Hi, I have setup a HEC input on a Heavy Forwarder and have a base app for all data outputs to forward to Splunk Cloud Indexers but not seeing the HEC data in Cloud. Am I missing out a particular setting that forwards HEC data Thanks, ... View more

Hello, I am having an issue with IPLOCATION displaying the wrong Country using the following query.   index="office365" sourcetype = o365* Workload=AzureActiveDirectory Operation=UserLoggedin ActorIpAddress=152.37.xxx.xxx | iplocation ActorIpAddress |table Country Which shows the country is "United States" Checked the web on different IP locators and all show the IP as UK which is the correct location.   If I run this query: | makeresults | eval ip="152.37.xxx.xxx" | iplocation ip | table Country, ip The country display as the UK.   Anyone know what is causing this issue. I have updated the mmdb file to the latest release.   TIA       ... View more

I have a search query to display external files shares that are active (Sharepoint/Onedrive).     This is working and shows us when file shares to third parties are still active. index=o365 file_path=* user=urn* OR TargetUserOrGroupType=Guest | fillnull value="-" | dedup UniqueSharingId TargetUserOrGroupName | where NOT Operation=="RemovedFromSecureLink" |stats latest(_time) by user Operation file_path file_name vendor_product TargetUserOrGroupName UniqueSharingId The issue we have is if a user just deletes the file share folder (so no longer an active share) the dashboard still displays the share as active.   I need to append the following search and match to the unique sharing location to display if the file/folder has been deleted: index=o365 Operation=FileDeleted       TIA ... View more

Currently using a UF to forward logs to Splunk. Each .log file in the directory is 1 event but Splunk is separating each event into 4 separate logs. I have added a custom app on the search head with a props.conf file as follows: [RMAN] SHOULD_LINEMERGE = false LINE_BREAKER = ((*FAIL)) TRUNCATE = 99999999 Restarted Splunk but events are still separated into 4 events. Anyone have any idea how to fix this. TIA ... View more

Hi, I am trying to find unique id's the have 3 letters followed by 6 numbers for example   bhg111111   My issue is I want to not count duplicates and would like to do this within the regex itself (not dedup by field.   is this possible   thanks, ... View more

I am trying to alter the response Time History Chart to display a red bar when a failure occurs and not when a response time threshold is met. sourcetype="web_ping" `website_monitoring_search_index` title="$title$" | timechart avg(total_time) as response_time | eval response_time_over_threshold=if(response_time>`response_time_threshold`,response_time,0) | eval response_time=if(response_time>`response_time_threshold`,0,response_time) TIA ... View more

I have a single value panel which is generated from the spl below: | inputlookup AD_User_LDAP_list where OU=Staff isDeleted=FALSE |stats count I would like to drill down when clicked and display a list of users in another panel (the results of the spl below): | inputlookup AD_User_LDAP_list where OU=Staff isDeleted=FALSE |table sAMAccountName Can someone kindly explain how to do this TIA ... View more