I think something like this would work: SEDCMD-turnthismotherout = s/(?:^-+[\n\r$])(?:.+?[\r\n])(?:^-+[\n\r$])//g ... View more

Can you provide an example? ... View more

Search heads need space too, for things like search artifacts: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Dispatchdirectoryandsearchartifacts You should check to see where the disk space is being used, and to make sure that your search head is in fact forwarding events to the index tier. ... View more

Command line sed is not the same as Splunk's SEDCMD command. The regex would need to be modified. On a mac that would look something like like: sed -E "s/(password_new(_confirm)?\\\\?\":\\\\?\\\\?\s*\")([^\\\"]+)/\1xxxxxx/g" < test.txt ... View more

According to some of the HEC folks, even /event endpoint still engages the regexreplacement, just not the line breaking and timestamping processors. But this reaaaally needs to be documented. ... View more

If I guessed right at your invite, it's been resent. ... View more

Just a note that 7.3 adds the ability to have negated CIDR in tstats. ... View more

Hey there, The signup process is not automated. It is reviewed on a frequent basis (usually once a week, but people are people). That means that the signup is not instant, but you should receive an invite within two weeks. One problem that can occur is if you have an exiting invite which has already been sent in the past, the system will not resend the invitation, so you may need to search older emails to see if you have a pending invitation. Thanks, Dave ... View more

Didn't know that. This post is solid gold! ... View more

This is a fantastic post. The only thing I would add is that the regex_cpu_profiling was added in 6.6. Thanks! ... View more

My version is saying "anything that isn't a quote character, repeated one or more times". Once it hits that first quote, the match stops, and then we add another quote to match it. This is stricter than the other version, which would keep capturing until it hit the final quote. HTH! ... View more

We only include the inputs.conf. ... View more

I know this is late, but it could help others: If you have the Splunk Add-on for Windows installed, you will get two fields when looking at 4720 events, the user and the src_user . In the context of this event, the src_user is the user creating the account and the user is the user being created. Note that per the Common Information Model, this isn't correct, and you would expect the user to be the user creating the action and the user being created should be in a field named object . So, in this case, the TA is incorrect. HTH, Dave ... View more

Those are searches for report acceleration. If you get the "savedsearch_id" field from the results it will give you the name of the user and the app, and the "search_type" field will tell you the type of acceleration. ... View more

As a self plug here, I work for a company called Aplura. We are based outside of Baltimore, and I am sure we would be able to meet your needs. We regularly deliver Professional Services as well as longer term O&M. We can be found at https://www.aplura.com. Thanks! ... View more

You shouldn't this is the only correct answer at the moment. Tstats is not CIDR aware for WHERE clauses. ... View more

tstats is not CIDR aware for where clauses. Sorry 😞 ... View more

in this case, the impact is that the events will be larger, and the errors will go away. Generally, adjusting that value will allow for larger events. If your linebreaker is wrong, and you allow jumbo events, the possibility exists that your indexers/HFs will become unhappy. ... View more

Are the items that you want to separate the data by available in the data? That is, are the hostnames in the eventdata itself? ... View more

You should still do a reload. I've gotten this error before and have found that it helps if you specify the class that you made adjustments to: ./splunk reload deploy-server -class newclass I would also suggest that you open a support ticket, because I believe this is a bug. ... View more