@sivaranjiniG  Visit Splunk Education https://education.splunk.com/  and navigate to "My Current Learning" to view all your certifications. If you encounter any issues, refer to the details below and reach out to Splunk for assistance. Official Help/Support: certification@splunk.com Education Education_AMER@splunk.com Education_EMEA@splunk.com Education_APAC@splunk.com Accreditation accreditations@splunk.com   ... View more

Hi @cadrija, I’m a Community Moderator in the Splunk Community. This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

Hi or is it possible to use this example with REST query and cURL on cli? https://community.splunk.com/t5/Other-Usage/Why-can-t-I-change-alert-with-REST-It-change-permission-from-app/td-p/646456 r. Ismo ... View more

Another remarks. You shouldn't ever install any additional module directly into Splunk's python! If there is something what you are needing, then create on app (see dev.splunk.com) and add those libraries under it. ... View more

Hi If you have some fields with and without the ., below is an example of how to get that to work. However it only works going into an event index, it does not seem to work going into metrices. [test_abc_transforms] CLEAN_KEYS = false DELIMS=, FIELDS=degraded.threshold,down.threshold [drop_header] REGEX = metric_timestamp,metric_name,_value,degraded\.threshold,down\.threshold DEST_KEY = queue FORMAT = nullQueue     metric_timestamp,metric_name,_value,degraded.threshold,down.threshold 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300   ... View more

Hi you can use CLONE_SOURCETYPE to clone same event to the different sourcetype. You should remember that  it duplicates your license usage! https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf r. Ismo ... View more

As far as I remember, the automatic json extraction (contrary to the spath command) does not care about attributes hierarchy. ... View more

Thanks for the reply, but i need to use props and transforms either index or search time extraction  ... View more

That isn't index-time, but ok, a REPORT based solution might still be preferred over spath in the query. Except for the fact that json is way to complex to parse with such a simple regex. It doesn't support nesting, it doesn't support arrays: https://regex101.com/r/PJQJp7/1 This would work a bit better already: "([^"]+)":\s*("[^"]+|\[[^]]*\]|\d+) https://regex101.com/r/u8hgTB/1 But that also doesn't extract json the way Splunk's auto extraction would. My solution does take content of nested structures, but without retaining that structure, it just captures all the 'leaves' in the json tree. ... View more

Short answer is don't do that. Longer answer is - I recognize auditd logs and these are indeed four different events (they are independently emmited by auditd). Yes, they may be related to a single user's operation (for example - launching a new process), but they come from four different auditd rule actions. You should keep them as separate events and you can use transactions of other forms of search-time trickery to group them when searching. ... View more

This is not possible at UF. Please use indexer to do this. This will not affect the license.   https://community.splunk.com/t5/Installation/Filter-Indexing-to-Avoid-License-Issues/m-p/91903 ... View more

Yes, it is possible in UF that you can enable a UDP/TCP port and start receiving logs from network appliance. Check the firewall communication between network devices -- > UF --> Indexers. ... View more

You could count length of all event together and get some kind of estimate for volume. But the best/only real way is to use internal index where splunk stores that information. ... View more

Okay. Thanks for your response. I have multiple monitor stanzas in my inputs conf file..So you are saying this mistake i made in one stanza will not affect other stanzas..data will still sent to indexer? ... View more

I never have got data in indexer before deleting fishbucket so i thought it didnt read log file..moreover i didnt see any crc related issue in splunkd log..i am not sure how to find out these types of issue in splunkd log ... View more

The IN operator is translated into ORs before the query executes.  So   index IN ("indexA*","indexB*")   becomes   index "indexA*" OR index= "indexB*"   ... View more

Instead of the original command: sourcetype=access_* action=purchase The following command worked for me: index=main sourcetype=access_* action=purchase,Write index=main in the start of the command. The below command works for me: index=main sourcetype=access_* action=purchase instead of the original one: sourcetype=access_* action=purchase ,Write index=main in the start of the command. then it works for me. ... View more

If you mean to SAI: https://splunkbase.splunk.com/app/3975/ then the purpose of this app is to monitoer your enterprise systems the Monitoring Console AKA MC / DMC is there to monitor your Splunk environemnt ... View more

No. I don't think the values for access can accept anything other than "*" OR actual roles. Do you need to exclude access to one particular role for all the dashboards or just one dashboard? If its later, it could be easier to implement access rules only for that dashboard. Do you really need those many roles? if your roles follow a pattern or hierarchy/inheritance, you can use the lowest role for access:read ( so any role inheriting will have access as well). ... View more