I think something like this would work: SEDCMD-turnthismotherout = s/(?:^-+[\n\r$])(?:.+?[\r\n])(?:^-+[\n\r$])//g ... View more

Can you provide an example? ... View more

I added an issue to the github repo to cover this: https://github.com/automine/TA-cisco_acs/issues/1   ... View more

Splunk Cloud only supports Splunk2Splunk communication using TLS. If you need to get general TCP data in, you would need to have a forwarder on-premises that has the TCP input, and then forward those events to Splunk Cloud. ... View more

Search heads need space too, for things like search artifacts: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Dispatchdirectoryandsearchartifacts You should check to see where the disk space is being used, and to make sure that your search head is in fact forwarding events to the index tier. ... View more

Command line sed is not the same as Splunk's SEDCMD command. The regex would need to be modified. On a mac that would look something like like: sed -E "s/(password_new(_confirm)?\\\\?\":\\\\?\\\\?\s*\")([^\\\"]+)/\1xxxxxx/g" < test.txt ... View more

According to some of the HEC folks, even /event endpoint still engages the regexreplacement, just not the line breaking and timestamping processors. But this reaaaally needs to be documented. ... View more

If I guessed right at your invite, it's been resent. ... View more

You mean props.conf , correct? ... View more

Just a note that 7.3 adds the ability to have negated CIDR in tstats. ... View more

Hey there, The signup process is not automated. It is reviewed on a frequent basis (usually once a week, but people are people). That means that the signup is not instant, but you should receive an invite within two weeks. One problem that can occur is if you have an exiting invite which has already been sent in the past, the system will not resend the invitation, so you may need to search older emails to see if you have a pending invitation. Thanks, Dave ... View more

I haven't tried that particular setting. ... View more

Didn't know that. This post is solid gold! ... View more

This is a fantastic post. The only thing I would add is that the regex_cpu_profiling was added in 6.6. Thanks! ... View more

My version is saying "anything that isn't a quote character, repeated one or more times". Once it hits that first quote, the match stops, and then we add another quote to match it. This is stricter than the other version, which would keep capturing until it hit the final quote. HTH! ... View more

The "Details" section of the app listing on Splunkbase lists which dashboards are mapped to which data model. Scroll down to the "Control Dashboards" section. In terms of getting data into the data models, you may find these useful: Common Information Model Add-on docs on using the tables in the documentation Aplura's Data Onboarding Cheat Sheet ... View more