Hello, what would you do to track log changes, maybe using "punct" field? Thanks for your help! ... View more

Hello, since upgrade 9.4.11 from 9.3.0 getting error 500 on splunkweb using local user (works with admin account). The user works fine from CLI using API but I wanted to try a query on splunkweb.     Exception observed is:   TypeError: 'NoneType' object is not subscriptable   File ".../util.py", line 1761, in should_use_app_bar_performance_optimizations optimize_app_bar = splunk_web_optimizations_settings["enable_app_bar_performance_optimizations"]   Tried to recreate same role with limited capabilities and user on another platform and working fine, on same version.   /OPT/splunk/etc/system/local/authorize.conf [role_monitoring] get_diag = enabled get_metadata = enabled get_typeahead = enabled rest_access_server_endpoints = enabled rest_properties_get = enabled search = enabled srchIndexesAllowed = _*;linux;oxygene_cmdb;windows srchJobsQuota = 9 srchMaxTime = 1800 srchTimeEarliest = -1 srchTimeWin = -1     Thanks. ... View more

Hello, looks like the new ping command is conflicting with ping of Splunk Enterprise Security "SA-ThreatIntelligence" ... View more

Hello, a quick note from support to explain how events are handled on HEC (on HF for instance) : https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.3/get-data-with-http-event-collector/http-event-collector-rest-api-endpoints   Event endpoint:   The event is pre-structured JSON — event boundaries are defined by the JSON structure itself   LINE_BREAKER and EVENT_BREAKER settings in props.conf do NOT apply because the JSON payload already defines what constitutes an event   However, other props. conf/transforms.conf rules from a TA will still apply if the sourcetype matches — specifically index-time transforms (field extractions, routing, etc.)   The sender controls metadata (host, source, sourcetype, index, time) directly in the JSON payload, and individual events in a batch can override token defaults independently     Raw endpoint:   Data is treated as raw, unstructured text — just like file-based inputs   LINE_BREAKER (regex-based) and EVENT_BREAKER (intelligent breaking) rules from props.conf fully apply for the assigned sourcetype, matching the behaviour of file-monitored inputs   The sourcetype is determined by the HEC token configuration, not the payload   If a TA installed on the HF has props.conf rules matching that sourcetype (e.g., SHOULD_LINEMERGE, TIME_FORMAT, INDEXED_EXTRACTIONS), those rules will run at index time   For batch raw JSON events, props.conf must be configured correctly — e.g., INDEXED_EXTRACTIONS = json for JSON arrays, or SHOULD_LINEMERGE = false for line-delimited events   A TA typically ships two types of config:   props.conf / transforms.conf (index-time rules) — These apply on the HF only if the sourcetype of the incoming HEC data matches stanzas in the TA. With /raw, the full parsing pipeline runs (line breaking, timestamp parsing, field transforms). With /event, only the transforms/field extraction rules apply — not line breaking.   ... View more