dont post wrong answers to delete all the data ... View more

Hi At least on my 9.1.0 MC shows pop up list for possible instances, where you can limit queries to those. The default is indexers, but for some reason (bug?) it didn't limit that search for those! But fortunately you could use search and REST for it. Just add/switch this to your previous REST    splunk_server_group=dmc_group_indexer   This dmc_group_indexer should be defined on your MC as a default for all instances which have indexer role checked on General Settings. If needed you could create own groups too which you then could use on different screens on MC. r. Ismo  ... View more

Hi, we are having a similar issue, have you managed to solve it? We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes? ... View more

What should be modified in the search to display the events in Verbose mode ... View more

This Worked for me as well.  No need to give admin_all_objects permission! Splunk V. 8.2.5 ... View more

Hi @SinghK , I go to DataLab > Lookups > New Lookups, Step 1:  Set Reference Search with time range : results as expected Step 2: Set Lookup SQL: results as expected Step 3: Field Mapping: - Search Fields Match Table Columns (case sensitive) - Lookup Fields: Table columns chosen Preview Results: (...) | dbxlookup connection="Pro_DB" query="SELECT TOP(1000) [SID] , [LogTime] , [DocID] FROM [Storage].[dbo].[DocStates] ORDER BY [LogTime] DESC" "SID" AS "SID" OUTPUT "LogTime" AS "Log_Time", "DocID" AS "Doc_ID" Then I clicked on "Open In Search", only the SPL query returns result, but the dbxlookup fields are all blank. Tks Louis   ... View more

dbxlookup doesn't seem to work when I tried to run. The query doesn't provide any outputs when I clicked Open in Search in Data Lab/ Edit Lookup page. Both my reference search and Look SQL are working, and provide correct results when running separately. ... View more

I am using v1.1.3, and I still have problems to ingest data to Splunk 8.2. Hope it would be compatible soon. ... View more

This error is raised in version 4.1.3 too. I have changed the inputs.conf and restmap.conf to python2, but it doesn't work Splunk: 7.7.3 Python: 2.7 ... View more

Thanks, this worked for me.   Had to add stanza, as it was not in default\phantom.conf   [verify_certs] value = false ... View more

@pkarpushin I have a similar use case but I need the two-level of row expansion, The first expansion is on main row and the second expansion is on the expanded row.  Is this possible? Please assist! ... View more

The answer is shown in this post: https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-and-Linux-configuration/td-p/366783 You need to installed Splunk_TA_nix on all indexers/forwarders and searchhead. The search head needs Splunk_TA_nix to display data. Tks Louis. ... View more

Can your Fortinet FW send to HEC? ... View more

Hi @louismai, If you are getting any unseen or special character in field stime_from. It is better to replace all non alphanumeric characters in the field values and then convert to epoch like below. | eval time_from = strptime(replace(stime_from, "[\W]+", ""), "‎%Y‎‎%m‎‎%dT%H%M%S%N") Examples: | makeresults | eval stime_from="‎2020‎-‎03‎-‎04T‎23:01:58‎.500000000Z", time_from = strptime(replace(stime_from, "[\W]+", ""), "%Y%m%dT%H%M%S%NZ") ... | makeresults | eval stime_from="‎2020‎-‎03‎-‎04T‎23:01:58‎.500000000", time_from = strptime(replace(stime_from, "[\W]+", ""), "%Y%m%dT%H%M%S%N") ... View more

When I run a script in PowerShell on the same user, the PowerShell script returns a non-null value, while the app Active Directory still receives null value. It is very strange. Tks Louis ... View more

Hi louismai, it isn't a best practice to use Indexers to ingest syslogs, especially an Indexer Cluster because during maintenance it's possible to have both the Indexers in stand by so you could loose syslogs. The best practice is to use two Splunk Heavy Forwarders (that are full Splunk installations where all the logs are forwarded to Indexers) and a Load Balancer that in normal run balances logs between indexers and in fail or maintenance Indexers condition sends logs to the active Indexer and eventually caches (if both Indexers are down). These servers can be virtual servers without great configurations (e.g. 4 CPUs and 8 GBs of RAM). If you haven't a Load Balancer, you can use a DNS setting as a Load balancer. Ciao. Giuseppe ... View more

We have this issue again when we are upgrading to 7.3.3 to fix timestamp issue: The percentage of small of buckets created xx over the last hour is very high and exceeded the red thresholds (xx) for index=xxxxx, and possibly more indexes, on this indexer I wonder if we can search for the source/host the time is not correct, so we can fix it. We have about 1200 forwarders. TKs Louis. ... View more

I read a similar post, and followed them. https://answers.splunk.com/answers/172847/ldapfilter-is-giving-me-error-missing-required-val.html If you only have 1 domain, you can change that to default. It seems a work-around. local/ldap.conf [default] alternatedomain=DOMAIN basedn = dc=domain,dc=net binddn = svc_splunk_ldap server = ausdadc01.domain.net ssl = 0 port = 389 ... View more

This works well. I place it in the teardown function: teardown: function($container, rowData) { var that = this; that._tableView=null; var search_idCell = _(rowData.cells).find(function (cell) { return cell.field === 'Login Name'; }); mvc.Components.revokeInstance(search_idCell.value); }, ... View more

index=_internal source=metrics.log group=udpin_connections |timechart avg(udp_kbps) max(udp_kbps) span=5m UDP is similar. But UDP has _udp_bps=25434.085277542734, _udp_kbps=24.837973903850326, _udp_avg_thruput=15.692977114824794; so we might not need to do calculation. ... View more

https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Configurationfilechangesthatrequirerestart This works for me. ... View more