Hi @gcusello  did you get answer from @woodcock regarding applying on all etc/system/local/authorize.conf search head nodes (preferably from GUI if possible) ? Thanks.   ... View more

This part is very important "any that did not match in the last lookup would null out previous matches." ... View more

Hi, I have the same issue but its not working for me.. I first created the lookup and save the search as a report, and then i need to edit my query to append ONLY new values. The current query does not push values at all.     index="rapid7_threat_intelligence" type="Domain" |table _time, source, type, value |outputlookup DOMAIN_IOC_ACTIVE.csv append=true | append [ | inputlookup append=true DOMAIN_IOC_ACTIVE.csv] | dedup value ... View more

What does the ***** represent? ... View more

| eval zip=mvzip(Cluster, mvzip(Current, Max)) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2) | eval threshold = Current / Max | where threshold > 0.85 ... View more

Im having the same issue as ownerpost I tried your index=_internal host=___ I typed in my agent1 , agent2 and agent3 along with controller each tiime and data popped up for each 4 of them. but when I type in the command Index=”main” host=* | table host | dedup host it does not show anything at all? Can you help me troubleshoot this 😞 ... View more

hi @lucky, Try this: | rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)" Sample query: | makeresults | eval _raw="message: INFO [nio-8443-exce-8] b. b. b.filter.loggingvontextfilter c.c.c.c.l.cc.f.loggingcintextfil=ter.post process(Loggingcintextfilter.java\"201)-PUT/actatarr/halt/liveness||||||||||||METRIC|--|Responsecode=400|Response Time=0" | rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)" ... View more

Good to hear that this is working! BUT still you have this issue on your TZ definition on log file. If you ever get logs from TZ which has its xx:30 (like some Indian like -05:30) shift instead of full hour, those will get a wrong UTC time on splunk. ... View more

When you are enabling splunk boot start (please check exact syntax from docs) as systemd managed version, splunk create systemd config file into /etc/systemd/system. Its name is Splunk’s.service or something similar. You could change this if needed/wanted by splunk-launch.conf. As I earlier said, when you are running that “splunk enable boot-start ….” as a root, it creates systemd conf file with standard values based on your host current physical attributes. If you want to restrict memory usage just decrease that memory parameter. I suppose that this restricts the Splunk’s memory usage. ... View more

Oh ok I did not realise that @manjunathmeti  I was trying to present certain values in a columnised Table,  but some of those values won't be populated for all API methods...which means then I may have to have separate panels in the dashboard for the particular API Method, I guess ☹️ Thanks for your guidance ... View more

Hi have you try /servicesNS/ instead of /services/ ? Like this curl -ku $PASS https://localhost:8089/servicesNS/nobody/search/search/jobs --data-urlencode .... r. Ismo ... View more

Any Answer please .. Help me on that regards.  ... View more

Thank you 🙂 ... View more

Try this: index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*" | rex field= log " state=(?<state>.*" | eval starttime=_time | table _time,bid,mandid,actionid,state | apppend [ index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*" | table _time manid actionid | eval endtime=_time ] | stats values(*) as * by mandid | eval duration=endtime-starttime ... View more

Assume that your data field is named data, | rex field=data "^[^/]*(?<data_a>.+/)[^/]*$" | eval data_a = split(data_a, " */") | eval data_a = mvmap(data_a, replace(data_a, "/\* *", "")) ... View more

hi @Erfan, This is working for me, make sure your file contains data in the below format. There should not be any space b/w fields and values. src,dst,protocol,user,whitelisted 192.168.10.1,120.18.97.6,*,*,true 192.168.10.5,*,*,*,true *,*,https,bob,true    ... View more

Answering your second question - timestamp is something unique and it is expected to be different across your events and "carrying over" the timestamp from the previous event is just a form of a fallback when the timestamp cannot be parsed from the raw message. But host or source is expected to be fairly static and is defined at the whole input level. Your transform only overwrites it when it is applied to a single event. In general, other than the timestamp falling back to previous event's there is no "state" with event ingestion. Each event is processed on its own and you have no knowledge of any "previous" ones. Which makes sense since other events from your data stream could have been - for example - routed to other indexers/HFs. The "get last event's time" functionality is also not meant to be used as a reliable timestamping technique, it's just a (kind of) sane failsafe for a situation for when there is something wrong with the event's timestamp (no timestamp or a timestamp too old or too far into the future) ... View more

Just cut it and paste it and run it AS-IS.  Do not modify anything at first. ... View more

Like this: | makeresults | eval _raw=" user action A view A purchase B view C purchase" | multikv forceheader=1 | stats count(eval(action="view")) AS views count(eval(action="purchase")) AS purchases BY user | where views>0 AND purchases==0 So like this: index="A" AND (action="view" OR action="purchase") | stats count(eval(action="view")) AS views count(eval(action="purchase")) AS purchases BY user | where views>0 AND purchases==0 ... View more

You are following the recommended way. Check if you've met prerequisites mentioned: https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/InstallonWindowsviathecommandline#Prerequisites_to_installing_Splunk_Enterprise_on_Windows ... View more

hi @Dany-Abou-Asali, Role can_delete might be inherited in the role(s) that these users belong to. Share the authorize.conf. ... View more

I believe  match="relative_time(now(), &quot;-5m&quot;) &gt;= $start_time$" should be match="relative_time(now(), &quot;-5s&quot;) &gt;= $start_time$" ... View more

as long as the data structure doesn't change too much this should work.   | rex field=_raw ".*\[\s(?<category>.*)\s\]\s(?<type>\w*).*\|\s(?<data>\d*)" ... View more

How about if i got 2 cluster environments for example: HF1->HF2>Indexer1 HF1->HF2>Indexer2 For Indexer1, the indexer should be able to query as per norm with 3 index. For Indexer2, the indexer should be able to query with index_general. I have tried other option which props/transform from sourcetype with _MetaData:Index in HF1, but this method affects the existing index and logs flow to Indexer1 as well.  Is there any alternative option or technically feasible? ... View more