Hi there, I'm trying to do a search that look at the latest status of a given actionid everyday to make a kind of day by day backlog (event if no action was done). To be clearer, let's say we have the events :  12/01/2021 actionid=actionid1 status=start 12/02/2021 actionid=actionid2 status=start 12/06/2021 actionid=actionid1 status=sent 12/08/2021 actionid=actionid2 status=sent 12/09/2021 actionid=actionid1 status=done 12/10/2021 actionid=actionid2 status=done  The status of a given action doesn't evolve (until it change) but I've no event before it change. And the result that I want is something like (representing the backlog of the actionid by status day by day) :   start sent done 12/01/2021 1 0 0 12/02/2021 2 0 0 12/03/2021 2 0 0 12/04/2021 2 0 0 12/05/2021 2 0 0 12/06/2021 1 1 0 12/07/2021 1 1 0 12/08/2021 0 2 0 12/09/2021 0 1 1 12/10/2021 0 0 2   I hope my request is clear enough. Any help would by great 🙂 Best regards, Francois ... View more

Hello, On Snow alert action, only admin users can see the snow account set up. The non-admin have a "Search produced no results." message. When looking at the rest behind this search, admin have result from | rest servicesNS/nobody/Splunk_TA_snow/admin//splunk_ta_snow_account splunk_server=local whereas non-admin user have an error : Failed to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/Splunk_TA_snow/admin//splunk_ta_snow_account?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Learn More The REST request on the endpoint URI servicesNS/nobody/Splunk_TA_snow/admin//splunk_ta_snow_account?count=0 returned HTTP 'status not OK': code=500, Internal Server Error.   Any idea ? Regards, Francois ... View more

Hi there, I try to delete old SAML users on a SHCluster with Splunk 7.1.4. I followed instructions here https://answers.splunk.com/answers/525555/how-do-i-remove-old-saml-users.html but I still have these users in the access control > users page. More surprisingly, if I request curl -k -u admin:{password} --request GET https://{searchhead}:8089/services/admin/SAML-user-role-map/{user} I have a positive answer (user found) But if I request curl -k -u admin{password} --request DELETE https://{searchhead}:8089/services/admin/SAML-user-role-map/{user} It says : In handler 'SAML-user-role-map': Does not exist: /nobody/system/authentication/userToRoleMap_SAML/{user} These users are not in /etc/users folder nor in authentication.conf file I also tried with authentication/users method. I tried to complete with debug/refresh and restart the SHCluster without the expected result. Any idea ? Regards, Francois ... View more

Hi guys, I'm trying to use Splunk App for Infrastructure bu I've an issue : some entities are in inactive status although receiving data (confirmed in "Analysis" view) but sometimes go back to active and so on. As most of the "sometimes inactive status" entities are receiving data every 5m (not production hosts), I wonder if there is a parameter to tune the detection of pseudo inactivity ? Thanks for your help Francois ... View more

Hello guys, I'm currently using Splunk_TA_Windows (v5.0.1). I'd like to add the user who launched each processes. Is there a way to add this ? (argument to winhostmon binary ?) Regards, Francois ... View more