You have configured an anomaly detection but you have to many entities, maximum ist 30. https://docs.splunk.com/Documentation/ITSI/4.13.1/SI/AD ... View more

@the_wolverine  This answer is old. but its still valid as of today.  ... View more

Hi, Have your find any solution for this, in my case, we are not getting logs from event hub and in internal logs intermittently can see below error messages. I am using current version of Microsoft Cloud Services add on (4.1.1). 2021-02-26 08:14:18,418 level=WARNING pid=31978 tid=Thread-1 logger=uamqp.connection pos=connection.py:work:255 | ConnectionClose('ErrorCodes.UnknownError: Connection in an unexpected error state.') 2021-02-26 08:54:28,165 level=INFO pid=127352 tid=Thread-1 logger=__main__ pos=mscs_azure_event_hub.py:_work_proc:465 | datainput="securitycenter" start_time=1614326067 | message="Start receiving events." max_wait_time=20 max_batch_size=300 2021-02-26 08:54:27,680 level=INFO pid=127352 tid=MainThread logger=splunksdc.collector pos=collector.py:run:246 | | message="Modular input started." [2:06 PM] Bhaskar Chourasiya EXT 2021-02-26 08:54:25,620 level=INFO pid=31978 tid=MainThread logger=splunksdc.collector pos=collector.py:run:249 | | message="Modular input exited." 2021-02-26 08:54:25,605 level=INFO pid=31978 tid=MainThread logger=splunksdc.loop pos=loop.py:is_aborted:38 | datainput="securitycenter" start_time=1614307646 | message="Loop has been aborted."   Thanks, Bhaskar ... View more

/* Row Coloring */ #tblTooltip tr td.range-green{ color: green !important; } #tblTooltip tr td.range-red{ color: red !important; }     ... View more

Could you please tell me how I can set the email subject dynamically? ... View more

You are welcome. Happy Splunking !!! ... View more

@matiyayan1996 No Sir, i have tried this both axis should not be the static it should be dynamic bt then both axis 0 should be at the same place. ... View more

Thanks for the Support but please let me know the path how to set the user time zone as EST instead CEST as a admin.i have tried the above one bye going to access controls---users---timezone but still the user able to see EST only as a admin if i check my end i can see in CEST is it possible to sync user(system) time zone with server time zone ? ... View more

Thanks maityayan. This works, I did it in other way around but only problem is printing in 6 decimals |stats count(eval(responseStatus=200)) as Success, count as Total by _time |eval Percent=round((Success/Total)*100,2), Failure=Total-Success |eval Date =strftime(_time, "%m/%d/%y") |timechart avg(Percent) AS Successrate%, avg(Failure) AS Failed-Session-Count 94.680000 617.000000 ... View more

Sorry for late reply, my query worked for me, as I tried to test the dashboards separately and integrated the drilldown later. Not sure if there was some spacing issues when I initially tried. So I made a separate dashboard with the drilldown query to test if it worked and then moved that query part into the main drilldown panel. Thanks, Ashraf ... View more

Yes it is pretty much possible to put two licence with the different expiry date. Just upload it normally. It will create a stack with the new one. No extra configuration is needed. ... View more

Hi, I had this quirk too, its specific to Splunk cloud free trials (15 days).... even though HEC shows as disabled in the UI it will work also use the endpoint similar too.... https://prd-p-h00lm.splunkcloud.com:8088/services/collector That should get you there ... View more

This is what I wound up doing, as the calc for sha256 did not take that long per url. | eval "sha_url_tok"=sha256(url) Then passed the $sha_url_tok$ out to the Virustotal API. ... View more

Another option | eval "Event_Time"= strftime(_time,"%m/%d/%Y %H:%M:%S %Z") https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables ... View more

@HattrickNZ, if you are on Splunk 6.5 or higher , you can enable Summary Row using table which shows Total as the final row in the table: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsFormatting#Totals_summary_row ... View more