hi @MousumiChowdhur  depending on what services you want to collect data for, configure the inputs accordingly. https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configuretenant  https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureinputsmanagementAPI https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputs     ... View more

@MousumiChowdhur Thanks it work, but some lines are huge specially exception one, how can trim only first line of error? e.g. current output 2022-04-25 15:35:10,514 ERROR [APP] User User1 invalid: javax.security.auth.login.LoginException: User T75171 invalid at ws.loginmodule.Spi.login(LoginModuleSpi.java:356) [loginModule2-1.0.0-SNAPSHOT.jar:] at ws.loginmodule.ModuleSpi.login(LoginModuleSpi.java:172) [loginModule2-1.0.0-SNAPSHOT.jar:] at sun.reflect.GeneratedMethodAccessor1495.invoke(Unknown Source) [:1.8.0_275] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.8.0_275] at java.lang.reflect.Method.invoke(Method.java:498) [rt.jar:1.8.0_275] at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755) [rt.jar:1.8.0_275] at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195) [rt.jar:1.8.0_275] at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682) [rt.jar:1.8.0_275] ...   expected output: _raw                                                                                                                                                                                                                                          count  2022-04-25 15:35:10,514 ERROR [APP] User User1 invalid: javax.security.auth.login.LoginException        550     any idea? Thanks ... View more

Your email Id please... ... View more

Hi @MousumiChowdhury, in situations like the one you described, I usually prefer to use the Lookup File Editor app tha you can find at https://splunkbase.splunk.com/app/1724/ . Ciao. Giuseppe ... View more

you're most welcome ! please accept if it helped 😉 ... View more

Hi @lakshman239, I checked all the permissions of the user running the process. Also, the same user with same privileges is running checkpoint in some other environment. I am not facing any issue there. Can you more specific on what process that could be that needs any special permission? ... View more

You may have to look at your Asset/IPAM repository/DNS servers for the host/IP, location and other specific information, to pull all the details. When forwarders/other splunk instances connect, i believe we will have either hostname or IP, but not both in one place [ metrics/license.log etc..]. If you have nmap installed, it could help discover host/ip as well. ... View more

You should be able to trivially clone the data into the right index/sourcetype and much much more using Cribl - check out this blog post for an example of how to clone data. ... View more

It was network changes IP address were swapped. ... View more

Hi All, I have gone though all the answers and done all required changes in config but nothing will happend. Finally, I use below steps to reslove this issue. Backup your files, if exist, ex: db_input.conf and drivers Stop splunk. Remove db_connect app from app folder. Restart Splunk. Upgrade your splunk with just new version. install > db connect app check your db it will be okay now. Happy Splunking !.. ... View more

Hi, I have no access to the configuration for the splunk deployment. I am just a user so can only do stuff from the frontend. ie. Dashboard, report, search etc... ... View more

Hi @nambir , Please use the below query: host="PRODAPP1" sourcetype="iis" | timechart span=1mon count by c-ip where c-ip is the client ip address from where you are getting hits to the web server. Run the above query for last 5 months. Thank you. ... View more

Hi , Thanks for responding i have tried above but i was not able to get the result. My search result is resulting the below text in one filed.Now i want to high late the http link and if i click on that respective page should open. *Net banking is not working properly https:\xxyz.com* Thanks in advance ... View more

The Azure AD application registration (client ID and key) must have at least "Billing Reader" permissions on your subscription. Check this by going to your Azure portal and then: find your subscription click Access control (IAM) view the role assignments. If your Azure AD application is not listed there, click the Add role assignment button Select Billing Reader for the Role search for you application Click save ... View more

Hi @woodcock , Ya I could get an output field clientip for the internal host names but not external host names. Later just found that resolving any external host names is out of scope for the available name server. ... View more

Hi @LordSnooz For this purpose, I going to use the Splunk _json sourcetype default settings (It works in my case) My sourcetype name for this example will be "test" A workaround to do this would be the following: 1) Create a custom sourcetype 2) Configure your custom sourcetype (in opt/splunk/etc/system/local/props.conf) as: [ test ] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=AUTO INDEXED_EXTRACTIONS=json KV_MODE=none category=Structured description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true EVAL-my_tag = tag 3) Configure your data input (Using the sourcetype created, [ test ] in my case ) 4) Search your results index=< your_index_name > sourcetype=test my_tag="7b91119dbad4" Please try and let me know if it is working for you or not. ... View more

Try this ... | rex "batchId\s==>(?<batchId>[^=]+)==(?<batchIdBoolean>\w+)" | ... ... View more

Thank you for your help! I don't think this would work because I have so many URLs that I would not be able to write a like statement for all of them. ... View more

This question has been asked in various ways over the years and the answer in the past has inevitably been some variant of "bundle the library in your app". There are numerous reasons these solutions are problematic and I encourage you to read through some of the past answers to better understand. However, driven by the desire to solve this problem for myself, I've recently released a new app on Splunkbase called PyDen which allows a developer to create Python virtual environments of varying versions (2.7, 3.5-3.7) and install PyPI packages to them for use by other Python scripts. Scripts will run under these virtual environments instead of the built-in Python Splunk uses allowing you to leverage any version of Python and libraries you'd like. The app is still in early development and I'm looking for feedback so please let me know if it satisfies your needs! ... View more

Following is the note on Splunk Mobile App on Splunkbase: Splunk Mobile App will reach its End of Life on August 13, 2018. Contact your local sales rep for more information. ... View more

No luck in getting the data to splunk from azure? Any one getting it? ... View more

@carlosumbc, please keep in mind that we can use wildcards (*) and regex in the host and source stanzas. ... View more

Looking at this again - there's definitely a logic error that will arise at line 9, because the first_of_day and last_of_day won't pass through the stats command. But I'm not totally clear on the purpose of that line, so I can't quite figure out how to fix it. ... View more

Hi brober27, It would be better if you can provide sample logs to provide you with exact query but meanwhile you can take the reference of the below query to identify the error message with that specific error in your log. The below query is specifically for ERROR from splunk internal log. index=_internal log_level=ERROR | rex "(ERROR)\s+(?P<ErrorMessage>.*)" | stats count by log_level ErrorMessage You can add your own index name, rex and log level field name in the above search query. ... View more

Hi @raomu, You can keep the configuration DATETIME_CONFIG = blank in props.conf instead of setting it to CURRENT or NONE that will consider the timestamp of the event. For your reference https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf Thanks. Let me know if that helps. ... View more