Hi @tatdat171 , I am using python modules which are shipped with Splunk Enterprise so to use my script you need Splunk Enterprise as well (you don't need to start/run Splunk Enterprise locally). ... View more

Hi @tatdat171 Script which I have created is not out of date. It still works for On-prem and SplunkCloud. I would like to know which functions didn't work for you. Thanks, Harshil  ... View more

It depends, if you have sourcetype which is using INDEXED_EXTRACTIONS then those data goes through StructuredParsing pipeline which means datetime parsing happen on UF. See https://wiki.splunk.com/Community:HowIndexingWorks (4. Detail Diagram - UF/LWF to Indexer) ... View more

You can't configure different MAX_TIMESTAMP_LOOKAHEAD. Have you tried datetime.xml which I have provided? ... View more

Can you please try below config in datetime.xml?   <datetime> <define name="_house" extract="day, litmonth, year, hour, minute, second, subsecond"> <text><![CDATA[house.*\[(\d{2})/(\w{3})/(\d{4}):(\d{2}):(\d{2}):(\d{2})\.(\d+)\]]]></text> </define> <define name="_battle" extract="year, month, day, hour, minute, second, subsecond, zone"> <text><!CDATA[battle.*\[(\d{4})\-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})\.(\d+)(\+\d{4})\]]]></text> </define> <timePatterns> <use name="_house"/> <use name="_battle"/> </timePatterns> <datePatterns> <use name="_house"/> <use name="_battle"/> </datePatterns> </datetime>     ... View more

I have not gone through regex in details but I can see that in your datetime.xml, you don't have <datetime> and in props.conf you have defined defaults however you have directory called default ... View more

Hi, When you say parsing on search heads, do you mean search time extraction is not working on Search Heads for Bluecoat logs ? ... View more

Hi, What is your splunk web port, default 8000 ? Generally I have seen that selinux is not causing any issue with splunk but if you are using some other ports which is not allowed by selinux then it may create problem. ... View more

Hi, Looks like you are using very old version of SC4S, please use latest version. ... View more

It looks like you are using Python to push data in Splunk via HEC, can you please let us know which python modules are you using? ... View more

That is correct, do you have below configuration in inputs.conf on HF/IDX ? [tcp://....]   Are there any other systems sending logs to HF/IDX? ... View more

Are you sending logs from Windows UF to Indexer on port 9997 ? ... View more

I'll not recommend it, I'll recommend you to write better search. ... View more

I didn't get you.   If you want to check summary index configuration then look at scheduled search configuration. ... View more

It looks like you are sending traffic from Splunk UF to Indexer/HF on TCP port not on splunktcp port. Can you please share inputs.conf from HF/IDX whoever is receiving data from UF (Mask any sensitive data) ? ... View more

Any index can be summary index. For example (below scenario are valid): Schedule_search1 is ingesting summary data in index1 Schedule_search2 is ingesting summary data in index2 Schedule_search3 is ingesting summary data in index3 OR Schedule_search1 is ingesting summary data in index1 Schedule_search2 is ingesting summary data in index1 Schedule_search3 is ingesting summary data in index1 ... View more

Hi, In Splunk summary index is not any special index, you can summarize data in any index which exist in splunk. To find out whether any schedule searches have summary alert action enabled then you can use below search on search head to find out those scheduled searches. | rest /servicesNS/-/-/saved/searches splunk_server=local f="action.summary_index" f="action.summary_index._name" f=disabled f=title | rename action.* as * | where summary_index=1 AND disabled=0   ... View more

Hi,   Have a look at conf session https://conf.splunk.com/files/2019/slides/FN2048.pdf about Multi-Deployment Server ... View more

You need to modify schedule search permission who is generating this result, if you don't have permission then you need to ask Splunk Admin. ... View more

I am confused now, JSON events which was not extracting fields at search time is working now ?? ... View more

For me it is working with Field Extraction and Field transformation. Main things you need to keep in mind that your sourcetype must have KV_MODE = json otherwise below configuration will not work. Used your regex but removed starting \" Regex: (?<protocol>\w+)\s[rR]equest\D+(?<src>[^\:]+)\:(?<src_port>\d+) to (?<dest>[^\:]+)\:((?<dest_port>\d+))?\.\sAction\: (?<action>\w+)\.(?: Rule Collection\: (?<cat>\w+)\. Rule\: (?<rule>[^\"]+))?   Field Transformation Field Extraction ... View more

Please provide more details like what you configured for Metrics and in which Metrics are you interested? ... View more