Adding a little to the wise words from @alacercogitatus, there are quite a few ways to this. OP might have found a solution already. If anyone still stuck on this, below is one of the many ways to do it Have Tokens for your form Elements Anything user enters is stored in Token You can get really creative and do a search as |makeresults |eval Input1 = $token1$ |eval Input2 = $token2$ |eval Input3 = $token3$ |collect index= host= sourcetype= All of these are part of core Splunk, no custom code. Read more about collect command here https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/SearchReference/Collect Hope this helps! Thanks, Raghav ... View more

cool....I am able to pass the arguments to external script but the can't add this to triggered alert action as results are always 0 though there's value. I guess it passes the arguments and cleans itself out? I run this |gentimes start=-1|eval x=120|map search="|gentimes start=-1 | script python Hello $x$" I get the values of x printed to a text file but results say 0. If i could get the results populated so that they are displayed in triggered alerts & pass arguments that would solve it all. And i would drive to Texas and buy you a beer :)...is it possible? ... View more

you gotta be kidding me 🙂 that shed the exact amount of light i needed....Thank you ... View more

Excellent! Please accept this as an answer so that it can easily be found. Thanks, Raghav ... View more

I do not think that is required. Since you are working on only one out of 8 indexers, I would just put that indexer in offline mode and disable boot start. We applied OS patches on our 33 indexer cluster by taking one indexer offline at the time. IT did take lot of time but I never had to touch my master ot the configurations on the master once during the process. As long as the work you are about to do doesn't alter the application or configs, you should be alright. I apologize for the delay. Thanks, Raghav ... View more

Hello @runiyal Method #1:You can extract the source values to a extracted field and then apply the condition after extraction. Example: Sourcename is the field you extract and you can simply ask splunk to |search Sourcename=vendor which will limit it to the events that contain that field Method # 2: use a combination of eval , match function and the condition you want. Method#3: use stats and eval combination with a AND condition (If both conditions you are looking for are key pairs) Hope this helps, Thanks, Raghav ... View more

@sbattista09 , We had the same message couple of weeks ago....We just ran java service and Splunk with proper permissions and it worked like charm...kinda what Damien said above. Thanks, Raghav ... View more

Hey @skoelpin Is the ask here to fix the 8089 vulnerability anyway or using the self signed cert only? In general, if you want to force the cipherSuite, i would just add the following to server.conf under sslconfig stanza (This will take care of all the SSLv3 POODLE stuff) What it doesn't take care of is XSS (Cross Site Scripting) vulnerability if you using versions older than 6.3.3 (I say 6.3.3 because that's the version has XSS patch) supportSSLV3Only = false cipherSuite = TLSv1.2:!eNULL:!aNULL While you are in there, disable kvstore port 8191 if you don't need it as that will pop up in the scan results eventually. Hope this helps! Thanks, Raghav ... View more

Hey @iamarunk, Here's how licensing works Free Splunk : cannot exceed 3 violations in a rolling 30 day window Enterprise Splunk (With active license): cannot exceed 5 violations in a rolling 30 day window If it's an Enterprise Splunk Instance with active License, please contact your Splunk Support person to get a reset key. Once you add the reset key, the search functionality will resume (Your indexing does not get interrupted due to this btw) After you resume the search functionality, go to LURV/ License utilization . If you are in a distributed setup, these metrics will be found on your license master. Check for hints as to what and how this license overage has caused and correct it. Here's what i would do Check which index/host/Business unit is consuming license more than it's entitled to Filter the data upfront (Before it hits the Indexers) If all the data is required/already filtered, start a dialogue with Business/Splunk teams to buy more license. Hope this helps! Thanks, Raghav ... View more

Excellent! Please accept it as an answer if it helped you and others can find it easily. ... View more