I am working on developing a Splunk base app for anomaly detection to be released soon. However my 10GB developer licence for testing expired and I want to renew it. I sent an Email to sales@splunk.com 1 week ago but received no answer. I didnt find a renew button on my Splunk.com profile either.  Any suggestions, who I can email to get help? ... View more

I use props.conf setting for Azure json data that I push directly into Splunk via python REST API call (not via UF). It correctly separates events by my custom line breaker. However it still breaks jsons after \r or\n which I do not want. The documentation mentions, line breaking settings are only honored by Forwarders. However, the setting honored LINE_BREAKER, but not the MUST_NOT_BREAK_AFTER settings The props.conf is in an /app (not in system...) My data is nested json events, but in the values can be several \n or \r. [azurejson3] CHARSET = UTF-8 SHOULD_LINEMERGE = false KV_MODE = json LINE_BREAKER_LOOKBEHIND = 5000 LINE_BREAKER = (\<linebreaker\>)+ TRUNCATE = 0 MUST_NOT_BREAK_AFTER = [\r\n]+ MUST_NOT_BREAK_BEFORE = [\r\n]+ MAX_EVENTS = 60000 How can the breaking be prevented?   ... View more

We want to parse highly nested jsons into expanded tables. We found that the following code works, given we apply the | rename . as _ as many times as deep the nesting is. Without replacing the "." Splunk does not make all fields and subfields available. Might there be a more generic solution? index="adm_compute_qcheck" | rename *.* as *_* | rename *.* as *_* | rename *.* as *_* | rename *.* as *_* | rename *_{}* as ** | rename *{}_* as ** | rename *{}_* as ** Here the first part of the JSON: [ { "BIOS": { "manufacturer": "INSYDE Corp.", "SystemBiosMajorVersion": 0, "SystemBiosMinorVersion": 41, "SMBIOSBIOSVersion": "0.99" } }, { "Checkpoint": { } }, { "ClusterName": null }, { "CPUType": { "NumberOfCores": 16 } }, { "HBA": [ { "active": true, "drivername": "elxfc", "driverversion": "12.2.207.0", "firmwareversion": "11.4.204.25", "optionromversion": "11.4.204.25", "manufacturer": "Emulex Corporation", "model": "LPe32002-AP", "serialnumber": "FC83980875" }, { "active": true, "drivername": "elxfc", "driverversion": "12.2.207.0", "firmwareversion": "11.4.204.25", "optionromversion": "11.4.204.25", "manufacturer": "Emulex Corporation", "model": "LPe32002-AP", "serialnumber": "FC83980875" } ] }, { "HPE": [ ] }, { "HPEDiskCount": 0 }, { "HPELogicalDisks": { "Status": null, "RaidLevel": null, "ID": null, "Capacity": null } }, { "HPEPhysicalDisks": [ ] }, { "Mig": { "VirtualMachineMigrationEnabled": true, "VirtualMachineMigrationPerformanceOption": 2, "VirtualMachineMigrationAuthenticationType": 1, "MaximumVirtualMachineMigrations": 2, "MaximumStorageMigrations": 2 } }, ... View more

Is there an environment variable or a setting for defaul.yml I can set for python.version = python3 so that it is added to the server.conf? docker run -dt --restart=always --name=splunk--hostname=splunk --privileged -p 8000:8000 -p 8001:8001 \ -v /home/user/mysplunkinstallation/default.yml:/tmp/defaults/default.yml \ -e SPLUNK_START_ARGS=--accept-license \ -e SPLUNK_PASSWORD=splunk\ splunk/splunk:8.0.2 ... View more

We noticed we have 2 different processes running: systemctl status splunk systemctl status Splunkd The docs explain that there are 2 ways to setup the Splunk service https://docs.splunk.com/Documentation/Splunk/latest/Admin/RunSplunkassystemdservice#Unit_file_naming_considerations Is it correct that the 2 are running in parallel on the same machine? should it not be either one or the other? ... View more

We are indexing the unix /etc/passwd /etc/group and /etc/sudoers in splunk. Now we have to create reports and dashboards that summarize and list all the users, groups and their respective rights. Are there already existing macros, searches oder even apps that do this or help doing this so we would not have to write custom regex code? Example Inputs: /etc/passwd 05.10.18 06:16:11,000 host passwd-file: www-data:x:33:33::/home/www-data:/bin/bash /etc/group 05.10.18 06:16:26,000 host group-file: printadmin:x:396: /etc/sudoers * 05.10.18 06:16:50,000 host sudoers-file: %zabbix ALL=NOPASSWD:/usr/bin/diff * * 05.10.18 06:16:50,000 host sudoers-file: %zabbix ALL=NOPASSWD:/sbin/hpasmcli Output: parsed tables /indices of the passwd group and sudoers files. We found https://splunkbase.splunk.com/app/833/ that parses passwd and group files, but not sudoer files (there can be many different sudoers files) Final Output: once parsed, all the permissions of the users / groups should be in a flat table As there can be several sudoer files ... View more

I am researching to implement a LightGBM model using Skicit Learn in Python. Is it possible to install LightGBM Python packages so it can be used through the ML-SPL API ? ... View more