Hi @LizAndy123 , please try this: | rex "project id : (?<Project_Id>\d+) and metadata id : \w+\sis\s:\s(?<Size>\d+) and time taken to upload is: (?<Upload_Speed>\w+)" that you can test at project id : (?<Project_Id>\d+) and metadata id : \w+\sis\s:\s(?<Size>\d+) and time taken to upload is: (?<Upload_Speed>\w+) Ciao. Giuseppe ... View more

Hi @Nicolas2203 , it's a lack in Splunk architecture: there isn't an HA solution for Heavy Forwarders. You have two solutions: install the Add-On on a Search Head Cluster, so the cluster manages add-ons and HA is guaranteed, but many users don't love to have the ingestion systems in the user fornt-end. The second solution is to configure more HFs and manually enable one at a time, but this isn't an automatic recovery solution and yu have to manage checkpoints between HFs. I hint to add a request in Splunk ideas about this. Ciao. Giuseppe ... View more

Hi @OgoNARA , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @timtekk , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @Stives , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @Stives , if they are private, you cannot do anithing, he shoudl share it at least at app level, enabling the roles to edit alerts and dashboards. If these knowledge objects are orphaned (because e.g. the account was disabled), there's a feature to assign them to another user, then you can share to the correct roles. Otherwise, the only way is to search them on conf files and copy in another user or app area. Ciao. Giuseppe ... View more

Hi @Stives , you should modify the permissions of the alerts and dashboard that you want to modify giving the "Write" permission for the role of these users. It isn't a role problem, but a knowledge objects sharing permissions problem. Ciao. Giuseppe ... View more

Hi @Stives , you should ask to Splunk Cloud Support to remove your app, because there isn't a feature to remove apps, you should delete the app folder, but you cannot access system in SSH. Ciao. Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

H @Znerox , I don't think that you can use a token from two other Single values, but you could use the same search (eventually as base search in this third Single value, using a search like mine. Ciao. Giuseppe ... View more

Hi @Znerox , you have to append two searches: <your_search_A> | stats sum(X) AS A | append [ <your_search_B> | stats sum(Y) AS B ] | stats values(A) AS A values(B) AS B | eval C=A-B | table A B C Ciao. Giuseppe ... View more

Hi @uagraw01 , in general there can be two potential root causes: the server is down, there's a network or server congestion so, the internal Splunk logs have a minor priority than the other logs. I don't think tha you can find a root cause in _internal, see the server and network logs. Ciao. Giuseppe ... View more

Hi @Gregski11 , at first I never saw a production Splunk infrastructure based on Windows (at least labs), think to use Linux! Then, don't put conf files in $SPLUNK_HOME\system\local becaue you cannot manage them using a Deployment server: it's always better to put them in a cstom app (called e.g. TA_indexers) containing at least two files: app.conf, indexes.conf. Anyway, having an Indexer Cluster, you define Volumes and Indexes on the Cluster Manager. Then volume isn't relevant for Search Heads (Clustered or not): they point to the Cluster Manager to know the active indexers (using Indexers Discovery: https://docs.splunk.com/Documentation/Splunk/9.3.1/Indexer/indexerdiscovery ) or directly to the Indexers: https://docs.splunk.com/Documentation/Splunk/9.3.1/Indexer/Indexerclusterinputs). About volumes and indexes, you can put them in your indexes.conf file following the nstructions at https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/Indexesconf Ciao. Giuseppe ... View more

Hi @jatkb , usually connectione between Splunk systems are configured in autoloadbalancing so you have load distribution and failover management between the receiverse (both HFs or IDXs): [tcpout] defaultGroup=autoloadbalancing [tcpout:autoloadbalancing] disabled=false server=10.1.0.1:9997, 10.1.0.2:9997, 10.2.0.1:9997, 10.2.0.2:9997 Otherwise I don't think that it's possible to have an automatic failover management. Ciao. Giuseppe ... View more

Hi @timtekk , good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @jaburke1 , try it, but, as I said, I usually avoid to use automatic lookups. Ciao. Giuseppe ... View more

Hi @FPERVIL , I usually deploy on all the Forwarders an app, usually called TA_Forwarders, containing at least three files: app.conf deploymentclient.conf, outputs.conf. in this way I can centrally manage both sending data to Indexers and Conncection to Deployment Server. Ciao. Giuseppe ... View more

Hi @waJesu , exactly define your requirement and match it to your fields, then it's easy to use commands. Ciao. Giuseppe ... View more

Hi @jaburke1 , I don't like automatic lookups! And I use them only when I must! Ciao. Giuseppe ... View more

Hi @jroedel , eventtype and tag aren't related to the fields: you have to create at first an eventtype for the login, called e.g. "my_technology_login": index=my_index sourcetype=my_sourcetype ("has logged onto the server" OR "logged on" and tag it as "Authentication" required BY CIM and "LOGIN". then index=my_index sourcetype=my_sourcetype (logoff OR "has logged off the server") and tag it as "Authentication" required BY CIM and "LOGOUT". The last sample doesn't seems to be a logfail event, please check it and apply as the others. Then you have to extract fields: user and src using regexes. Ciao. Giuseppe ... View more

Hi @jroedel , ok, you have to create eventtypes and add to login, logout and logfail eventtypes the tag "authentication. You should try to use the Add-On Builder app (https://splunkbase.splunk.com/app/2962) or the CIM-Vladiator app (https://splunkbase.splunk.com/app/2968) that helps you in field aliases, calculated fields and tagging. I usually use the second one. Ciao. Giuseppe ... View more

Hi @waJesu , if host is the host sending the logs and url is a fied in your logs, youcould run something like this: index=your_index sourcetype=your_sourcetype earliest=-24h latest=now host=your_host | stats count BY URL obviously this search depends on the extracted fields. Ciao. Giuseppe ... View more

Hi @whitecat001 , sorry but there's something strange in your request: are you speaking about how to ingest json files in a forwarder or how to parse json files in Search Heads Cluster? you spoke of Deployer that's used in Search Head Cluster, if your requirement is to parse a json file, you have to add INDEXED_EXTRACTIONS=JSON to the sourcetype using the web gui and this configuration is replicated to the hother Search Heads. If instead you are speaking about how to ingest and parse a json file, you have to add INDEXED_EXTRACTIONS = JSON to the sourcetype in props.conf, in the forwarders using the Deployment Server or manually. What's your requirement? Ciao. Giuseppe ... View more