https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf # For Windows systems only. # Does not use file handles [MonitorNoHandle://<path>] * This input intercepts file writes to the specific file. * <path> must be a fully qualified path name to a specific file. Wildcards and directories are not accepted. * This input type does not function on *nix machines. * You can specify more than one stanza of this type. disabled = <boolean> * Whether or not the input is enabled. * Default: 0 (enabled) index = <string> * Specifies the index where this input sends the data. * This setting is optional. * Default: the default index I have no experience using this myself and only learned about this in the last week.  Since you said the UF was on a Windows client this could work for you.  This would not work with a UF on *nix environments.  ... View more

| tstats count where index=<your-index-here> earliest=-3d@d latest=now() by _time span=15m | eval date_wday=strftime(_time,"%A"), date_hourmin=strftime(_time,"%H:%M") | search date_wday!=Saturday date_wday!=Sunday | eval current_weekday=strftime(now(),"%A") | eval previous_working_day=case(match(current_weekday,"Monday"),"Friday",match(current_weekday,"Tuesday"),"Monday",match(current_weekday,"Wednesday"),"Tuesday",match(current_weekday,"Thursday"),"Wednesday",match(current_weekday,"Friday"),"Thursday") | table _time count date_wday date_hourmin current_weekday previous_working_day | where date_wday=current_weekday OR date_wday=previous_working_day | chart sum(count) as count by date_hourmin, date_wday Ok that is the closest I could get to what you originally tried.  However, there are some flaws with this solution you may want to consider.  Specifically partial time bins can not be filtered out without using the time chart command.  So it could look like the count for the most recent time span has dangerously dropped when in reality you only have 2 or 3 minutes of the 15 minute window to measure. Working with the timewrap command is more correct way to do this as you can leverage timechart which allows you to disable partial windows.  You will find though that filtering out week-ends and the -3d@d makes for odd visualizations. index=<your-index-here> date_wday!=saturday date_wday!=sunday earliest=-3d@d latest=+1d@d | timechart span=15m partial=f count | timewrap 1day align=end Splunk time extracts date_* fields for you already.  The +1d@d is only important if you want your graph to go midnight to midnight, replace with now() if you are ok with the visualization start and end moving as the day progresses. ... View more

The absolute best practice is to always explicitly define your timestamp along with timezone.  You can get away with it most times if you don't but when it doesn't work always revert back to a proper definition. ... View more

Your timestamp raw feed does not have a time zone indicator.  In that case the indexer will assume local system time zone and apply that in most cases.  If our collection point (UF) is -4 and your indexing point (IDX) is -5 it will assume that the timestamp is also -5. A best practice is to always define your time zone and never allow Splunk to automagically assume based on the datetime.xml auto extractions. https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Propsconf#Timestamp_extraction_configuration   ... View more

https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf [MonitorNoHandle://<path>] * This input intercepts file writes to the specific file. It appears this monitor config does not read the file itself but only intercepts what is about to be written to the file.  Your image shows last modified as Jan 4th which is your stated last ingest. I think your configuration will only capture future content and not existing content.  ... View more

| makeresults | eval tmp="Thu 1/18/2024 @ 06:52:30.918 PM UTC 00.000.00.000 (00.000.000.001, 00.000.00.01, 00.000.00.03) > 00.000.00.0:0000 \"PUT /uri/query/here HTTP/1.1\" - 1270 200 3466 https-openssl-nio-00.000.00.0-000-exec-15 \"hxxps://url.splunk.com/\" \"user_agent\" - - - -" | rex field=tmp "^(?<timestamp>\w+\s\d+\/\d+\/\d+\s\@\s\d+:\d+:\d+\.\d+\s\w+\s\w+)\s(?<remote_hostname>\S+)\s\((?<x_forwarded_for>[^\)]+).*$" | table tmp timestamp remote_hostname x_forwarded_for | eval x_forwarded_for=split(replace(x_forwarded_for,"\s",""),",") Hello, This will auto extract a variable number of x-forwarded-for addresses and place into a multi value field.  ... View more

Have you checked the _audit logs to confirm user and roles values? ... View more

https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/Rolesandcapabilities schedule_search Lets the user schedule saved searches, create and update alerts, review triggered alert information, and use the sendemail command. So this capability is by default provided to power user roles.  You can clone the power user role to a custom name for your organization.  Inside that cloned version you can remove the above capability.  Some apps such as ITSI are preset to inherit the power user role so you still have to watch the inherited capability lists.   Updated: Copy and Pasted wrong capability originally. ... View more

