I have lookup with CIDR advanced field which contains:   id cidr_field 1 1.1.1.1/24 2 8.8.8.8/24     If I search for single if in the range, i.e:   | makeresults | eval ip="8.8.8.1" | lookup mylookup cidr_field as ip OUTPUT id     It's worked currently, But If I'm tried to search for CIDR it does not return any result:   | makeresults | eval ip="8.8.8.8/28" | lookup mylookup cidr_field as ip OUTPUT id     So how can I search for CIDR in another CIDR? ... View more

We are monitoring through HF a directory through 'batch' input. The directory contains 100s of zip files, each zip contains 1000s of log files. We have a requirement to write down each log file separately, after it was being forwarded. 1. We tried to use splunkd.log in the HF The component "ArchiveProcessor" does not write each log file within the zip. The component "Metrics" holds stastics of top 10 every 30 seconds, so it does not write every file. Can we change the 'Metrics' paremeters, to write top X and not top 10? Is there any other component we can use, even in DEBUG mode, to get that information? 2. We tried to approach this through the index itself in the indexer. The log files timestamp is not close to 'now', but is spreaded across many years, so it is very slow and not efficient to search them through the index. For example: (| tstats count where earliest=0 latest=now index=myindex by source) ... View more

Hi, I want to create my search macro to return new field. Example: my_search_macro("1") I want to return a new field, test, that contains "your value is " + $arg$ What I'm tried to write in search macro definition: |eval test="your value is " + $arg$ But when I execute my search command as follow: |makeresults | eval msg = my_search_macro("1") | table msg I got an error. So how can I simply create search macro with return value? Thanks ... View more

I have the following query: |tstats values(field1) as f1 values(field2) as f2 where index=INDEX1 [|tstats count where index=INDEX2 by field3 | table field3 | rename field3 as f3] by f3 | sort -fX What I execute the query above I got the following: Subsearch produced 65000000 results, trunacting to maxout 50000 What can I do to solve it? ... View more

I'm trying to send the following Request body (Using Splunk Rest API, C#): search = |inputlookup mylookup | eval week_ago=strftime(relativetime(now(), "-7d@d"), "%Y-%m-%d %H:%M:%S") | where record_created>week_ago Post request to: https://mysplunkuri:8089/servicesNS/~/search/search/jobs Headers: Content-Type: application/x-www-form-urlencoded Authorization: Basic (base64Stringofmycredentials) And got 400 bad request. If I'm trying the following query: search = |inputlookup mylookup | where record_created>"2019-04-16 00:00:00" Its return status code 200 (OK). All the queries above works in splunk. What I'm doing wrong? ... View more

Hi, I'm trying to configure the Splunk Hadoop Connect application with the following configurations: HDFS URI: mynamenode:8020 HADOOP_HOME: /opt/cloudera/parcels/CDH JAVA_HOME: /usr/lib/jvm/java (tried also /usr/java/latest) Namenode HTTP Port: 50070 And I'm got the following error: Unable to connect to Hadoop cluster 'hdfs://mynamenode:8020/' with principal 'None': Failed to run Hadoop CLI job command '-ls' with options 'hdfs://mynamenode:8020/' Error: Could not find or load main class org.apache.hadoop.fs.FsShell. How can I solve this? Thanks! ... View more

Hi, I have two events: event1: field1="A",field2="ABC",.....,fieldN="12" event2: field1="B",field2="ABC",.....,fieldN="13" Is it possible to do a query to find the difference between these events? I don't know the amount of the fields, I want to compare all event fields and check if there is something different. How can I do this? Thanks. ... View more