Best thing is to add that as its own question, and we'll take it from there. ... View more

'append' does seem broken with Splunk 5.0.2. See my question as well: http://splunk-base.splunk.com/answers/76493/specific-search-not-working-after-upgrade-to-splunk-50 ... View more

This is exactly what I needed. Thanks! ... View more

its in server.conf but under the httpServer stanza http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf sever.conf [httpServer] disableDefaultPort = true Confirm with a netstat that your splunkd port is no longer listening ie. netstat -an | grep tcp | grep LISTEN I ran into this during vulnerability scans also. ... View more

I fixed it manually, but the app needs to be fixed... $SPLUNK_HOME/etc/apps/maps/appserver/modules/GoogleMaps/GoogleMaps.js add: 'https:' ... View more

REGEX IP ADDRESS \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} REGEX RFC1918 IP ADDRESS (192\.168\.)\d{1,3}\.\d{1,3}|(10\.)\d{1,3}\.\d{1,3}\.\d{1,3}|(172\.1[6-9]\.)\d{1,3}\.\d{1,3}|(172\.2[0-9]\.)\d{1,3}\.\d{1,3}|(172\.3[0-1]\.)\d{1,3}\.\d{1,3} REGEX NON-RFC1918 IP ADDRESS \d{1,3}(?<!10|255)\.\d{1,3}\.\d{1,3}\.\d{1,3} |\d{1,3}\.\d{1,3}(?<!192\.168|255\.255)\.\d{1,3}\.\d{1,3} ... View more

Does running "splunk btool find-dangling" produce any output? If so, running "splunk btool fix-dangling" might help. ... View more

here is an example of running the tcpdump command looking for outbound emails on port:25/tcp tcpdump -s0 -xX port 25 ... View more

That's exactly what I was looking for. Thanks. Any idea on why existing alerts are not sending emails? Any new alerts work just fine. ... View more

I know this is old, but I thought I'd add that in Powershell, you still use the single quote, not double. ... View more