Hello,    How can I change the host name displaying in Splunk with out changing /etc/hostname in linux. I did changed in system/local/inputs.conf under default and /local/server.conf under general.    But nothing has helped me. I am trying to achieve SAML integration with Splunk for SSO. I am getting an error, since my linux host name starts with numbers.   Please do help me.      Thanks in Advance.  ... View more

Hello, I have a problem with my replication status.. getting the below result when ever I am trying to see kvstore status. host 2 replication status is showing recovering from past 1 week. I tried to resync both shcluster config using "splunk resync shcluster-replicated-config" and kvstore using "splunk resync kvstore -source MyGUID" But, both didn't work. Any help would be appreciated. This member: backupRestoreStatus : Ready date : Mon Feb 3 15:50:19 2020 dateSec : 1580763019.583 disabled : 0 guid : ****-46ED-450B-BE21-****** oplogEndTimestamp : Mon Feb 3 15:50:18 2020 oplogEndTimestampSec : 1580763018 oplogStartTimestamp : Mon Feb 3 06:06:00 2020 oplogStartTimestampSec : 1580727960 port : 8191 replicaSet : splunkrs replicationStatus : KV store captain standalone : 0 status : ready Enabled KV store members: host1:8191 guid : ****-46ED-450B-BE21-****** hostAndPort : host1:8191 host2:8191 guid : ***-9A10-4962-9A3F-****** hostAndPort : host2:8191 host3:8191 guid : ****-F4B3-4E58-B765-******* hostAndPort : host3:8191 KV store members: host1:8191 configVersion : 205602 hostAndPort : host1:8191 lastHeartbeat : Mon Feb 3 15:50:17 2020 lastHeartbeatRecv : Mon Feb 3 15:50:17 2020 lastHeartbeatRecvSec : 1580763017.874 lastHeartbeatSec : 1580763017.873 optimeDate : Mon Feb 3 15:50:14 2020 optimeDateSec : 1580763014 pingMs : 0 replicationStatus : Non-captain KV store member uptime : 253492 host2:8191 configVersion : 205602 hostAndPort : host:8191 lastHeartbeat : Mon Feb 3 15:50:17 2020 lastHeartbeatRecv : Mon Feb 3 15:50:19 2020 lastHeartbeatRecvSec : 1580763019.366 lastHeartbeatSec : 1580763017.873 optimeDate : Wed Oct 2 11:09:46 2019 optimeDateSec : 1570028986 pingMs : 0 replicationStatus : Recovering uptime : 253417 host3:8191 configVersion : 205602 electionDate : Fri Jan 24 21:18:18 2020 electionDateSec : 1579918698 hostAndPort : host3:8191 optimeDate : Mon Feb 3 15:50:18 2020 optimeDateSec : 1580763018 replicationStatus : KV store captain uptime : 844587 Thanks, ... View more

Hello, We are planning to buy recorded future for my organization to integrate with splunk ES. We have small Infrastructure with 50GB per day splunk license and I am the only Splunk Engineer working or who can configure things. We are 4 people in my SOC team. When we contacted recorded future sales rep. They are forcing us to buy 4 core licenses since we are 4 people. What if we buy only one core license and integrate with splunk ES? can I run recorded future with domain account? Can we use same account for multiple users? Please do help me with my queries. That will help us save money. Thanks in advance! Happy splunking 🙂 ... View more

Hello, My Threat Activity dashboards returning zero result found message on every dashboard. I turned on data model for threat and threat downloads for all locals When ever I am searching for ip_intel and service_intel, then I am getting the result but all dashboards are empty. Please do help me. Any help would be appreciated. ... View more

Hello, I have tons of data that are ingesting to some index="abc". But I want to filter the whole data and want to ingest the log with the words "Events,Transaction,Payment" and then want to route that data to index=event_logs I wrote the below props and transforms. But no luck. Props: TRANSFORMS-filter = null, IQ,Events Transforms: [null] REGEX= . DEST_KEY = Queue FORMAT = nullQueue [IQ] REGEX= .+(Event|Payment|Transaction).+ DEST_KEY = Queue FORMAT = indexQueue [Events] REGEX= .+(Event|Payment|Transaction).+ DEST_KEY = _MetaData:Index FORMAT = Event_log Please do help me with the issue. Thanks in Advance ... View more