Hi , I am facing the same issue and found this thread. Was the issue resolved ? Can you let me know the fix please if this is working for you now. Thanks ... View more

I managed to add extra python modules to Python for Scientific Computing by building it from source. In my case I added xgboost for Linux (64-bit) Cloned the GitHub repo: https://github.com/splunk/Splunk-python-for-scientific-computing Just for increased stability I checked out the latest available git tag (currently 4.2.1, this step might not be necessary) I then added in environment.nix.yml the python module that I want (in my case: - xgboost=2.1.1) Afterwards, followed the readme and run: make freeze make build make dist Finally copied the tarball from the build directory to the user_apps directory on Splunk (substituting the existing Python for Scientific Computing app if already installed). When using Python for Scientific Computing copy the exec_anaconda and util python scripts to the bin directory of your app. Also copy the lib/splunklib from Python for Scientific Computing to the bin directory of your app. Add these lines to the start of your script:   import exec_anaconda exec_anaconda.exec_anaconda()     ... View more

@damodeI have the same issue in a Windows machine after changing Splunk from Local account to domain account. Did you find a solution? ... View more

@robnewman666  A new TA "Add-on for SharePoint API with AWS Integration" has been released @ Add-on for SharePoint API with AWS Integration | Splunkbase   ... View more

This is a very old thread. You can get more visibiliy by starting a new one instead. But to the point - all those files are relevant. Splunk builds a single configuration version from various files in its directories according to precedence rules - https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Wheretofindtheconfigurationfiles   ... View more

I had the same issue, for me I was using a vpn which splunk oculd not reach the right host, if oyu are using a vpn as well just disconnect from it and try again. Hope it will help someone! ... View more

I just posted an "idea" for the return command to be able to do what you would like it to do. https://ideas.splunk.com/ideas/EID-I-532  The following is your command, rewritten with a rex command that should create a simple boolean expression from one subsearch.   (index=winsec sourcetype="WinSecurityEvent") OR index=DNS [ search sourcetype="dns" "specific urls" | dedup src | return 100 src_ip=src OR query | eval search = if(len(search)<3, "NOTHING FOUND") | rex mode=sed field=search "s/ (OR|AND|NOT)=\"\" / \1 /g" ] ) | dedup accountname | stats values(accountname) AS accounts | table query, src_ip, accounts     The string in the eval command should be changed to something that will never be found.  Depending on the use, perhaps "index!=*" might be more efficient.  Otherwise, if nothing is found then the search will return an empty string that matches all events. This may be desired, in which case the eval statement should be removed.   ... View more

If we are talking about removing the hosts which are labeled as "missing" from MC>Forwarders> Forwarders Deployment then we are able to rebuild the Forwarders Asset Table to remove decomm'd host from the dashboard/ report.    https://docs.splunk.com/Documentation/Splunk/8.0.4/DMC/Configureforwardermonitoring#Rebuild_the_forwarder_asset_table ... View more

I can't reproduce the issue. I follow the link, I log in, and I can see the downloads available. When you follow the link and log in, you get only a partial page? What browser/OS/region are you in? (me: Chrome/MacOS/USA) ... View more

It is my pleasure .. ... View more

Hi Hunter, Thanks for your quick answer, and correct clarification. My confusion was a result of there being TWO ossec config files: 1) ossec-hids-2.8.3.tar.gz -> installs ossec itself 2) splunk_add-on-for-ossec_401 -> installs Splunk_TA_ossec, for ossec/Splunk integration. I had just missed the second one. David ... View more

Try like this your current search giving fields Device_Id, Location_Id, Start_Date, End_Date | eval Date=mvrange(strptime(Start_Date,"%d/%m/%Y"),strptime(End_Date,"%d/%m/%Y")+86400,86400) | mvexpand Date| eval Date=strftime(Date,"%d/%m/%Y") | table Date, Device_Id, Location_Id You now go a row for each date from Start_Date to End_Date, including End_Date and you can do your evaluations. ... View more

Thank´s for your quick answers. ... View more

I downvoted this post because did not address question ... View more

Hi hunters, thanks for your reply. I was concerned that the free Test/dev license is considered the same as Splunk Free. I will try to look at other issues that may be preventing the indexing. Thanks again!! NAMjp ... View more

Ugh well the formatting kinda sucks but hopefully you can get the idea..... ... View more

If u r spanning Per day wise use min(_time) for first time ad authentication and max(_time) for recent/last time authenticated time. ... View more

Thanks Hunters & Dal. Will try. ... View more

Thanks. It works. The Splunk forwarder instance does not crash now. However, the data does not get pushed to indexes because of the following issue. 01-22-2017 22:29:42.914 -0500 WARN FileClassifierManager - Some automatic additions to the learned app were squelched by learned_sourcetype_limit (1000) in limits.conf: some squelched sourcetypes: filename=/1481425575 st=1481425575 ; Use sourcetype rules in input stanzas or source:: rules in props.conf to control sourcetype assignment ... View more

Hi user4455, Seems that your search is returning data very slowly, which shouldn't be the case with accelerated data models. You can run the following search to see how many events your search is scanning. | tstats count from datamodel=<your_data_model> by http_status_code | sort -count Also, try this command that generates results from the TSIDX data automatically generated by the acceleration, unsummarized data is not included: | tstats count from datamodel=AccButtercup_Games_Online_Sales summariesonly=t Hope this helps. Thanks! Hunter ... View more

In your search add this near the end: ... | eval date_zone=if((date_zone="+0900", "KRW", date_zone) ... View more

Thanks! I was mainly just curious but am also interested in use cases where Splunk is used as a backend for web application features. For example, if someone is already using Splunk to provide the audit log for an application, I wonder how practical it would be to provide a security-trimmed view of that data to authenticated end users. We do this for certain internal end users but not at large scale. At scale, would a SHC and indexer cluster deliver adequate reliability? Would the unpredictable load be a nightmare? I figured Splunk Answers might have gone down this road already. I think the thing I would be most concerned about when delivering search results to non-employees is the risk of having rogue data in an index. Splunk doesn't seem to have the concept of index-level security on the input side except when using HEC, but almost all environments will have open forwarding ports as well. Dedicated indexer cluster may be the way to go. Thanks for the info! ... View more

Hi vijaydudipala88, Yes, queries can contain the "search" keyword and accessed through REST endpoints. For details, see: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTsearch The API supports token-based authentication using the standard HTTP Authorization header. This is the recommended method to programmatically access resources. For details, please refer to documentation here: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Authentication_and_authorization Hope this helps. Thanks! Hunter ... View more