I have a lookup file called prefixes.csv, and it has about 5 headers: prefix,location,description,owner "1.0.0.0/8",usa,"corporate things", "joe schmoe" I want to be able to reference this file so that, for example, if I am looking at firewall logs, I can ignore or , alternatively, specifically look for events where their src_ip falls into these ranges. So for example, something like: index=firewall src_ip=* | search NOT [ |inputlookup | field + prefix | rename prefix as src_ip] I know that I can do something like this if I had every range expanded for single entries per IP, but is there a way to do this with cidr? I have tried doing the lookup definition route but I think I am missing something or misunderstanding something there. Thanks in advance __PRESENT ... View more

We have a 3rd party pulling AWS logs as far back as AWS holds onto logs. However, we want to be able to go back further so we are looking at our AWS index in Splunk. We want to extract a full export of _raw for the entire index. We have access to the management port of our searchhead which is pointing to an indexer cluster with all of the aws index data - noting that the index is SmartStore enabled. What's the best way to export this programmatically? It would not scale to manually run the search in the GUI and export it. We've looked at the oneshot search with js but it seems to be timing out even though we have baked in pagination. Thanks in advance ... View more

Hello, unfortunately I am having to attempt to do a restore of copies of old db_* and rb_* structures that were basically rsync'd over time to some cold storage. I am noticing that things like ".bucketManifest" don't exist. I am trying to restore it to  a net new indexer cluster with the index configured in indexes.conf. I am happy to do this on a standalone indexer if that's the right way to do this, assuming that this is even possible.   To be clear, i have all of the directories that are prefixed with rb_* and db_*, but nothing else. *EDIT* I actually only have db_*/rawdata/journal.gz and rb_*/rawdata/journal.gz Thanks ... View more

This is the URL it gives me: https://heavyforwarder.domain.com:8000/en-US/manager/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup?action=edit Takes me to 404 page: "https://heavyforwarder.domain.com:8000/en-US/manager/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup" I pushed the app from my deployment server to the heavy forwarder. ... View more

When I enable/disable the input it pulls in new events, but it throws the below errors. If I leave it enabled and it stops pulling in logs after the first attempt. ERROR: /splunk/etc/apps/sft-audit-events-splunk/bin/app/node_modules/async/dist/async.js:473:16 /splunk/etc/apps/sft-audit-events-splunk/bin/app/sft-audit-events.js:215:72 /splunk/etc/apps/sft-audit-events-splunk/bin/sft-audit-events.sh" Logger.info(INPUT_NAME, "Got events: " + results.getAndEmitEvents.list.length "Dependencies This modular input depends on a couple of npm modules: 1. request - Apache 2.0 2. async - MIT 3. splunk-sdk - Apache 2.0 4. parse-link-header - MIT" https://splunkbase.splunk.com/app/3260/#/details ... View more