You will need to use git hooks. I use Stash by Atlassian where I have implemented pull requests to merge to master, reject commits directly to maste. If there is a merge conflict on a pull request users must resolve those conflict before pull request can be approved. I recommend user pull from master before creating a pull request. Check out my pervious post: https://answers.splunk.com/answers/312571/best-way-to-use-git-for-source-version-control-wit.html ... View more

Unfortunately, they are not three different connections. Sometimes a single connection is interrupted in the logs, becoming two lines. (Lines 2 and 5) and sometimes the exact same tuples will occur again, but later than a logical connection would last (line 7). I think I need some combination of a maxspan from transaction and your suggestion with stats. The transaction command uses only the _time field (not shown in sample) not the internal times from the log lines. stats doesn't group similar lines together. ... View more

To add onto this, here is an example of the bash script we use to install universal forwarders to all have a random password. We don't save the password as it is easy to reset with access to the filesystem and access is rarely a need to directly connect to a universal forwarder in our instance. If the password needs to be saved you could probably add in there to have it write password and hostname to a file somewhere to retrieve later. We have a similar script for Windows forwarders as well. #!/bin/bash groupadd -g 777 splunk useradd -m -u 777 -g splunk splunk tar -xzvf <forwarder-version>.tgz -C /opt/ chown -R splunk:splunk /opt/splunkforwarder/ su - splunk -c "/opt/splunkforwarder/bin/splunk start --accept-license" su - splunk -c "/opt/splunkforwarder/bin/splunk set deploy-poll <deployment-server>:8089 -auth admin:changeme" splpassword=$(head -c 500 /dev/urandom | sha256sum | base64 | head -c 32) su - splunk -c "/opt/splunkforwarder/bin/splunk edit user admin -password $splpassword -auth admin:changeme" su - splunk -c "/opt/splunkforwarder/bin/splunk restart" /opt/splunkforwarder/bin/splunk enable boot-start -user splunk ... View more

Thank you for your response. As it turns out, in my case I need to report on each 6 second interval. I ended up writing a pre-processor to take the feed as I outlined above and expanding it so that there would be one event every 6 seconds. ... View more

I am able to see the splunkd.log from the server on the indexer. We made sure the splunk user has access to the logs. No logs found when i searched through all time. I'll have to turn on the debugging. ... View more

Facing same issue. It works fine in Chrome or Firefox but when in IE, drilldown doesn't work at all. Nothing happens on click. Difficult to make client understand this problem. ... View more

Edited my answer to show how to convert time to epoch ... View more

I did wonder if you could have the same element ID for multiple tables or whether it would cause issues in splunk.. I was thinking more along the liens of having element_id = * for ALL tables.. ... View more

Anytime! Glad I could help. ... View more

Issue was due to Forwarder being 5.0 and Indexer being 6.0, thanks, should have noticed that one :S ... View more

Thanks mate. The link gave me answer. Cheers ... View more

It would be nice if there was a simple option to revert the UI exactly as was, without having to dig into the XML. ... View more

Could you be more specific on what you are using to identify that a hack is taking place? ... View more

Because it will only take the last FIELDALIAS statement it reads. So actually in your example, the ip field will only contain the values from the dest_ip field. ... View more

sort sorts rows, not columns. ... View more