How do you determine what goes down the 9997 pipe verses the encrypted 9998 pipe on your forwarders? ... View more

I know this is an old thread but thought I would post an answer for future reference. I was getting https:///en-US/app/splunk_app_db_connect/ftr# with a blank screen. I am using Chrome. After upgrading from 3.11.1 to 3.12.1, I was still only getting a blank screen so I removed DB connect and installed 3.11.1. No luck - still a blank screen. Finally, I cleared the browser cache and was able to access DB Connect without any issues. ... View more

Thanks Rich, I saw that too hence the reason for the question and since MLTK is Splunk Cloud supported and MLTK is a prerequisite for the "DGA App", I was just curious if any one knew. I have opened a ticket with support. ... View more

Thanks Rich,  I have opened a ticket with Splunk Support. ... View more

If I am following you right, my search without any exclusions will return  the fields A1Sender,  A2Sender, Recipients{} plus some other fields not related to the lookup csv such as user, _time, src_ip ... The csv contains A1Sender, A1Sender_domain, A2Sender, A2Sender_domain, Recipient{}. The data for each roll is manually added into the csv as they are discovered.  Not every field is filled as in the example below. A1Sender                        A1Sender_domain       A2Sender                      A2Sender_domain     Recipient{} fred@flintstone.com                                                 tinker@sbuggy.com                                                                                     *@bbunny.com,                mmouse@wd.com                                                                                 *@wd.com,                                                                   *@bbunny.com,                                                                                                                                                                                    myemail@me.com ... View more

A1Sender,  A2Sender and Recipients{} are fields within the events. I am looking to exclude anything in the lookup table from the results found in {mysearch} If fields A1Sender, A2Sender contain values then omit them from the results.  This works in the first example but getting the rest to work have been difficult. If field Recipient{}] contain values then omit them from the results.  If field A1Sender_domain, A2Sender  convert A1Sender_domain into A1Sender and use A2Sender to omit from results If field A1Sender_domain, A2Sender_domain same as above by A2Sender_domain will be A2Sender. Did that answer your question? ... View more

Did you find a resolution to this issue? I am having the same issue after upgrading from 3.2.0 to 3.3.2. Thanks ... View more

Question #2 This won't tell you the version but will indicate whether the new package is up to date. The fwd_config field will tell you either it is the "legacy" or "new" package. index=_internal source=*metrics.log group=tcpout_connections name=splunkcloud* | stats latest(_time) AS _time latest(name) AS name by host | rex field=name "(?<output_group>.+?)\:" | eval fwd_config=if(output_group="splunkcloud","legacy","new") | stats count by _time host output_group fwd_config | reltime | fields _time reltime host output_group fwd_config | sort 0 fwd_config ... View more

If you are only getting header information, check your query in Log Analytics first. If it works correctly there then it should work in KQL. We haven't had one not work yet. Also, Some logs in Azure only have header info and no data.  Not sure why that is. ... View more

I couldn't find any thing published for this so I had to create a field extraction for each individual query that we implemented. It took a few tries on each one. Just when I thought I had it, MS would through a new format in the query but they have been pretty stable lately. They are not the prettiest regexes but they are working for us. ... View more

Thanks! Using your btool command located the missing server classes.  Everything is working as expected. ... View more