I've done this little app in order to adress this specific use case : https://github.com/kilanmundera/Custom-Annotations-Framework-for-Splunk-Enterprise-Security ... View more

If you have wildcards in your lookup, just use the lookup command ... View more

You can achieve this by using the sendemail command. Rather than setting email as an action, you can incorporate the sendemail command directly into your search query, configuring it with the necessary parameters. Example <yoursearch> | sendemail to=example@splunk.com server=mail.example.com subject="Here is an email from Splunk" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true   ------ If you find this solution helpful, please consider accepting it and awarding karma points !! ... View more

I'm accepting this as the solution since this line was the key to creating my final search as seen below. It looks for empty indexes which can be used in an alert as "When number of results is greater than 0" and "Trigger for each result"    | rest splunk_server=local /services/data/indexes | where title IN ("index1", "index2", "index3", "index4", "index5", "index6") | table title | rename title AS index | join type=left index [| tstats count where index IN ("index1", "index2", "index3", "index4", "index5", "index6") BY index] | fillnull | where count=0     ... View more

Is it possible to ask that sender reduce content of HEC event or is it used somewhere else also? ... View more

When you change the "Wrap results" option, it switches between this CSS .results-table .wrapped-results td, .results-table .wrapped-results th { white-space:pre-wrap; } and the "nowrap" value. Instead of "nowrap" it probably should use "preserve-spaces" one to be consistent. (or collapse in both cases). The mystery of collapsing spaces in the source view which I showed is still present however. ... View more

@PickleRick , @Jawahir  Thank you for your responses; my issue has been resolved.   ... View more

I agree with @PickleRick about data optimization of bucket. Those warm and cold buckets are identically. Of course you could additionally configure tsindex reduction there, but it hasn't anything to do with warm -> cold movements. Here is one old, but still mostly valid presentation about event lifecycle. https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf After one have read it, one probably understand this better. ... View more

Here's what I ended up doing, seems to work! | rex max_match=0 field=Tags "(?<namevalue>[^:, ]+:[^,]+)" | mvexpand namevalue | rex field=namevalue "(?<name>[^:]+):(?<value>.*)" | eval {name}=value The confusion about seeing only one of the fields being extracted was a result of the mvexpand. I didn't realize that created NEW events, one for each field. Makes sense now...thank you! ... View more

@gcusello    I have one indexer and inside that i have created one index and i couldn't fetch data of that index from search head but i can fetch it from the indexer. Thanks ... View more

This YouTube video on Search Optimization in Splunk is highly useful https://www.youtube.com/watch?v=U3A1zxag_lc ------ If you find this solution helpful, please consider accepting it and awarding karma points !!   ... View more

Try this : <your_search>|rex field=source "\/audit\/logs\/(?<environment>[^\/]*)\/(?<hostname>[^-]*)\-(?<component>[^-]*)\-(?<filename>.*$)" ------ If you find this solution helpful, please consider accepting it and awarding karma points !! ... View more

Did you come up with any solution?  I'm curious how you had the webhook working with MS Teams before? I never could get the default Splunk Webhook action to properly send to the Teams Webhooks integration. It seemed like the default Splunk Webhook json is not formatted in a way that Teams accepts? ... View more

Thanks both of you - both work :-0) ... View more

All "final" inputs that your LB balances traffic to need to have the same configuration so that they behave identically regardless of where your request is redirected - they have to have the same tokens defined, should set the same default metadata fields should they not be set by the sender, have the same queue parameters.   ... View more

If the same search on the same data ran within the same app (are you running both searches from the same app?) yields different results for two different users there must be some difference in configuration. It can be either due to one of the users having custom settings defined on a per user level or difference in permissions to the app the settings (probably either extractions or calculated fields) are defined in. Compare settings for relevant sourcetype with app and user context using btool. ... View more

when we combined these lookups as shown in the query you shared, the results only reflected matches from the second lookup, meaning only the IP addresses were being compared. Additionally,  My mistake again.  When using the same output name, the second lookup overrides the first.  Use outputnew in the second. index=A sourcetype="Any" | fields "IP address" Hostname OS | dedup "IP address" Hostname OS | eval Hostname = lower(Hostname) | lookup inventory.csv Reporting_Host as Hostname output Reporting_Host as match | lookup inventory.csv Reporting_Host as "IP address" OUTPUTNEW Reporting_Host as match | eval match = if(isnull(match), "missing", "ok") | table Hostname "IP address" OS match   ... View more

I hope this search query proves useful to you. index=federated:infosec_apg_share source=InternalLicenseUsage type=Usage idx=*_p* idx!=zscaler* st IN ([ search index=<your_index> | stats count by sourcetype | fields sourcetype ]) | stats sum(b) by st | eval GB = round('sum(b)'/1073741824,2) | fields st, GB   ------ If you find this solution helpful, please consider accepting it and awarding karma points !! ... View more

Restarting did get rid of the message. Thanks for the reminder that a restart is necessary after every change. ... View more

  Run the query for All Time to identify the oldest bucket in the specified index. (Just to get information) The fields start_days and end_days represent the time range of events contained within each bucket. Sort the buckets by end_days in descending order to find the oldest bucket in that index. For example, if the end_days value is 500 and you only want to retain 400 days of data, configure the following parameter in your index settings frozenTimePeriodInSecs = 34560000      #(Seconds equivalent to 400days) ------ If you find this solution helpful, please consider accepting it and awarding karma points !! ... View more

@harishsplunk7  I hope this search will help you .. | rest /services/authentication/users splunk_server=local | table title, realname, last_successful_login | rename title AS username | addinfo | eval status=if(last_successful_login>info_min_time,"User logged in during the selected time range","User Not logged in during the selected time range") | convert ctime(*_login) ctime(*_time)|fields - *_time, info_sid ------ If you find this solution helpful, please consider accepting it and awarding karma points !!   ... View more

My background is network engineering so I can't speak to any specific software processing benefits of HTTP vs HTTPS.  However, since HTTP is essentially plain text that would be fairly simple to take the packet off the wire.  Having to decrypt HTTPS would by the very nature of an additional step add processing requirements but as pointed out by others depending upon the compute power of your server(s) there usually isn't a noticeable hit or queuing of data.  Most systems today have compute that will outperform the physical network connection. ... View more

Thx Jawahir007, unfortunately, we do not have OVOC (Audiocodes EMS),it will be interesting to find the dashboard spl code,but can't find it,   Thx       ... View more

index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3) | fields _time, indexname, sourcetypename, GB ... View more

Use INDEXED_EXTRACTIONS = CSV in porps.conf for your sourcetype and push it to Universal Forwarder too along with inputs.conf props.conf [DataDeletion] INDEXED_EXTRACTIONS = CSV FIELD_DELIMITER = , FIELD_NAMES = field1, field2, field3, field4 # (Replace with actual field names) TIME_FORMAT = %Y-%m-%d %H:%M:%S # (Adjust based on your timestamp format) TIMESTAMP_FIELDS = timestamp_field # (Replace with the actual field containing the timestamp) ------ If you find this solution helpful, please consider accepting it and awarding karma points !! ... View more