripts • epav (SecKitBase) • epintel (SecKitBase) • netipam (SecKitBase) The additional indexes are for the collection of variuos other logs sources - read through the sec 3 ( Index Guidance) for the details. there are several TA for log collections would use the above mentioned indexes Splunk_TA_windows SA-ModularInput-PowerShell Splunk_TA_windows_SecKit_0_all_inputs Splunk_TA_windows_SecKit_1_all_inputs Splunk_TA_windows_SecKit_2_dhcp_inputs Splunk_TA_windows_SecKit_2_dcadmon_inputs Splunk_TA_windows_SecKit_2_dcadmonsync_inputs ... View more

yoursearch| eval CST_time=_time-21600| convert ctime(CST_time)|table CST_time , _time yoursearch| eval CST_time=now()-21600| convert ctime(CST_time)|table CST_time , _time Central Standard Time (CST) is 6 hours behind Coordinated Universal Time (UTC). where your _time is UTC ... View more

When two or more data inputs are configured for the same product (e.g. non_audit , firewall , vpn , smartdefense ) and follow similar naming convention (e.g input/9, input/19, etc), there is a possibility of race condition as all these inputs refer to the same checkpoint file. You will see the following warning message: Unable to get a lock or parse the checkpoint file . Will retry on next run. Your error will be logged in splunk_ta_checkpoint-opseclea_modinput.log and Splunk software will stop indexing data for that particular data input. Hope this helps to helps ... View more

These are already indexed and you cannot modify - if you have the log backup then you may go ahead to delete (yoursearch sourcetype=syslog | delete) the previously indexed data and ingest the log with new source type ... View more

Access the Edit Tenant Setup - System task and ensure that the Enable User Activity Logging checkbox is selected. - You can able to search for user activity Access the Edit Tenant Setup - Security task and ensure that the OAuth 2.0 Clients Enabled checkbox is selected. ... View more

assuming you are running latest splunk version with splunk admin permissions still your dashboard-2 hang ? limits.conf # This section contains settings for search concurrency limits. base_max_searches = <int> * A constant to add to the maximum number of searches, computed as a multiplier of the CPUs. * Default: 6 max_rt_search_multiplier = <decimal number> * A number by which the maximum number of historical searches is multiplied to determine the maximum number of concurrent real-time searches. * Note: The maximum number of real-time searches is computed as: max_rt_searches = max_rt_search_multiplier x max_hist_searches * Default: 1 max_searches_per_cpu = <int> * The maximum number of concurrent historical searches for each CPU. The system-wide limit of historical searches is computed as: max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches * NOTE: The maximum number of real-time searches is computed as: max_rt_searches = max_rt_search_multiplier x max_hist_searches * Default: 1 max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches = (1* 28) + 6 = 28 + 6 = 34 max_rt_searches = max_rt_search_multiplier x max_hist_searches = 1 * 34 = 34 Its not advised to modify default limits.conf without proper assessment/support. With the default limits.conf settings you can run the above number of concurrent searches - If your splunk is still loaded , and If your dashboard -2 should at least show "Queued job waiting to start" - you can conclude that your job is waiting for resources ... View more

Check the value set for the MAX_ROWS in the .py file , try modify this param {SPLUNK_HOME}\etc\apps\splunk_app_db_connect\bin\dbxquery.py ... View more

You may need this capability rest_apps_management to add apps Suggest better only admins install apps/addo-ons in prod. ... View more

index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3) | fields _time, indexname, sourcetypename, GB ... View more

Modular inputs are running on the splunk enterprise 6.3.2. this server is a new vm, and I referred to the page https://answers.splunk.com/answers/10588/does-splunk-support-fips-140-2.html , my server is running with default configs & modules. ... View more

Yes , I using the latest splunk & add-on for F5 BIG-IP ... View more

EDIT : whereas logs from other apps are coming in on same port. You mean other logs from the DS server ? do you miss only CEF logs alone ?! Are you using universal forwarder , Did u take a look at the splunkd.logs ... View more

Currently , I see only "opsecMetrics" datamodel alone in the app "Splunk Add-on for Check Point OPSEC LEA" - What version of the app to be used to get the mentioned datamodels ? ... View more