Hi @trile757 , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @Andre_ , Search Heads (as Heavy Forwarders) don't display by default the indexes list because they don't know it. For this reason is a PS best practice to create ad add-on (called e.g. "org_all_indexer_base" where org is the customer name) containing the indexes list (indexes.conf file) and deploy it to the Search heads and Heavy Forwarders. Ciao. Giuseppe ... View more

Hi @ddrillic , let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @trile757 , I suppose that  [monitor:///drive/drive2/Linux_Audit.../audit.log is a mistyping because the correct one is: [monitor:///drive/drive2/Linux_Audit/.../audit.log] Anyway, I'd check again the permissions on that files for the user that you're using to run splunk. Ciao. Giuseppe ... View more

Hi @ddrillic , it's a best practice, requested by Splunk PS, to install in the Heavy Forwarders an add-on listing all the indexes available on the Indexers (whether they are on-premise or in the cloud), even if you don't localy index your data, but only to have them in lists. It should be called "org_all_indexes" where org is the organization name. Ciao. Giuseppe ... View more

Hi @ddrillic , if you're speaking of UF Management by the point of view of the add-ons configurations, the best solution is the Agent Management (ex Deployment Server), eventually integrate with an Ansible and GitHub repository for versioning. If instead you're speaking about the UF itself, you have three solutions: use a script for Linux and Group Policies for Windows: this is the easiest solution but you don't have a real management and you don't have versioning, Use Ansible, integrated with GitHub repository: for the moment, my preferred one, wait for Splunk releasing the UF upgrade feature that was requested by Community and promised in a future version of the Agent Management, my future preferred one, even if I don't know how they will manage versioning. Ciao. Giuseppe ... View more

Hi @PaulaCom , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @PaulaCom , I see three errors in your SPL: between "set expiry date and manager" and 1=1 you need a comma. the condition for "set expiry date and manager" should be an AND condition not OR. the condition "set expiry date and manager" should be listed as first condition, because otherwise one of the previous conditions will win. Ciao. Giuseppe ... View more

Hi @Matt_Splunk , Use the Splunk Add-On for SERVICENOW (https://splunkbase.splunk.com/app/1928). It will give your all the features you need. Ciao. Giuseppe ... View more

Hi @splunkreal , if you configured outputs.conf and you're receiving logs from the other .log files it isn't a normal behaviour. Di you checked if the owner of the "opencti_create_incident_modalert.log" file is splunk? Ciao. Giuseppe ... View more

Hi @splunkreal , did you configured your Search Head to send its logs to the Indexers? Ciao. Giuseppe ... View more

Hi @Wohamed_wakkad , this is a recognized by Splunk Professional Services architecture, so you can open a ticket to Splunk Support. Ciao. Giuseppe ... View more

Hi @hotrodbass , you need to add the time factor and the threshold to your search, something like this: index=linux | rex field=_raw "(?<pctUser>[0-9]+(?:\.[0-9]+)?)\s+(?<pctNice>[0-9]+(?:\.[0-9]+)?)\s+(?<pctSystem>[0-9]+(?:\.[0-9]+)?)\s+(?<pctIowait>[0-9]+(?:\.[0-9]+)?)\s+(?<pctIdle>[0-9]+(?:\.[0-9]+)?)" | eval cpu_busy_pct=round(pctUser + pctNice + pctSystem, 2) | eval cpu_non_idle_pct=round(100 - pctIdle, 2) | bin span=5m _time | fields _time host pctUser pctNice pctSystem pctIowait pctIdle cpu_busy_pct cpu_non_idle_pct | stats max(*) AS * BY _time | where cpu_busy_pct>=90 Ciao. Giuseppe ... View more

Hi @USA69 , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @USA69 , I cannot test the search, so, see my approach and apply it to your search: index="maj_p" OnboardingStatus=Onboarded OSPlatform=windows1* | stats latest(OnboardingStatus) AS OnboardingStatus latest(SensorHealthState) AS SensorHealthState latest(OSPlatform) AS OSPlatform latest(ClientVersion) AS ClientVersion latest(_time) AS Def_Lastseen BY DeviceName | eval Week_breakdown=case(Def_Lastseen>=relative_time(now(), "-7d@d"), "1-7 days", Def_Lastseen>=relative_time(now(), "-15d@d") AND Def_Lastseen<relative_time(now(), "-7d"), "8-15 days") | eval nt_host=upper(replace(DeviceName, "\..*$", "")) | append [ | inputlookup workstation* WHERE hostname!="*.corp" (dv_install_status IN ("In use", "In stock") OR ds="dal" OR (seen_by_obt="n/a" AND ds!="dal")) AND (seen_by_cs="Yes" OR seen_by_q="Yes" OR seen_by_sccm_status="Yes") AND (os="Windows" OR os="WINDOWS") | eventstats count as scope_count ] | stats values(*) AS * BY nt_host | eval nt_host=upper(replace(DeviceName, "\..*$", ""))] | search OnboardingStatus=* | stats count as agent_count by scope_count | eval missing_agents = scope_count - agent_count | eval incompleteness = round((missing_agents/scope_count) * 100, 2) | eval completeness = round((agent_count/scope_count) * 100, 2)" Ciao. Giuseppe ... View more

Hi @USA69 , there is a main issue in your search: putting the search on index in the subsearch, you have the limit of 50,000 results for the subsearch, for this reason it's a best practice to put the index search in the main search and use the inpulookup search in the subsearch or (better) use the lookup command. In addition the join command is a commad to avoid because it's very slow and resource cosuming. I will try to rewrite your search later. Ciao. Giuseppe ... View more

Hi @bowesmana , yes correct! I always forgot it and I have to replace the command! Ciao. Giuseppe ... View more

Hi @ChrisHms , they should be in the dispatch folder, but anyway you cannot access and recognize them. Why do you want to access them? Ciao. Giuseppe ... View more

Hi @LizAndy123 , it's really difficoult to help you without having a view on the fields that you want to compare, anyway, I'll try to give you a generic answer. If ProjectID is the correlation field and Data_Security_Details is the field to check, you could run somering line this: index=<your_index> earliest=-2d@d latest=@d | eval day=strftime(_time,"%d"), period=if(day=strftime(now()-86400,"%d"),"last_day","previous_day") | stats values(eval(period="last_day")) AS Data_Security_Details_last_day values(eval(period="previous_day")) AS Data_Security_Details_previous_day BY ProjectID In this way, you can compare values of a field in two different periods. Ciao. Giuseppe ... View more

Hi @BradOH , you can do this pre-processing the CSV before ingestion or at search time using my search. I'm not sure that it's possible to apply the transformation at index time. Ciao. Giuseppe ... View more

Hi @Na_Kang_Lim , Use the "Splunk Add-on for AWS". Ciao. Giuseppe ... View more

Hi @BradOH , where did you insert the transformation to split names: in a search or where? if in search I'd use something like this: <your_search> | rename "Full Name" AS Full_Name | rex field=Full_Name "?<Last_Name>^\S+)\s+(?<First_Name>.+$" Ciao. Giuseppe ... View more