Hello,  I see following in _raw.  However, when I run search with table or fields it does not display text within double quote despite its in _raw.  "ptp-slave" does not get displayed as a value for field title. it only displays PTP State is ptp-listeining, should be.  2022-01-25 21:47:57.047, id="12342ee7c-757e-71ec-1090-777c841f0000", version="15119", title="PTP State is ptp-listening, should be "ptp-slave"", state="OPEN", severity="CRITICAL", priority="MEDIUM", --> there are more fields after this.  How can get entire test to be displayed.  ... View more

I need to use federated search which does not support search time lookup at this time in splunk 8.2.2.1. I came across splunk doc to add fields at ingest time (index time) based on ingest time lookup.  https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/IngestLookups What I am trying to do is during event ingestion I am looking for value of field "application" and match that with the CSV file as shown below and trying to add fields APP and COMP based on application value.  e.g. if incoming event has application=Linux add APP field with value 9001 and COMP field as 8001. But it does not work.  Please help.  Here are the following files I created as documented.  more /opt/splunk/etc/system/lookups/APP_COMP.csv application,APP,COMP Linux,9001,8001 Console,9002,8002 Windows,9003,8003 more /opt/splunk/etc/system/local/props.conf  [access_combine_wcookie] TRANSFORMS = Active_Events /opt/splunk/etc/system/local/transforms.conf [Active_Events] INGEST_EVAL= APPCOMP=lookup("APP_COMP.csv", json_object("application", application), json_array("APP", "COMP")) more /opt/splunk/etc/system/local/fields.conf [APP] INDEXED = True [COMP] INDEXED = True ... View more

We have a requirement to configure splunk with the CA issued certificates. We are running Splunk 8.2.2.1. In test environment – two standalone splunk instances. In other environments –   cluster 3 node SH cluster  + SH deployer 3 node indexer cluster + CM License Master/Monitoring server Deployment Server Heavy forwarders   I tried to configure standalone server's Splunk web (8443) and splunkd (8089) using this new CA issued cert. But after I configured it for splunkd 8089 it breaks web, command line and also when I run openssl from other server it shows connected but then hangs and does not show certs. I came across following link but it was for splunk 6 and things has changed a lot since then. https://community.splunk.com/t5/Security/Custom-Certificate-for-Port-8089/m-p/362377 We also want to configure SH cluster to use CA issued cert for splunkd (8089). But I could not find doc for SH cluster. On standalone splunk instance: cat /opt/splunk/etc/system/local/web.conf [settings] httpport = 8443 enableSplunkWebSSL = 1 sslVersions = tls1.2 sslPassword = $7$1_encrypted_password_lzShn0euEM5Yi9m6pUPS38TkYu1lDDsg= serverCert = etc/auth/splunkweb/QA_Splunk_Concatenated.pem privKeyPath = etc/auth/splunkweb/QA_Splunk_PrivateKey.key cat /opt/splunk/etc/system/local/server.conf [general] serverName = xxx.test pass4SymmKey = $7$k_encryted_key== [sslConfig] #serverCert = server.pem sslPassword = $7$3_encryted_key== sslVersions = tls1.2 enableSplunkdSSL = true serverCert = /opt/splunk/etc/auth/splunkweb/QA_Splunk_Concatenated.pem #requireClientCert = false Is this correct? Also, Do I need to request separate cert for each SH member? Will this impact other communication between SH custer and indexer cluster, license master, monitoring console, SH deployer? ... View more

We are moving from one datacenter to another one which require to change IP addresses of all Splunk instances. All of these instances are running with Splunk 8.1.1 and soon will be upgraded to 8.1.3. License Master / Monitoring Console.  - Single server. SH ( non-clustered) -  Separate servers for SH1 and SH2. SH is configured with 3 indexer peers in three different regions and only one indexer will be moved at a time.  Indexer servers - separate servers for each indexer total 3.  UF  servers.  Is there any procedure/doc available. I could not find one in Splunk doc.  ... View more

I have following data file which I want to ingest as metrics data. Is it possible? Node_Name, IfIndex, date_time, ifInOctets, ifOutOctets, ifInErrors, ifOutErrors, locIfCarTrans, locIfInCRC, locIfOutputQueueDrops, locIfInputQueueDrops, IfName, IfType, IfSpeed, IfAlias server1.com,066,20190821 13:01:10,0,350782,0,0,0,0,0,0,Gi2/42,ethernetCsmacd,1 Gbps, eth6-1.1.1.1 server2.com,051,20190821 13:01:10,0,0,0,0,0,0,0,0,Gi2/3,ethernetCsmacd,1 Gbps, Gig1.6-Private-intf server3.com,111,20190821 13:01:25,0,0,0,0,0,0,0,0,Gi3/39,ethernetCsmacd,1 Gbps, ETH0 decom server4.com,003,20190821 13:01:30,15179,4690,0,0,0,0,0,0,Gi0/1,ethernetCsmacd,40 Mbps, Gi0/2.3412 : MetroE 40M Notice, data_time format is yyyymmdd HH:MM:SS format and its in 3rd column. NOT in first column. metric names are ifInOctets, ifOutOctets, ifInErrors, ifOutErrors, locIfCarTrans, locIfInCRC, locIfOutputQueueDrops, locIfInputQueueDrops remaining other fields Node_Name, IfIndex, AND IfName, IfType, IfSpeed, IfAlias need to use as dimensions. ... View more

I am not using deployment server in our environment yet. I have non-clustered search head and three indexers. If I want to create custom app where should I create it. on search head server or app server (indexer)? I have same setup in A side (primary) and B side (standby). Both active - active. A side - one search head and three app servers (indexers). B side - one search head and three app servers (indexers). I know this will consume double license but that's the requirement. ... View more

I am not using deployment server in our environment yet. I have non-clustered search head and three indexers. If I want to create custom app where should I create it. on search head server or app server (indexer)? I have same setup in A side (primary) and B side (standby). Both active - active. A side - one search head and three app servers (indexers). B side - one search head and three app servers (indexers). I know this will consume double license but that's the requirement. ... View more