Hi, plan is to splunk all PC in network and need to know what is average usage per client for both linux and windows (with sysmon). I understand that is per case to case, but some kind of average what is? i need to know because of storage planing ... thank you ... View more

Dear, couple hours i am trying to get: i have one log with no similar way of words in one line... because of that i cannot get in one search what i need. This two searches get what i need: index=ise "authentication failed" "Administrator-Login" index=ise "authentication failed" "UserName" Now i want this two query to join in one and get results which admin login and user login have authentication failed... thank you ... View more

hi, after installing this plugin, i have errors on every search, realted to cisco or not... Always see this errors: Could not load lookup=LOOKUP-cisco-asa-action_lookup Could not load lookup=LOOKUP-cisco-pix-action_lookup Could not load lookup=LOOKUP-cisco_fwsm_action_lookup i see this search is located in /opt/splunk/etc/apps/Splunk_TA_cisco-asa/default/props.conf but not sure what need to change to fix this? thank you. ... View more

Dear, i was looking in manual and search over this board, and cannot find exactly how to put for example in alert trigger, sending email with subject which contain value from search . Situation is this: 1. backup server send email with subject and message of hostname of server which are failed. 2. Splunk read that email with imap, triger alert on specific word in email and send email. All that work fine, but those email from splunk i cannot use if i don`t have hostname in subject/message of email.. I am getting empty emails... tried couple options, but unsuccessful .. can i get some directive how proper to setup this? i tried $result.failed$ (because subject/message from backup server contain only "failed hostname.of.server") and nothing... ... View more