Hello, I would like to copy paste my app dashboards, say from the app  A/local/data/ui/views folder to the corresponding backup app, say A_backup/../views several times a day adding the timestamp to the dashboard name. The goal is to give developers the possibility to come back to their coding from like 3 hrs back. What do I need to take into consideration for that? I mean I would like to avoid restarting my splunk in-between to make the changes visible of course.  The developers should be able to access the A_backup and see their versioned dashboards by the corresponding name. I know, there are perhaps better ways (github app) for that, but I would like to keep it simple as that. I made a test with copy paste of one .xml file within the same app, but it is not visible in the UI, so I guess I miss some parts here. Can anyone help with the above? Kind Regards, Kamil ... View more

Hello, We have several cases, where we relate the data between panels. On the example screenshots below, we have: 1/ Chart with the number of database threads in time, and the sum of threads per time unit involved in the execution of the particular SQL statement (SQL hash) - represented by the different colors:    2/ Pie chart showing the portion of the particular SQL statement / hash in the given time span: Is there any easy way to keep the colors for the same SQL statements/hashes between the two panels? Kind Regards, Kamil ... View more

Hello,   We have Django logs in following format: 11/15/2021 08:34:38 [INFO - 171 ] - [tenant_move.py] - [STOP_PROCESS] : STOP_PROCESS(HANA Tenant Move Alerts) completed successfully - Rows affected : 1 and we would like to extract the following fields using regex, on the above example: TYPE=INFO LINE=171 SCRIPT=tenant_move.py MODULE=STOP_PROCESS .. ideally using single regex expression and not 4 separate. Could anyone help? Kind regards, Kamil ... View more

Hello, I am trying to extract the system IDs from single event into the multiple events, I mean that each SID is in a separate line. I try to deploy a regex for this, without success. Could perhaps anyone help with the below? Kind Regards, Kamil   | makeresults | eval SID="I32 DYR DZ1 MHW DYN I58 ICZ ICN I69 I8Y IAE I6J I71 SLG I9Z I7T I7Z I5Y I5U I5T I3I I3G TCX I5O DZX DZC DYQ DYO DYM OGO OJ8 OK8 OKQ OKX DXF DYE DYF SS4 QMW I24 R9H O67 OP0 SP9 I4I I4M" | rex field=SID "^(?<SID2>[^\r\n].+)"   ... View more

Hello, I read my data with the inputlookup command and try to count the different occurrences of the field fields.SID as below:         | makeresults | eval time=relative_time(now(),"-24h") | eval time=ceil(time) | table time | map [ |inputlookup incidents where alert_time > $time$ ] | join incident_id [ |inputlookup incident_results ] | fields fields.SID | search fields.SID=* | mvexpand fields.SID           Unfortunately, whatever tricks I do I am always getting several SIDs packed into a single event, see the screenshot below.  How would I split it the way to have each fields.SID in separate row to be able to count it? Kind Regards, Kamil ... View more

Hello, We are using the Tenable Infrastructure Vulnerability scanner to scan regularly our complete infrastructure. Tenable reports following findings for the Splunk Server Ports: https://www.tenable.com/plugins/nessus/31705 SSL Anonymous Cipher Suites Supported Please find below the plugin output: The following is a list of SSL anonymous ciphers supported by the remote TCP server :   High Strength Ciphers (>= 112-bit key)     Name                          Code             KEX           Auth     Encryption             MAC     ----------------------        ----------       ---           ----     ---------------------  ---     AECDH-AES128-SHA              0xC0, 0x18       ECDH          None     AES-CBC(128)           SHA1     AECDH-AES256-SHA              0xC0, 0x19       ECDH          None     AES-CBC(256)           SHA1 The fields above are :   {Tenable ciphername}   {Cipher ID code}   Kex={key exchange}   Auth={authentication}   Encrypt={symmetric encryption method}   MAC={message authentication code}   {export flag}   Could you please advise how to adjust the SSL Splunk configuration to fix this issue? Can this be fixed by setting certain value to cipherSuite in server.conf? The above issue is reported for the ports (2)8191 and (2)8089.  Our server.conf (local) looks as follows: [kvstore] port = 28191 [license] master_uri = https://splunk-license.xxx.corp:443 # Workaround to overcome the connection issues to the license server [sslConfig] # To address Vulnerability Scan: # https://serverfault.com/questions/1034107/how-to-configure-ssl-certificates-for-splunk-on-port-8089 sslVersions = tls1.2 sslVersionsForClient = *,-ssl2 enableSplunkdSSL = true serverCert = /etc/apache2/splunk.pem # Workaround to overcome the connection issues to the license server cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH # To address Vulnerability Scan: # https://community.splunk.com/t5/Archive/Splunk-shows-vulnerable-to-CVE-2012-4929-in-my-Nessus/m-p/29091 allowSslCompression = false useClientSSLCompression = false useSplunkdClientSSLCompression = false sslPassword = xxx [general] pass4SymmKey = xxx trustedIP = 127.0.0.1   The cipherSuite in server.conf (default) looks as follows: sslVersions = tls1.2 cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1   Could you please advice? Kind regards, Kamil ... View more