Splunk-works! (for all the racing fans out there) ... View more

Sadly I haven't come up to speed on Splunk in containers.. even though I really want to! I would think it would do fine since according to this: https://www.youtube.com/watch?v=wsg7wrTbBRk Docker is supported... it would certainly be interesting to test.   ... View more

I have since purchased a mac mini with the original M1 and Splunk runs beautifully on it (using Rosetta) there is no noticeable detriment to the operation. I am curious myself if there will ever be an ARM version compiled which would allow Splunk to run bare metal(silicon) on the M1 chip...  ... View more

Look at the answer here: https://community.splunk.com/t5/Reporting/How-to-modify-the-quot-View-Results-in-Splunk-quot-link-from/m-p/202301 depending on how many search heads you want to put this into you may be better off setting up an app to distribute the settings to your search heads... or if you are doing a single then put it in $SPLUNK_HOME$/etc/system/local/alert_actions.conf ... View more

this is fantastic! I assume that there are or will be ways to search for comments blogs etc by people with specific skills or platforms selected in their profiles?   that would be awesome! ... View more

https://www.youtube.com/watch?v=iYOXiwgt-3o.      interesting ... View more

I would check out this page: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/JSONFunctions  as these functions make it cleaner and easier to extract JSON fields (particularly when your events are as consistent as these) then follow the steps that @ITWhisperer suggested. ... View more

I would first check the role capabilities. Are there any other users with that role? Can they share reports, etc?  I would guess there is a capability missing, but I’m not 100% sure. Hopefully someone else will have a better suggestion. ... View more

So, a helpful hint. I had to learn this the hard way, always include the search you are asking about (unless it’s a huge multi-line search! It makes it easier to see the problem and offer support.   BTW the 30 day expiration you probably saw means that you will revert to a local license of 500MB/day of ingest and a couple other limitations. It should not affect your fundamentals course at all.  Last hint, on your screen there is a job link that is a pull down you can go into the job inspector and see exactly what is happening with your search. I’m on my phone so can’t go too into detail but here is a handy link https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-job-inspector.html  ... View more

so the following props.conf SEEMS to have resolved the issue... [inserver] LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}.\d{6}( SHOULD_LINEMERGE = false I'm still a little afraid its going to break but I'm hopeful... ... View more

actually when I put that props.conf into production its apparently working and its setting the date based on today (which the file is and the time based on the line... so... maybe I'm ok... thank you for feedback ... View more

its breaking in odd places... perhaps at a blank line in the actual file...though i'm not 100% certain of that here is what the search returns currently: 1/22/20 11:55:04.213 PM 23:55:04.213420(1f24) VSLRuleRepository setting offline state to TRUE 23:55:04.214419(1f24) LicenseRepository setting offline state to TRUE 23:55:04.215419(1f24) CINExternalOsmTreeRecoveryMonitor - Initialize recovery worker thread pool. 23:55:04.234424(1f24) CINDepartmentCrossNodeCache setting offline state to TRUE 23:55:04.235421(1f24) CINUserCache setting offline state to TRUE Show all 10 lines host = HDC0208index = perceptivesource = D:\inserver6\log\intool_CI_SBC_S2B_Import_FAC_20200122.logsourcetype = inserver 1/22/20 11:50:04.639 PM 23:50:04.639018(1c6c) VSLRuleRepository setting offline state to TRUE 23:50:04.640017(1c6c) LicenseRepository setting offline state to TRUE 23:50:04.640017(1c6c) CINExternalOsmTreeRecoveryMonitor - Initialize recovery worker thread pool. 23:50:04.659024(1c6c) CINDepartmentCrossNodeCache setting offline state to TRUE 23:50:04.660025(1c6c) CINUserCache setting offline state to TRUE Show all 10 lines host = HDC0208index = perceptivesource = D:\inserver6\log\intool_CI_SBC_S2B_Import_FAC_20200122.logsourcetype = inserver 1/22/20 11:45:05.036 PM 23:45:05.036601(b40) VSLRuleRepository setting offline state to TRUE 23:45:05.037595(b40) LicenseRepository setting offline state to TRUE 23:45:05.037595(b40) CINExternalOsmTreeRecoveryMonitor - Initialize recovery worker thread pool. 23:45:05.059596(b40) CINDepartmentCrossNodeCache setting offline state to TRUE 23:45:05.059596(b40) CINUserCache setting offline state to TRUE Show all 10 lines host = HDC0208index = perceptivesource = D:\inserver6\log\intool_CI_SBC_S2B_Import_FAC_20200122.logsourcetype = inserver 1/22/20 11:40:04.221 PM 23:40:04.221350(83c) Starting local heartbeat thread. 23:40:04.341359(83c) Stopping local heartbeat thread. 23:40:04.371361(cd0) CINExternalOsmTreeRecoveryMonitor - Shutdown recovery pool. host = HDC0208index = perceptivesource = D:\inserver6\log\intool_CI_SBC_S2B_Import_FAC_20200122.logsourcetype = inserver there are roughly 1500 lines in this particular file and its just breaking out 10-20 lines at a time. as to your question about props.conf I have played with a few things and this is the closest that almost works in my test bed though I havn't implemented it on my prod server [inserver] LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}\.\d{6}\( SHOULD_LINEMERGE = false so I need to test that and see if that helps... Ill post here if it does... but I know I'm still going to get errors about the lack of a proper date in the timestamp... so any ideas on that? ... View more

ok, I'm not 100% certain but I want to clarify a couple things. 1. Your HF is receiving the data from AWS so it should be sending it to your indexers in the index and with the specified sourcetype 2. Your Search head should already be able to find the data with index=foo sourcetype=bar 'specifics of your search' if the above isn't correct, then are you trying to search stream data without indexing it? I guess I'm a little unclear on your exact expectations, and I apologize for that. Perhaps you can further clarify exactly what you are trying to accomplish. ... View more

I think that the eval statements may be off kilter a bit here: shouldn't they be: index=mildw | fields _raw | eval esize=len(_raw) | stats count as count avg(esize) as avg | eval bytes=count*avg | eval kb=bytes/1024 | eval mb=round(kb/1024,2) | eval gb=round(mb/1024,2) | eval tb=round(gb/1024,2) | stats values(kb) as KB, values(mb) AS MB, values(gb) AS GB, values(tb) AS TB as the kb is bytes 1024 mb is kb/1024 etc etc... ... View more

Have you considered using host=someUniqueHostname in your inputs.conf file... which you can manage from a deployment server? its possible that the _internal indexes will continue to show the servername attribute, however your regular indexed events will show from whatever name you put in inputs as host=... I often use different host names from the same UF if I am getting logs from multiple servers forwarded to one UF for example. ... View more