Hello Gregski11. The timeout setting simple tells splunk to warn you about it, not to disallow the search. the default is 3000ms, so check that your local limits is even readable by splunk. There could be several reasons for the search taking so long to dispatch, such as permission on the directory where the artifacts are created, or even on you limits.conf in your local (if splunk cant read it, it will use the default version).  if the disk where the artifacts are create is very slow for some reason, then it could just be taking a while to create.  ... View more

Hello adrifesa95. Are you using the Splunk Add-on for Check Point Log Exporter, or the older Splunk Add-on for Check Point OPSEC LEA? If the newer one, there is a section on the docs referring to troubleshooting when its not parsing due to depth limit and how to increase it... https://docs.splunk.com/Documentation/AddOns/released/CheckPointLogExporter/Troubleshoot ... View more

From what I've read in the ScienceLogic docs (Logging in the Integration Service Platform": If you use your own existing logging server, such as Syslog, Splunk, or Logstash, the Integration Service can route its logs to a customer-specified location. To do so, just attach your service, such as logspout, to the Microservice stack and configure your service to route all logs to the server of your choice.   They seem to have an API for integrating with other systems you may want to check out too: https://docs.sciencelogic.com/latest/Content/Web_Content_Dev_and_Integration/ScienceLogic_API/api_title_page.htm?Highlight=API ... View more

depending on your method of collection, please see here: https://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureInputs Note this portion in case you are under this scenerio: Note: It is a best practice to collect VPC flow logs and CloudWatch logs through Kinesis streams. However, the AWS Kinesis input has the following limitations: Multiple inputs collecting data from a single stream cause duplicate events in the Splunk platform. ... View more

Please see this previous post: https://community.splunk.com/t5/Splunk-Search/How-to-extract-ip-address-using-regex/m-p/379717 ... View more

Hello dhuynh, there are a few possible reasons this could be happening. First, please check for payload character set issues (such as non UTF-8 characters, which can cause JSON to break. Also, check the splunk logs for errors. You can find HEC parsing errors in the _introspection index.  ... View more

Could some of those IPs internal IPs (like a 192.168.x.x network), or otherwise not resolvable? For the IPs that dont resolve, spot check some from a command prompt using nslookup <ip> ... View more

Hello, looks like this is not the first time. going way back... https://community.splunk.com/t5/Installation/Why-am-I-getting-an-installation-failure-for-Splunk-6-2-2-6-2-3/m-p/220838   ... View more

So long as you're not doing performance testing you may consider running splunk using docker.  Ive been able to spin up 3-node index clusters with an ITSI Search head, on an 8-core i9, 32GB (w/1TB SSD) macbook laptop, even running ITSI and another container running oracle. if you have a few machines, you'd be pretty set. again, so long as you're not doing real load testing, you can spin up an environment in a few seconds, and test your apps and inputs. https://docs.splunk.com/Documentation/Splunk/9.0.3/Installation/DeployandrunSplunkEnterpriseinsideDockercontainers Just be aware, the free version of splunk does not support clustering or premium splunk apps. ... View more

this may be a bit 'hacky', but if you want the actual value (the count) instead of the percentage, as part of the label on each slice, you could do something like this: index="test" sourcetype=csv | chart count by status |eval status=status." ".count ... View more

Hello, so are you looking to output a table of host and index to show what hosts are in each index? If so, try this: |tstats count where index=* by host index|fields - count ... View more

Are you looking for log_start_date? See here in the example (which has it under setting up from the UI, though can should be able to do it directly when editing the .conf files too) https://docs.splunk.com/Documentation/AddOns/released/AWS/S3#Configure_a_Generic_S3_input_using_configuration_files ... View more

can you elaborate on the "what i have to do is use a span that is equal to the time range picker."? The picker will provide a earliest and latest for the entire search to look over, where the span is duration to take each avg over. So if you search all of yesterday, then a reasonable span might be 15min for example (meaning show the avg every 15min for all of yesterday). so having a span that is equal to the time range is simple taking a single avg over the entire time, which you'd do with stats instead of timechart. ... View more

You can also add | fields - count to Richard's tstats, to be left with just the host field. ... View more

Oracle published a document back in 2015 for collecting data from their ZFS storage appliance using Splunk:  https://www.oracle.com/technetwork/server-storage/sun-unified-storage/documentation/splunk-logging-zfssa-2516546.pdf   This should still be relavent, and they may have an updated one too. ... View more

try this: index=_internal source=*python.log sendemail ... View more

since its an older version of dbx, you can try to add something like this to the connection string in the dbx jvm parameter settings:  -Duser.timezone=GMT   just be aware this would apply to all connections. ... View more

Hi Altink,   are you able to modify the SQL query to change the TIMESTAMP field? Here is a solution (using Oracle, but same premise): https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-time-in-Splunk-DB-Connect-and-the-Add-on-for/m-p/399225 Also, if thats the only connection you are using, you can also change the timezone at the jvm level, as it uses its own separate from the OS (unless they've been synced, but I usually see them using their own) ... View more

Actually, from the docs, this is now the method, when creating the database connection: https://docs.splunk.com/Documentation/DBX/3.10.0/DeployDBX/Createandmanagedatabaseconnections#Create_a_database_connection see the part re Timezone: ... View more

you can add a TZ setting to the props.conf in db connect for that sourcetype. ... View more

If you have outbound mail setup you can use |sendmail after the outputlookup. This this works for me, and Im able to receive csv files attached that were produced by the outputlookup: mysearch | outputlookup mylookup.csv | sendmail to="abc@xyz.com" sendcsv=true See these docs: https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Sendemail https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail   ... View more

Hello, Just an idea, but maybe if you are using data models and the CIM, consider scheduling tstats searches against the data models, to count for example, the number of Authentication failures by host over the last 5 minutes.  Then you wont care the source or sourcetype, or host. So long as its in the datamodel (likely via the CIM). Something like this, where it looks for the number of failed authentications per host, over the last 5 minutes...     | tstats count from datamodel=Authentication where Authentication.action=failure earliest=-5m@m by _time Authentication.src |stats sum(count) by Authentication.src     Schedule this every 5min, as it looks back 5 minutes within the datamodel (adjust the duration depending on you acceleration times/etc). Then you'll get a decent number you can alert off of, and it will give you the  src (host) having the increase of Authentication failures for you to go investigate.  It wont matter what the Authentication source is (dns, remote login, ssh, ftp, etc, etc) so long as it's in the datamodel, you'll get an alert. Just an idea.   ... View more

Hello, please have a look at the timewrap command. https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Timewrap?ref=hk This may be what youre looking for. ... View more