It sounds like the original data has too many lines/events.  You may want to implement EventBreaker or LineBreak in your props.conf on the ingest before you need to apply any search time eval or mvexpand. ... View more

Try | chart latest(Count) as Count by Name, ProcessDate | sort ProcessDate desc Found a very similar request under this previously answered question. https://community.splunk.com/t5/Splunk-Search/How-to-display-column-results-in-descending-order/m-p/405619 ... View more

USE_LOCAL_SYSTEM Install the universal forwarder as a local system 0   The default flag on install is 0 - update the install line to flag this set to 1. This is no longer best practice for security so be prepared to update future installs to fit with best practices. ... View more

Not exactly what I was looking for.  I have the Label and Value mapped to field 1 as that is the user friendly value and unique.  I have field 2 which means nothing to my users and is a varied value field. The Label/Value combo feeds panel_A chart which works very well.  I have panel_B chart which I would like powered from field2 without having to create a second drop down with the same values.  Two for the price of one.   I am going to try and make the Label field a combo of the 2 and then set a token to a regex extraction from $Label which may just work.  But I feel it's janky and cheating.  I am hoping someone will have a much better idea. ... View more

It appears that the field action has text values and you are trying to apply a volume limit where statement.  You could create a new field of 'tmp' if action IN (value1 value2), "1","0").  At that point you can stats count or sum the new field and apply your where statement based upon your own needs.   Just a thought. ... View more

Agreed - you need to have the index defined on the indexers.  Since the HF cooks the data when it comes across you need to have matching configuration at the receiving side.  Failure to do this will mean your data will route to the last chance index. On the indexer check btool config for indexes.conf [default] lastChanceIndex = <index name> * An index that receives events that are otherwise not associated with a valid index. * If you do not specify a valid index with this setting, such events are dropped entirely. * Routes the following kinds of events to the specified index: * events with a non-existent index specified at an input layer, like an invalid "index" setting in inputs.conf * events with a non-existent index computed at index-time, like an invalid _MetaData:Index value set from a "FORMAT" setting in transforms.conf * You must set 'lastChanceIndex' to an existing, enabled index. Splunk software cannot start otherwise. * If set to "default", then the default index specified by the 'defaultDatabase' setting is used as a last chance index. * Default: empty string   ... View more

This is exactly what I needed. My unique_ident was actually a collection of fields.  I just eval'd them together as a big string with a delim character that I can easily separate out post processing. One issue that I will not worry too much about but if you have a hint would be good.  The values fields are text and can contain an "*" character.  Even if the value exists on both columns it is registering as "Added" and "Removed".  Because of the nuance I can live with it.  However, if I wanted to move this into a dashboard not all users might understand the mechanics. Example Unique Old New transact-x *_ABCD_* *_ABCD_* Results Unique Old New Audit transact-x   *_ABCD_* Added transact-x *_ABCD_*   Removed ... View more

Not a solution to your certificate issue.   If your version of Syslog-NG is recent enough I would consider switching to an HTTP Destination configuration.  Use the server as a relay to convert syslog protocol to HEC and you can send direct to Indexers or other destinations of your choosing. ... View more

To find login and logout sessions here is the search you want. index=_audit sourcetype=audittrail action IN ("login attempt" logout) For some reason the field extractions for action only work on my DMC and not my search heads so be cautious and edit the search where needed.  This tracks by user which is really easy.   However since most users will not actually log out and rather the behavior is to close the browser window the session will timeout.  You can map the log in session which is a field in the above login action.  The session timeout does not map a username value though. index=_audit sourcetype=audittrail action=expired_session_token info=expired There will be one log for each search head in your cluster.  So if you have a 5 search head cluster you will see a single login action but then 5 session timeout values.  ... View more

Interesting, from what I have just read this will require you to have three source types but keep an eye on the parsing queue.  It would be unhelpful if clone_sourcetype wants to occur before the rewrite of the meta field making this solution a non-option.  I've never tested so best of luck and I hope it works. ... View more

It was only introduced in 9.x so prior versions of Splunk would not have that index and logging available.  Previous to this we had a script which would ingest the outputs of a btool command and then compare changes in values over time. ... View more

Leave the DATETIME_CONFIG xml value as is.  Set the TZ on the PROPS.CONF that is distributed to the UF for your sourcetype where you do event breaking. ... View more

| convert ctime(_time) as Time ... View more