Again, to avoid confusion of future readers and stress woodcook's point: One instance of Splunk can fulfill multiple roles! So to have one Splunk instance act i.e. as license master, cluster master and DMC you do not have to install 3 instances! Instead you configure the necessary stuff for the 3 roles on the same instance. There's some role Splunk tells you not to combine them (i.e. Cluster Master and Deplyoment). But generally this works like a charm while installing 3 instances on the same server is definitively a mess and 3 VMs would be unnecessary and lot of overhead (ressource- and managment-wise). ... View more

Any case where a deployed inputs.conf can not be accessed or changed. my szenario was attaching new indexers to an existing infrastructure as preparation for a migration.  But index names also changed so for a specific period we had to write events to two different indexes on different indexers. Kind of special case though. ... View more

Years later 🙂 According to https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#KEYS: the correct solution was: [WinEventLog] SOURCE_KEY=MetaData:Sourcetype REGEX=sourcetype::WinEventLog:Security DEST_KEY=_MetaData:IndexFORMAT=Security   Probs: - Syntax for indexes fields (:: instead of 😃 has to be used in  REGEX -There was a mix between sourcetype (in SOURCE_KEY) and source (in REGEX) -case sensitivity of indexes is delicate, so I would always only use lowercase (FORMAT)   As of Splunk Add-on for Windows >=5.0.0  sourcetype contains only "WinEventLog" (or XmlWinEventLog) for all EventLogs, so the correct solution to specifically route WinEventLog:Security is: [WinEventLogSecurityRouting] SOURCE_KEY=MetaData:Source REGEX=source::WinEventLog:Security DEST_KEY=_MetaData:Index FORMAT=security     ... View more

As said above: If you can access the splunk.secret i.e. because you have console access, it's very easy and public knowledge. Posted several time in other places  i.e. https://community.splunk.com/t5/Splunk-Search/How-to-get-the-plain-text-of-pass4Symmkey/m-p/482645 If you don't have access to splunk.secret: As hard as it is to crack an encryption algo or brute force a hopefully not weak password. ... View more

Reliably worked for me, from about version 6.0 up to 8. For sure you need transpose 0 at both invocations, otherwise you will get only the first 5 events. I did some more testing with Win eventlog data: Result as expected (as long as there are not to many events, otherwise it will block the browser tab, because it is so slow). Some fields i.e. Source_Network_Address appear to be empty bu do net get removed. As a matter of fact it contained a space, which you can only see this by dragging the mouse over the values! But I also like your wildcard trick with the table command a lot and for sure it is much faster. Big advantage of transpose is that you do not have to know the field names, therefore it would be much easier to use as a macro, but for a high price... So I think I will also use wildcards next time. ... View more

Use | transpose 0, which indicates that the number of rows to transpose is unlimited. (and be carefull with event counts > 10000, it trashed my browser) ... View more

Followup question: We are only talking about the asset or identity priority. Same with the documentation. http://docs.splunk.com/Documentation/ES/5.1.0/User/Howurgencyisassigned But we quite often have two identities (user and src_user) and two assets (dest and src) in a notable. So which one counts? The documentation says: "If both the asset and identity in the notable event have an assigned priority, the higher priority is used to calculate the urgency. ". So still the question remains: Which asset and which identity? My guess is that it is always user and dest, but found no information on this till now. Quite often you would want to use src instead of dest for the calculation, i.e. if your notable uses web proxy logs and the dest is always an external url, which of course has an unknown priority. In this case it is clearly the src that you want to use for urgency calculation. But if it is always dest, the only option you have is to calculate urgency yourself either with an eval or using the urgency lookup in your search to lookup the src. Any comments on my thoughts? (also submitted this as a question at the above doc page) ... View more

Does not seem to work for me (ES 4.7.2 and above) and it is clear why: owner and status are not saved in the notable index but in a kv store lookup. To lookup these fields you can use the macro "notable" So this works for me: `notable` | TABLE host search_name rule_title owner status ... View more

Here's a solution that eliminates empty columns AND keeps the order of the columns. As table is often used to define the order of fields, keeping it is essential. Tested about a dozen possibilities and the only generic one I found (where you don't have to know the column names) is using transpose, which eliminates empty columns when creating rows of it: `| makeresults count=3 | rename comment as "generate some test data" | streamstats count | eval f2=if(count=2,"YYY",null), f3=if(count=3,"ZZZ",""),f5="XXX",f6=null | rename comment as "f1, f4 and f6 have no values in any row" | table f6 f5 f4 f3 f1 f2 count | rename comment as "now the transpose magic" | transpose | transpose header_field=column | fields - column` ... View more