Hi I am monitoring dir paths on a syslog server with a UF. I have a few sources with different formats under the same sourcetype. I decided to use a regex to differentiate sources and set their unique formats.   For example I have these two sources... source 1 = /splunkdata/foobar/serverName/2021-04-06-bar.log source 2 =/splunkdata/foobar/serverName/2021-04-06-foo-bar.log I cannot use a "*" wildcard because it is not specific enough,  for example *-bar.log will pickup -foo-bar.log too. The date prefix changes with the log names so I tried this... source 1 = /splunkdata/foobar/serverName/\d{4}-\d{2}-\d{2}-bar.log source 2 =/splunkdata/foobar/serverName/\d{4}-\d{2}-\d{2}-foo-bar.log but no luck... 😞     IDK if I messed the regex or this is not possible...   Any ideas or examples appreciated. Thank you   ... View more

Does anyone have a query that lists UF hosts by version and serverclass? I need a report that provides  host= <foo>  Splunk Version = <version num> ServerClass = <bar> Thank you ... View more

I have a user that kicks off long-running queries and complains that he gets job failures. "DAG Execution Exception: Search has been cancelled" "Search auto-canceled" "The search job has failed due to an error. You may be able view job in the Job Inspector." When I run the same query as admin, the job takes a while but it will complete without failure, usually around 20 minutes. I check the shc ram usage and that looks fine,  the resources appear fine. IDK if the user is running the search at high usage times, but I am not sure how to t-shoot where the issue is. Any advice is appreciated. Thank you     ... View more

Hi -  I have a 4 idx cluster with smartstore.   I keep seeing these warnings on all 4 idx members >>>  Search peer <splunk-idx-1> has the following message: The minimum free disk space (512000MB) reached for /opt/splunk/var/run/splunk/dispatch.  3/11/2021, 1:30:00 AM No matter what I do to make extra room, I keep getting the warnings. On each idx the server.conf is configured locally (/opt/splunk/etc/system/local) with  [cachemanager] eviction_policy = lru #eviction_padding = 5120 eviction_padding = 10240 <<<< doubled max_cache_size = 0 hotlist_recency_secs = 86400 hotlist_bloom_filter_recency_hours = 360 evict_on_stable = false # disk usage processor settings [diskUsage] #minFreeSpace = 5000 minFreeSpace = 512000 <<<< 500GB pollingFrequency = 100000 pollingTimerFrequency = 10 The warning troubles me because if the cache_manager is evicting properly I should not be seeing this warning, or am I mistaken? I don't see a lot of misses in the MC under SmartStore Cache Performance, I see some repeated downloads, but no excessive downloads. Should I set the max_cache_size instead of the minFreeSpace setting? Per Splunk docs >>> Set limits on disk usage Note: This topic is not relevant to SmartStore indexes. See Initiate eviction based on occupancy of the cache's disk partition for information on how SmartStore controls local disk usage. Per Splunk docs >>> Disk full issues A disk full related message indicates that the cache manager is unable to evict sufficient buckets. These are some possible causes: Search load overwhelming local storage. For example, the entire cache might be consumed by buckets opened by at least one search process. When the search ends, this problem should go away.   **** this is not the case because even when search activity has ended, the warnings persist Cache manager issues. If the problem persists beyond a search, the cause could be related to the cache manager. Examine splunkd.log on the indexer issuing the error. ***** I am seeing some >>> Cache was full and space could not be reserved, warnings but I don't know how to fix this.   Any advice is greatly appreciated. Thank you ... View more

Lets say I have 3 lookups >>> a-list.csv, b-list.csv, c-list.csv and the lists only have 1 column header = Name Alice is on a-list Bob is on b-list Charles is on c-list There are lots of people on each list and the lists are dynamic and updated. I have a request to create a Combined_Master Lookup (where C_M-list.csv = a-list.csv + b-list.csv + c-list.csv), where the list contains NAME, FLAG fields such as NAME,FLAG Alice, a-list Bob, b-list Charles, c-list So far I use the following query to build the C_M-list.csv, where there is a Name and Flag appended to each name (which indicate which list the person is from) BUT I am wondering if there is a better way...   | inputlookup a-list.csv | eval FLAG = "a-list" | inputlookup b-list.csv append=true | eval FLAG = coalesce(FLAG, "b-list") | inputlookup c-list.csv append=true | eval FLAG = coalesce(FLAG, "c-list") |.... <rest of the query follows>....   My desired outcome is a M_C-list.csv Alice,a-list Bob,b-list Charles,c-list Any suggestions or improvements appreciated. TY! ... View more

I know the documentation for Zeek add-on says there is support for specific versions  Zeek aka Bro versions 2.1, 2.2, 2.3, 2.4, 2.5 But has anyone used it with Zeek version 3.+???  OR does anyone have a suggestion to onboard Zeek 3+ ???   Is sending as json format the best option? TY! ... View more

I have about a dozen data sources that I want to monitor for an outage...  like>>> No Events in Last 60 minutes. Currently I have been using a separate alerts for each data source / index which run every hour and alert if there are 1 < events. I am just wondering if there is a better way to do this....  I also have to contend with some sources having longer that 60 minute delay at times...   Thank you ... View more