What is the interval you a querying the API at? ... View more

If you are looking to filter out events where ignore is null you can actually do this as well: ignore="*" This essentially means ignore needs to have a value. Also, to do the second filter I would do it this way: index=my_index | lookup my_table local=true device_id OUTPUT device_id as ignore | search ignore="*" code!=0001 In the last line, anything after the search command implies AND ... View more

Hey @rip_leroi, Please try this search and let me know how it works. index=netfw sourcetype=cisco:asa dest_port=445 Cisco_ASA_action!=teardown transport!=icmp | lookup smbwhitelist.csv dest_ip OUTPUT iswhitelist as whitelist | search whitelist!="yes" ... View more

@bobmacks for TIME_PREFIX, I don't see where the string DATE exists in your sample data. Is this the case? ... View more

@genesiusj splunk_app_for_nix is the application that holds all of the dashboards / lookups / savedsearches etc. This would be what is on your search head. Your indexer will have the Splunk Add-on for Unix and Linux a.k.a Splunk_TA_nix . This is present in your list under the $SPLUNK_HOME/etc/apps . The app comes with all the prebuilt dashboards and saved searches that use a macro to specify which index to find the *nix data. You may have used a custom index, or just used the default index=os . In order for the app splunk_app_for_nix to know where the data resides, you can follow the directions on splunkbase to edit the macro specified. Its important to remember that apps almost always reside on the search heads and contain knowledge objects. TAs on the other hand could reside on a SH / HF / IDX / UF. Where and when these are required depends on what you are looking to do with the data.s ... View more

Any time @jkcadaing! Best of luck and Happy Splunking! ... View more

@antnovo I would check the throughput restriction Splunk has by default. It throttles how much data splunk can send to 256kbps. This is done in limits.conf: [thruput] # setting this to 0 means makes it unlimited (be careful as a single forwarder can overwhelm an indexer) maxKBps = 0 ... View more

@mtupper after looking at the link you are talking about, I realized the problem lies in the fact that the ess_analyst has access to this collection. It is recommended that only admins have access to these collections. ... View more

whats the actual error your seeing? ... View more

Have you tried looking at the SAML Response? If not, depending on the browser you are using, you can get tools that will show you the SAML response and allow you to see what exactly is being passed. If you are using chrome, SAML tracer is a good tool. https://chrome.google.com/webstore/detail/saml-tracer ... View more

What are your time constraints for the search? If the events from that host fall under the time range you are selecting, you are still going to see the host. Once the events age out of that range you will no longer see them. ... View more

Am I correct in assuming you are trying to stop a server from receiving a TA with an input in it? If not, can you elaborate more on what you are trying to accomplish? ... View more

Where is your serverclass.conf file located? ... View more