I did tried with below query where as i am getting action results edit but i am not able see what is edited like deep dive result. Basically i need to see if anyone in the roles edited, added and deleted something in splunk . index=_audit user!=splunk-system-user user!="n/a" (action=edit OR action=create OR action=delete) | table _time user, action info host Result Table: Date&time: aaaaaaaaa user: AAAAAA action: edit_deployment_client, edit_user(This result i need to see what is edited by user in deep dive result) host: BBBBBBBB Thanks in adavance ... View more

I did tried with below query where as i am getting action results edit but i am not able see what is edited like deep dive result. Basically i need to see if anyone in the roles edited, added and deleted something in splunk . index=_audit user!=splunk-system-user user!="n/a" (action=edit OR action=create OR action=delete) | table _time user, action info host Result Table: Date&time: aaaaaaaaa user: AAAAAA action: edit_deployment_client, edit_user(This result i need to see what is edited by user in deep dive result) host: BBBBBBBB Thanks in adavance ... View more

Data stopped coming into the Splunk and i checked the disc space as example belowdisc is showing as 100% usage because of the duplicate data files consuming the extra disc space as in example below Log.1, log.2, log.3, log.4, log.5 files using additional memory.Please give me suggestion here is to increase disc space or removing the duplicate log files as in the image(How to remove the duplicates log file ingestion). Please check below examples for better understanding. Example: rw------ 1 splunkadmin splunkadmin 8486417 Aug 14 19:28 splunk_ta_microsoft-cloudservices_storage_blob_ZG90Y29tcHJlcHJvZA==.log rw------ 1 splunkadmin splunkadmin 24829845 Aug 14 19:26 splunk_ta_microsoft-cloudservices_storage_blob_ZG90Y29tcHJlcHJvZA==.log.1 rw------ 1 splunkadmin splunkadmin 24949031 Aug 14 19:16 splunk_ta_microsoft-cloudservices_storage_blob_ZG90Y29tcHJlcHJvZA==.log.2 rw------ 1 splunkadmin splunkadmin 24327574 Aug 14 19:04 splunk_ta_microsoft-cloudservices_storage_blob_ZG90Y29tcHJlcHJvZA==.log.3 rw------ 1 splunkadmin splunkadmin 24787540 Aug 14 18:55 splunk_ta_microsoft-cloudservices_storage_blob_B64_ZG90Y29tcHJlcHJvZA==.log.4 rw------ 1 splunkadmin splunkadmin 24898758 Aug 14 18:47 splunk_ta_microsoft-cloudservices_storage_blob_B64_ZG90Y29tcHJlcHJvZA==.log.5 Disc space using example: Filesystem Size Used Avail Use% Mounted on /dev/sda2 32G 31G 840M 98% / - This is the disc space devtmpfs 3.9G 0 3.9G 0% /dev tmpfs 3.9G 0 3.9G 0% /dev/shm tmpfs 3.9G 358M 3.6G 9% /run tmpfs 3.9G 0 3.9G 0% /sys/fs/cgroup /dev/sda1 497M 103M 394M 21% /boot /dev/sdb1 32G 2.1G 28G 7% /mnt/resource tmpfs 797M 0 797M 0% /run/user/1000 ... View more