I currently have the M1 mac & I have recently downloaded Parallels to utilize Ubuntu. I'm in the process of of installing splunk, but anytime I use these two commands:   sudo /opt/splunk/bin/splunk enable boot-start sudo /opt/splunk/bin/splunk start --accept-license    I receive this error   /opt/splunk/bin/splunk: 9: Syntax error: "(" unexpected   Also when i run the uname  -a command. this is the output:   Linux ubuntu-linux-20-04-desktop 5.4.0-66-generic #74-Ubuntu SMP Wed Jan 27 22:56:23 UTC 2021 aarch64 aarch64 aarch64 GNU/Linux    Has anyone had this problem? How can i resolve this? ... View more

I'm currently trying to create a search that look for employees hired within the last 3 months, but I keep getting all of the results. Here's the code:       | where _time >= relative_time(now(),"-3mon") | eval HR_STATUS=case(CGH_RITS_EMP_STAT="TE", "Terminated", CGH_RITS_EMP_STAT="AC","Active",CGH_RITS_EMP_STAT="LE", "Leave of Absence", CGH_RITS_EMP_STAT="PA", "Paid Leave of Absence", true(), "Other") | eval TYPE=case(CGH_RITS_EMP_CODE="E", "EMPLOYEE", CGH_RITS_EMP_CODE="C","CONSULTANT", true(), "Other") | eval Date=(strptime(ORIG_HIRE_DT,"%Y%m%d")) | eval Hire_Date=strftime(Date,"%m/%d/%Y") | table CGH_SOE_ID, FIRST_NAME, LAST_NAME, JOBTITLE, TYPE, EMAIL_ADDR, Hire_Date, ORIG_HIRE_DT, HR_STATUS | rename CGH_SOE_ID AS SOE_ID, EMPLID AS GEID | sort Hire_Date         ... View more

I'm trying to search between 2 indexes that correlates field value to return back certain fields. For example index a has the fieldname named src_ip and index b has a fieldname named src. The values are the same, but the fieldname are different. I want to use these values to correlate the data, but I want to also return field names that aren't in index a, but located in index b.   Here's my current quey.   index=a categories="media" | where bytes_out > bytes_in | fields _time, cs_user, src_ip, cs_auth_group, cs_host, cs_method, status, bytes_in, bytes_out, cs_User_Agent | eval src=src_ip | join src [ search index=b | fields log_subtype, cat]   ... View more

I'm currently trying to build a dashboard that would drill down by site name. Here's an example of the site name: ABC-DEF-PRIV-APJ-AU-SYD. So the drill-down would be APJ(Region)--> ABC(Business Unit) ---> assets Could someone point me in the right direction to accomplish this? Here's a snippet of the code and visualization that I'm getting: index="lob_data" sourcetype="csv" sitename!="hec*" sitename!="corp*" | where vulnAge > 30 | stats count(IP) as "Total Systems" by sitename,vulnAge ... View more

Im having an issue where my contact field and l2 field is showing duplicates of the same name and when i use the dedup command nothing happens. Here's the command: | tstats count(Vulnerabilities.signature) as "Total Vulnerabilities" from datamodel="Vulnerabilities" where (nodename="Vulnerabilities" Vulnerabilities.severity="high" OR Vulnerabilities.severity="critical" Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*)) by Vulnerabilities.signature Vulnerabilities.property | rename Vulnerabilities.property AS Property | lookup kv_opsdb property as Property output contact | lookup aws_accounts account_number AS Property OUTPUT account_name | eval Property=if(isnull(account_name), Property, account_name) | lookup workday.csv shortid as contact output l2 | sort - "Total Vulnerabilities" | dedeup l2 Heres the result: Vulnerabilities.signature Total Vulnerabilities Contact L2 CentOS 7 : bind (CESA-2019:1294) 129345 Jane Doe John Doe Jane Doe John Doe Jane Doe John Doe Jane Doe John Doe Jane Doe John Doe Jane Doe John Doe Jane Doe John Doe and it goes on for a couple more hundred times. i just need the contact name and l2 showing once ... View more

I'm currently trying to get the duration of some events, but when i use this search nothing is coming back: | tstats count earliest(_time) AS first latest(_time) as last FROM datamodel=Vulnerabilities where (nodename="Vulnerabilities" Vulnerabilities.severity!="informational") by Vulnerabilities.signature | eval first_time=strftime(first,"%Y-%m-%d %H:%M:%S") , last_time=strftime(last,"%Y-%m-%d %H:%M:%S") | fields - first,last |eval duration=last_time-first_time The strftime command converts the unix time, but im not able to get the difference ... View more