Thank you!  ... View more

@richgalloway  Your are correct. It is under the global setting. Thanks for the come back. ... View more

For customers hitting Cannot register new_channel error regardless of persistent queue at IF,  applying 9.4.x/9.3.2/9.2.4/9.1.7 and above should fix the issue or reduce the chance of events entering  into splunkcloud DLQ. ... View more

Thank you so much for this post!!! It solved my problem upgrading from3.9.to 3.16 ... View more

you could set up different inputs with a relevant source type on the input field of the form.  or if you are planning to use a single input with multiple tables coming in you can set up props and transforms in the app to modify the sourcetype value based on your logs. look for an identifying field with 100% log coverage, use that in a regex to identify your records and modify the sourcetype. ... View more

Thanks Rich, I saw that too hence the reason for the question and since MLTK is Splunk Cloud supported and MLTK is a prerequisite for the "DGA App", I was just curious if any one knew. I have opened a ticket with support. ... View more

If I am following you right, my search without any exclusions will return  the fields A1Sender,  A2Sender, Recipients{} plus some other fields not related to the lookup csv such as user, _time, src_ip ... The csv contains A1Sender, A1Sender_domain, A2Sender, A2Sender_domain, Recipient{}. The data for each roll is manually added into the csv as they are discovered.  Not every field is filled as in the example below. A1Sender                        A1Sender_domain       A2Sender                      A2Sender_domain     Recipient{} fred@flintstone.com                                                 tinker@sbuggy.com                                                                                     *@bbunny.com,                mmouse@wd.com                                                                                 *@wd.com,                                                                   *@bbunny.com,                                                                                                                                                                                    myemail@me.com ... View more

No I have not figured out a solution. I have narrowed down the issue to when routing API calls via a proxy. It works fine in a non-proxy environment. I first thought the issue is around certificates etc and imported them also with no luck ... View more

Question #2 This won't tell you the version but will indicate whether the new package is up to date. The fwd_config field will tell you either it is the "legacy" or "new" package. index=_internal source=*metrics.log group=tcpout_connections name=splunkcloud* | stats latest(_time) AS _time latest(name) AS name by host | rex field=name "(?<output_group>.+?)\:" | eval fwd_config=if(output_group="splunkcloud","legacy","new") | stats count by _time host output_group fwd_config | reltime | fields _time reltime host output_group fwd_config | sort 0 fwd_config ... View more

Could you please help us, giving some idea about the extraction you used to solve this issue. I am also facing the same issue here, though  we are able to fetch some data from MS Azure log analytics but data shows only header part. ... View more

Thanks! Using your btool command located the missing server classes.  Everything is working as expected. ... View more

Thanks Jeremy for your suggestion. I switched over to seckit_idm_windows_identities_accounts and it worked with my *.ninja accounts. I did find that adding would work in seckit_idm_windows_identities_nha ... View more

The regular Splunk tutorial may or may not have an example (I don't know for sure), but here's one that you can follow to get a reasonable example of how to do these things. A close reading of the docs for lookup may also suggest at least things to try. One thing you might need to do is make sure you have a field to join them up on - nt_host is fine, but it would have to be on both sides (not necessarily with the same name - just the contents.) ... | lookup TheNameOfMyLookup FieldInLookup1 AS FieldNameInEvent1 OUTPUT appowner AS MyNewAppOwnerName application AS MyNewApplicationName It's just a sample, but hopefully this gets you started. Happy Splunking, Rich ... View more

Kai, That works perfectly. Thanks for the help and explanation. -Ed ... View more

I am using rsyslog to read in my netscaler events. I have inputs.conf set up to read in all of my rsyslog events and set the sourcetype for each. This is my Netscaler code in my local/inputs.conf Netscaler [monitor:///opt/syslog/netscaler//.log] sourcetype=citrix:netscaler:syslog index=network host_segment=4 disabled=false Then I use a local/props.conf to establish the time and the local/transfroms to extract the netscaler hostname. From there the rest of the fields are extracted by the netscaler add-on. If you want to try this route, I can work you up a time and hostname extract based on your log example. ... View more

I have configured Syslog Server Endpoint (server:port), Transport (UDP) and Format (RFC 5424), following the docs. Take a look at the Notifications menu and go to Syslog Notifications. Check if all options are enabled. ... View more