This Worked for me as well.  No need to give admin_all_objects permission! Splunk V. 8.2.5 ... View more

Thanks for reporting this, we believe the issue has been addressed in version 1.6.18 of the Python SDK. After some discussion with the community on how to release the fix the consensus was to allow developers to opt-in to the fix (see https://github.com/splunk/splunk-sdk-python/issues/401). Here's more details on how to opt-in to the fix by calling self.add_field within the search command: https://github.com/splunk/splunk-sdk-python#customization ... View more

bit of an annoyance this one - hopefully there will be a new panel for the new dashboard emulation ... View more

Improvement... | makeresults 1 | timechart count span=1h | eval count=0 | append [ search YourSearchHere | timechart count span=1h] | timechart sum(count) as count span=1h ... View more

Thanks for your answer and very sorry for my delay. We don't use the security center, we use the api of the Nessus Professional v6. Do you have any idea why we get all the Events every time..? Is there some kind of option? The second problem does not occur, I guess because we only get 1000 Events per 15 min ;-). ... View more

Added | fields _time tet lowerBound upperBound isOutlier and it worked. ... View more

if you want to track over time, collect the timestamp and size fields on some regular basis and output to a lookup or csv file ... View more

The same issue just started with our tenable add-on. we were receiving data and now it stopped I restarted the Splunk service on the DCN but still doesn't work Anyone have any additional recommendations? ... View more

The message shows that the data is indexed. Maybe you forgot to create the index? Did you search in all the indexes for the sourcetype? Do you have any errors? ... View more

I figured that KV_MODE = xml for any XmlWinEventLog is not working somehow. Maybe it is not prober XML. I could not find something in answer. But as I have the same problem I found a lot of suggestions using KV_MODE = xml. But it just does not work ;-). https://answers.splunk.com/answers/302711/how-to-configure-splunk-to-extract-xml-fields-from.html https://answers.splunk.com/answers/402872/how-do-i-parse-applocker-windows-event-log-renderx.html I personally would use Splunk_TA_windows Transforms. They do extract the fields perfect. But the stanza in the splunk App [(?::){0}XmlWinEventLog:*] does not work for me. So I copied the Transforms directly to the sourcetype and created a local/props.conf: e.g. [XmlWinEventLog:Microsoft-Windows-WindowsUpdateClient/Operational] KV_MODE = none REPORT-0xml_block_extract = system_xml_block,eventdata_xml_block,userdata_xml_block,debugdata_xml_block,renderinginfo_xml_block REPORT-0xml_kv_extract = system_props_xml_kv,system_props_xml_attributes,eventdata_xml_data,rendering_info_xml_data Maybe somebody can comment on this issue? But the above solution works perfectly for me. Have a good day. Ben ... View more

Thanks, as you see in the tags i specifically asked for the packaged visualization https://splunkbase.splunk.com/app/3218/ ... View more

In my case the issue "vanished" After I rolled out 6.5 and made a rolling restart of the cluster it did not show up any more. ... View more

Like this: ... | rex max_match=0 "(?<message>(?:first message string)|(?:second message string)|(?:third message string)|(?:fourth message string)|(?:fifth message string)|(?:sixth message string)|(?:seventh message string))" | stats count by message Tack on | fields - count to get just the list of messages. ... View more

As a best practice, you should put the inputs.conf in one of the apps, not the system level directory. if there is an app that is appropriate, then clearly that works. For example, if you are talking about an F5 log input and you have the F5 app installed, the inputs.conf should clearly go in the local directory of the F5 app. If the input is not directly associated with any app, you might create an app, just as a place to house general configuration files. Or people sometimes choose to use the "search" app for that purpose. ... View more

See the answer from this link for the same http://answers.splunk.com/answers/310401/volume-used.html#answer-310985 ... View more

i believe he wanted a wild card in there somewhere benic ... View more