Hi, the solutions are equally valid. I mixed the two using the map and eval ifnotnull to get what I wanted. My indications have not been very precise, so I believe that both are still satisfactory. Thanks everyone for the help and the solution. ... View more

It sounds to me like your install didn't successfully take place. What do you get when you run: dpkg --status splunk ... View more

You can send events that don't match one of those document types to the nullQueue using props/transforms like these: props.conf [<name of relevant sourcetype>] TRANSFORMS-nullobject=nullobject transforms.conf [nullobject] REGEX=Object\sName:\s+[^\.]+\.(?:(?i)(?:pdf)|(?:doc)|(?:docx))$ DEST_KEY=queue FORMAT=nullQueue   ... View more

 Thanks it helps. ... View more

I'm not sure that this is possible without modifying the underlying alert action or cloning it and creating a modified version. However, there is a workaround that can provide similar functionality without using an alert action: | makeresults | eval somefield="Some text", search_name="SearchName", source=search_name | collect index=notable source="SearchName"   ... View more

Thank you so much! ... View more

Hi @Habanero, yes, the main action you have to do is to rename one of the fields to have the same fieldname in both the partial searches. You have to do this in both the cases: if you have to perform a subsearch or if you have to correlate searches with stats command. So, you have to run something like this:  index=estreamer NOT (src_ip="10.0.0.0/8" OR src_ip="192.168.0.0/24" OR src_ip=172.16.0.0/12) (app_proto="TeamViewer" OR app_proto="FTP" OR app_proto="FTP Data" OR app_proto="Telnet" OR app_proto="RDP" OR app_proto="SSH" OR dest_port="3389" OR dest_port="23" OR dest_port="22") fw_rule_action="Allow" [ search index=wineventlog | rename Source_Address AS src_ip | fields src_ip ] | ... Only two little final notes: you forgot one OR in the parenthesis conditions and it's better to have a NOT = condition than a != condition. Ciao. Giuseppe ... View more

Log into the instance on which you want to configure the monitoring console. The instance by default is in standalone mode, unconfigured. In Splunk Web, select Monitoring Console > Settings > General Setup. Click Distributed mode. Confirm the following: The columns labeled instance and machine are populated correctly and show unique values within each column. The server roles are correct. For example, a search head that is also a license master must have both server roles listed. If not, click Edit > Edit Server Roles and select the correct server roles for the instance. If you are using indexer clustering, make sure the cluster master instance is set to the cluster master server role. If not, click Edit > Edit Server Roles and select the correct server role. If you are hosting the monitoring console on an instance other than the cluster master, you must add the cluster master instance as a search peer and configure the monitoring console instance as a search head in that cluster. See Add Splunk Enterprise instances to the Monitoring Console. Make sure anything marked as an indexer is actually an indexer. (Optional) Set custom groups. Custom groups are tags that map directly to distributed search groups. You might find groups useful, for example, if you have multisite indexer clustering in which each group can consist of the indexers in one location, or if you have an indexer cluster plus standalone peers. Custom groups are allowed to overlap. For example, one indexer can belong to multiple groups. See Create distributed search groups in the Distributed Search manual. Click Apply Changes. https://docs.splunk.com/Documentation/Splunk/8.1.3/DMC/Configureindistributedmode  ... View more

Hello pleas check out the Splunk Operator for Kubernetes project available in Beta now! This functionality is something we would like to deliver as part of this project! Please join us to try it out! https://github.com/splunk/splunk-operator/tree/develop/docs#getting-started-with-the-splunk-operator-for-kubernetes   ... View more

Re: "how to specify the JSON elements in the query": Example: - if you have a field titled field1 that has JSON formatted data (e.g. {"att1":"val1","att2":"val2"} You can do the following: index=myIndex | spath input=field1 ouput=att1 path=att1 | spath input=field1 output=att1 path=att2 | eval test=case(source=Source1 OR sourcetype=sourceTypeB, att1,logSource=logSource2,fieldname1)   You can also use  | spath input=field1 without any output or path if you want to extract all JSON fields. For more details on the spath command go here: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Spath ... View more

I think the biggest clue is the 5th event down. This seems likely an authentication issue, make sure your certificate is correct and matches the public IP. ... View more

It sort of depends on your situation. How many deployment clients do you anticipate having? Are there network segregation concerns? A properly provisioned Deployment Server can handle  thousands of clients, so while there are some cases that a tiered deployment makes sense, it's usually not necessary. ... View more

Here is the problem I'm facing with "Predict" command - I used map command as per your suggestion above which is dynamically predicting values for different ID's, however "predict" command is not retaining the ID value its just giving the predicted value but not the ID. Is there a way for setting getting the predicted outcome along with its corresponding ID? please suggest... I need set the alerts for different ID's for predicted outcome value>=0.5 Awaiting for your response. Thank you! ... View more

I should add the dates on the graph should be the Monday of each week so the incidents need to be grouped by week. Thanks ... View more

Another option if you don't plan on turning this into a graph and will only be using the chart itself:   | eval service_label = "Druid Data Service-availability", value=round((good_events/total)*100,2), condition=if(value<=100,"Fail",""),value=if(condition="",value,value." (".condition.")") ... View more

I am assuming that when you say F4 in F5 is about the list of values of the split multi value field. See this example. You can see that split will split the second row values indicating that there is 'nothing' in the F2/F3 place, but as you can see from the count, there are 7 values in each row for the 'split' field. | makeresults | eval f=split("F0,F1,F2,F3,F4,F5,F6:F0,F1,,,F4,F5,F6",":") | mvexpand f | table f | eval split=split(f,",") | eval count_of_split_results=mvcount(split) | eval x=mvmap(split,if(len(split)=0,"-",split)) Note that is uses mvmap, which is a Splunk 8 function. But this simple iterates through the mv field values and changes any length 0 field to a hypen.   ... View more

I like the way you fixed the quoting in the json. ... View more

Hi @RomeSplunk123, it should be sufficient to take the Sales II certification, but you can ask to your Channel Manager. Ciao. Giuseppe P.S.: if you're italian, there's a Splunk User Group in Rome. ... View more

https://community.splunk.com/t5/Splunk-Search/After-updating-an-app-why-am-I-getting-search-error-quot-The/m-p/239462 ... View more