I created a Splunk Macros for regular expressions for IPv4 and IPv6 addresses. Definitions and usages are in an article below. https://qiita.com/Joh256/private/659ef65897905890ef99 I also put them in an add-on below. https://splunkbase.splunk.com/app/6595   ... View more

I would suggest trying Streaming XML plus app available on splunkbase. ... View more

@_gkollias It looks like you are trying to process EDI data.  We do have a solutions accelerator for EDI, we can share.  Are you interesting in learning about it?  Love to set-up some time to share what we have. ... View more

This is a 10 years old thread. It's doubtful you get much help here. I see you posted another thread. Just add more details to that thread if needed. ... View more

Great, thanks 👏👏👏 I took my way, doing so,   |eval earliest_epoch="$time.earliest$",latest_epoch="$time.latest$" |eval earliest_epoch=case(isnum(earliest_epoch),earliest_epoch,earliest_epoch=="now",time(),"earliest_epoch"="",0,true(),relative_time(time(),earliest_epoch)) |eval latest_epoch=case(isnum(latest_epoch),latest_epoch,latest_epoch=="now",time(),true(),relative_time(time(),latest_epoch))     ... View more

Anyone who comes across this issue please up vote the following idea for a configuration option to disable INDEXED_EXTRACTIONS via an app's local props.conf. https://ideas.splunk.com/ideas/EID-I-2400 ... View more

I had the same problem on a UF, checking the sourcetype props I noticed that there were magic 6 on the agent. After deleting them, the collection works again. ... View more

Here are the latest props.conf setting at 9.2.1 on the universal forwarder:  (json file parsing works g8 with this option) EVENT_BREAKER_ENABLE = <boolean> EVENT_BREAKER = <regular expression> LB_CHUNK_BREAKER = <regular expression> force_local_processing = <boolean>  * new * Forces a universal forwarder to process all data tagged with this sourcetype locally before forwarding it to the indexers. * Data with this sourcetype is processed by the linebreaker, aggerator, and the regexreplacement processors in addition to the existing utf8 processor. * Note that switching this property potentially increases the cpu and memory consumption of the forwarder. * Applicable only on a universal forwarder. * Default: false ... View more

You should use the timestamp after the host name like this:   TIME_PREFIX = [^,]+, MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %Y/%m/%d %H:%M:%S   This will pick this part, in bold: Nov 25 15:00:37 192.168.96.13 Nov 25 15:00:37 PA-Primary.abc.abc.com 1,2014/11/25 15:00:36,0011C100738,TRAFFIC.....   ... View more

Getting direct download is deprecated on splunk 9.X?  The app_exporter has many issues, but the biggest one is that it no longer works in splunk cloud as far as I can tell.  ... View more

Super old topic, but shocking that it seems Splunk hasn't brought this functionality into the product. Would you be open to sharing the modifications you made to incident_review.js?   Thank you ... View more

Hi , How long after did you get the results ? ... View more

Hi,  I script something by myself and I want to share it with you.   https://github.com/Gotarr/Splunkbase-Download-script  (python-script) My Inspiration is from @tfrederick74656  but his script dosnt work for me very well.   Happy splunking and let me know if something dosnt work.   ... View more

Hi, looks nice, thanks. ... View more

Thank you all for this thread!   I've been working on Splunk for close to 10 years and JUST ran into this today for the first time and thought I was losing my mind because I can't find any record of etc/system/default/deploymentclient.conf on any of my systems.     Thank you for confirming that I'm not the only one thinking this is really, really weird but seems "normal"   ... View more

So I have a stand alone splunk instance with only data that is imported from botsv3 and I used these instructions for  Adjusting Splunk memory in settings: You can allocate more memory to Splunk by adjusting the settings in the limits.conf file. Locate this file in the Splunk installation directory and modify the max_mem setting to allocate more memory. This file typically resides in SPLUNK/etc/system/local/limits.conf.  I changed max_mem = <new value>MB And so far changing the max_mem from the original 200 mb to 6,144 mb to make it 6gb for splunk to use, it seems like I do not have the bad allocation issue anymore. I will continue monitoring for the error and update my comment if I run into the bad allocation error again. This solution may not work for everyones specific situation especially since you may enter an organization and the memory allocation has already been configured and you may not have permissions to change any configurations but if you are working just with a home lab and you are making your own configurations as the splunk admin this is a good place to start. Since none of the solutions seem to actually provide steps on how to make the actual adjustments for people that are learning I figured I would include some descriptive steps to this discussion so people can contribute their expertise for people that are learning. Please build on the discussion with actionable steps instead of replying that this solution may not work so people can actually learn what the solution steps are. ... View more

i got the results with below query index=_audit action="search" search="*" NOT user="splunk-system-user" savedsearch_name="" NOT search="\'|history*" NOT search="\'typeahead*" | rex "index=(?P<myIndex>\w+)\s+\w+=" | stats count by myIndex ... View more

`macro1("my_parent()")` works because the parenthesis is inside of the double quotes. `macro1(my_paren())` does not work because there is no double quotes around it. ... View more

A while back I noticed the "endpoint" setting in the "serverclass.conf.spec" which *probably* could be used to create a functional Windows-based DS by directing the clients to retrieve the files from a non-Windows repository such that file modes are preserved: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverclassconf ... View more

Any ideas of how this needs to be adjusted for Splunk Cloud where edit_tcp is not allowed?    I've got a case where something is working under a role with sc_admin capabilities but I don't want the role is should really run under to have everything that is capable of.  Documentation is sparse ... View more

You can use something like below Index=*  earliest=-1w@w6 latest=now() | search errors*  ... View more

There is actually one more possible issue - when using a remote Indexer. You need to enable replication of KVStore lookups by added to <app>/local/collections.conf:   [<automatic_lookup_name>_kvstore] replicate = true   ... View more

https://www.splunk.com/blog/2015/04/13/how-to-edit-notable-events-in-es-programatically.html Hi, this link is not working anymore.  ... View more

@santhoshi  Is your issue fixed. Can you please share solution if it is fixed. Thanks. ... View more