Was this ever resolved without the need of Splunk Support? ... View more

Hi @bobmccoy, this surely is a very slow search, avoid to use join command, Splunk isn't a DB! let me understand: you want all the notables for the users in the user_watchlist lookup, is it correct? If tis is your requirement, you could try something like this: index=notable [ | inputlookup user_watchlist WHERE _key=* | rename _key as user asset AS src | fields user src | dedup user asset ] | where isnotnull(src) | mvexpand src | mvexpand user | dedup src user | eval user=mvindex(split(user,"@"),0) | rename src as asset | eval asset=lower(asset) Ciao. Giuseppe ... View more

Having same issue has anyone found answer on this  ... View more

Does it give more info if you remove the the /quiet switch at the end? ... View more

Make sure that when you are creating your inputs, that you are using distinct token names for each panel's input. ie. ...on the input for panel 1, use environment1 zone1 time1 ...on the input for panel 2, use environment2, zone2, time2 ...on the input for panel 3, use environment3, zone3, tme3 if the searches use the same token names, then the behavior would be as you described. ... View more

Take a look at splunkd.log in var/log/splunk/ in your Splunk folder, look for any ERROR, WARN, CRIT. ... View more

@acharlieh Agreed 🙂 ... View more

Hey bobmccoy, You need to enable the Splunk REST API and SDKs, submit a support case on the Support Portal to request access. Refer this doc: https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/User/Admintasks https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Service/SplunkCloudservice Let me know if this helps!! ... View more

yeah that is to unsecured I found I could do like this and it is working Once the Splunk App for Stream is installed on a Splunk Search Head, there will be a Splunk_TA_stream directory that’ll be created in $SPLUNK_HOME/etc/apps. Splunk_TA_stream will then need to be copied over to your windows machine under $SPLUNK_HOME\etc\apps (typically C:\Program Files\SplunkUniversalForwarder\etc\apps). From there, you’ll need to create a local directory and inputs.conf file within. Contents of the inputs.conf file should be as follows, just be sure to replace “localhost” with the hostname of the SH where the Stream app exists, and be sure to modify http/https and the port, where appropriate: [streamfwd://streamfwd] splunk_stream_app_location = https://localhost:8000/en-us/custom/splunk_app_stream/ stream_forwarder_id = disabled = 0 Then, make sure the windows machines has the outputs.conf to send data to Splunk Cloud, and restart the forwarder. ... View more

If C:\Deployments\xxxxxx-Web\LogHtml is the directory name and xxxxxx-Web_xxxxxx-Web_2018-03-05_05-06-57.html is the file name, your monitoring stanza should be like this [monitor://C:\Deployments\*-Web\LogHtml\*-Web_*.html] ... View more

We have the same problem in the APAC area. Waiting on a meeting to finish and information to come out of that. ... View more

If you edit the lambda function code as follows: Find const SplunkLogger = require('./../../../../../splunk-cloudwatch-logs-processor/lib/mysplunklogger'); and replace with const SplunkLogger = require('./lib/mysplunklogger'); I just tried on a test instance and that worked. ... View more

,I am also looking for something like this? Did you get it working? ... View more

I am having this same issue. A handful of servers resolve the correct host name and most give ip [udp://:514] connection_host = dns sourcetype = syslog disabled = 0 index = main no_appending_timestamp = true ... View more