Hi Everyone,   Is there anyway to forward Splunk User Activity Data(audit data) to External QRadar Server.   We have find the below reference link but unfortunately not able to implement because we dont have enough documentation for steps https://exchange.xforce.ibmcloud.com/hub/extension/f02b54de6c7cd4a5c66676592c36151b   Pleas help me for this   ... View more

Hello Everyone, Please help us to fix the below warnings related to Python Compatibility in Splunk Cloud. 1.Update custom CherryPy endpoints to be Python 3-compatible for the Splunk Enterprise 8.0. Splunk Web, which CherryPy endpoints depend on, will support only Python 3.7. If you've finished your update, please disregard this message. File: appserver/controllers/s3_connector_script.py 2.Python files found. Update these Python scripts to be cross-compatible with Python 2 and 3 for Splunk Enterprise 8.0. See https://docs.splunk.com/Documentation/Splunk/latest/Python3Migration/AboutMigration for more information. If you've finished your update, please disregard this message. ... View more

Hi, Is there any way to Connect with AWS S3 Bucket from Splunk Cloud? We want to download one text/log file from AWS S3 Bucket to Local System on button click of Splunk HTML Dashboard. We are trying with Python Script .Is there any pre built add on available? If we are going with Python Is Splunk-Python-SDK already available in Cloud? ... View more

Hi Everyone, Please help us on this    How to download the file from AWS S3 Bucket from Splunk HTML Dashboard button Click?   Regards, Manikanth ... View more

Hi Everyone, Can anyone help me create indexed fields in accelerated data models in order to work with tstats? Thanks & Regards, Manikanth   ... View more

Hi Everyone,   We have one Schedule which is running on the Index(mulesoft_index ).In this Index all the Fields are act as Indexed Fields . We are Storing Schedule  Search Results into one Summary Index (summaryindex_mt_stats) by enabling Summary Indexing option from that Schedule Search.But the Fields are not acting as Indexed-Fields in the Summary Index. So How can we create Indexed Fields in Summary Index while indexing from a schedule search ?   We are using data models on the Summary Index.But tstats command is not working on the Data Model because tsidx files does not contain the indexed fields, As summary index does not have the indexed fields. Can any one please help on this? Thanks&Regards, Manikanth         ... View more

Hi Everyone, I want to add few conf files in Managed Splunk Cloud app. Is it possible with out Splunk support to vet the app and deploy in Splunk Cloud? Thanks in Advance.         ... View more

Hi, Is it possible to create Indexed-Fields with the help of  collect Command from the splunk  search ?   ... View more

Hi Everyone, We are using do-nut visualization in Splunk Dashboard. But we are getting this error  "Error rendering donut visualization"  before loading this Viz. In the Splunk Base documentation mentioned about this issue is it will get if  you  are running on Safari v11.0+  But in our case we are using Google Chrome. Link: https://splunkbase.splunk.com/app/3150/#/details Please help us to resolve this issue. Thanks & Regards, Manikanth   ... View more

Hi Everyone, I am looking for writing tstats sub search in query in tstats where claus. I tried the below way but my query giving No Result. I want write in sub search with tstats from two indexes. Query:   | tstats latest(_time),values(relational_correlationId),values(tracePoint),values(timestamp),values(businessKey),values(businessValue)  where [  tstats latest(_time) as _time ,values(relational_correlationId) as relational_correlationId ,values(tracePoint) as tracePoint,values(timestamp) as timestamp,values(content.businessFields{}.key) as businessKey,values(content.businessFields{}.value) as businessValue where index="mulesoft_index" earliest=-10m@m latest=now() by environment,businessGroup,appName,interfaceName,correlationId]   Please help me. Thanks & Reagards, Manikanth     ... View more

Hi Everyone,   How can we remove the form inputs in the Dashboard URL.   ?form.messageInQGrater=Enter%20Message%20Queue%20Value&form.filterQuerystatus=Success&form.filterQueryMT=environment!%3D"*prod*"&form.environment1=non_prod&form.filterQuery_BTS=environment%3D"*prod*"&form.time.earliest=-30m%40m&form.time.latest=now&form.searchfield=Transaction%20ID&form.tableSearchField=Application&form.time1.earliest=-1h%40h&form.time1.latest=now&form.filterQuery_app=environment%3D"*prod*"&form.filterQuery_error=environment%3D"*prod*"&earliest=0&latest=&form.businessGroupMT=*&form.busines_groupQ=*&form.region_nameQ=*&form.appNameMT=*&form.businessGroupTS=*&form.interfaceNameMT=*&form.searchstring=Enter%20Transaction%20ID&form.tableSearchString=&form.environment_nameQ=*&form.busines_group_app=*&form.environment_name_app=*&form.busines_group_error=*&form.application_name_error=*&form.appVersion_app=*&form.category_error=SC1&form.queue_name_dd=*&form.criticality_app=*&form.status_app=*   Thanks & Regards, Manikanth   ... View more

Hi Everyone,   Is there anyway to limiting the users for a particular HTML Dashboard in Splunk? ... View more

Hi Everyone,   We are receiving below Data from HEC Token into Splunk. { "mirId": "Mule-111", "appVersion": "v1", "businessGroup": "Ecomm-Direct2Customer", "compress": false, "appName": "dev-pross-Ecomm-int-v1", "relational_correlationId": "22572801-b09e-11ea-9659-023335c1afde", "tracePointDescription": "Capture payload", "threadName": "[MuleRuntime].cpuLight.13: [adaptive-logger-test].adaptive-loggerFlow.CPU_LITE @6dbce5f9", "content": { "exception": "", "payload": "https://s3.console.aws.amazon.com/s3/object/unilever-ai-operationalframework/LEVEREDGE/prod/dispatchAdvice/c96d4fa0-a5fb-11ea-95a5-0281bc7d1468ERROR-2020-06-04T00:39:25.154Z1591231167.txt?region=us-east-2&tab=overview", "businessFields": { }, "category": "org.unilever.apps.adaptiveloggertest" }, "environment": "TJ-Ecomm-Dev", "LogMessage": "Test-TJ-SCHED", "correlationId": "227425e0-b09e-11ea-9659-023335c1afde", "interfaceName": "Process finance Layer", "tracePoint": "START", "timestamp": "2020-06-17T13:26:21.759Z" } We are trying to create a Indexed field for correlationId at Indexing time by using transforms.conf, props.conf,  fields.conf . How to link these conf files with inputs.conf. Please help me in this. Thanks&Regards, Manikanth ... View more

Hi Everyone, We have two indexed fields in Index A. We are doing some calculations using  tstats and collecting to another summary index B Those two fields will act as indexed fileds or not in Summary Index?     ... View more

Hi every one I have a schedule search which will run every 5 mins.But some times it going into failed state .Is there any way or setting to Re Run that schedule search as soon as it goes into failed state? Thanks&Regards, Manikanth ... View more