hi any update on this from anyone ? Thank you! ... View more

hi, Why do we have 2 fields  yearmonthday  and yearmonth in this query?  ... View more

Thanks for raising this query. I am having same issue, there is no pre-populated data in the sandbox version.  ... View more

This worked for me, thank you ... View more

Thank you for the replu Soutamo. I have explored this option and I think this works good if every alert that is configured aligns to this method. Currently there are many alerts that are running and they are set up with different alert actions and hence this method will not help for the scheduled alerts. I got response from splunk slack group and the response is as below: jeffland 14 hours ago When an alert runs, it lives for as long as its expiry setting allows it to. This data is pretty much a regular search job, so nothing you can "search" for with SPL as there is nothing that has been indexed (it lives on the disk of the search head running the search). Additionally, if you configured alert actions, those run if the criteria were met. If you sent out an email, it will be in the recipients mail box. If you indexed something, you'll find it where it was configured through the alert action configuration.   When an alert runs, it lives for as long as its expiry setting allows it to. This data is pretty much a regular search job, so nothing you can "search" for with SPL as there is nothing that has been indexed (it lives on the disk of the search head running the search). Additionally, if you configured alert actions, those run if the criteria were met. If you sent out an email, it will be in the recipients mail box. If you indexed something, you'll find it where it was configured through the alert action configuration. ... View more

hi, I have similar query but this is different. Is there any index/any place where all the events from the fired alerts are doing to?? I am not interested to know alert names/save search names. All that I want to know is, irrespective of what  the "alert action"  is I am assuming all fired events/fired results of alert are stored somewhere. I would like to know if there is any such index/sourcetype. Thanks in advance. ... View more

Thank you, I had the same query and this answer helped 🙂 ... View more

Thank you for the git link reference to the app,  create_thehive_alert.It worked. I tried using app, "TA_the hive_ce" but this did not help to send alerts from splunk to the hive.   ... View more

Hi, I thought I replied here but somehow I am unable to view my reply. The above where condition is not working when I have 10-12 index to use inside IN(A,B,C.....K,L) Issue 1: It says that where condition is missing closure with  )" when I use more that 2 index values Issue 2: It returns the events but it won't display the events ( I tried verbose and fast modes) but I can't see the events ( I do encounter this situation even when no syntax errors/ no error message) not sure why this situation happens, appreciate response for this condition as well. Please advise how how I can use filter the data model to fit only to my index values     ... View more

Thank you Gcusello for your quick reply. I tried to update the passwd with the command provided above splunk cmd splunkd rest --noauth POST /services/admin/users/admin "password=" by opening passwd via vi editor and updated the above command. Somehow I was unable make use of new <>/<> that I have updated as per the above command launching passwd file vi editor. I followed another approach that you have suggested above by moving passwd file as a passwd.back and then updated as below using splunk docs reference: Edit the $SPLUNK_HOME/etc/system/local/user-seed.conf file as follows: [user_info] USERNAME = admin PASSWORD = then I did below verification and I could login successfully. ./splunk login -auth admin admin/<> ... View more

Thank you Zuehlaa for your quick reply. I tried to update the passwd with the command provided above by opening passwd via vi editor and updated the above command but I was unable make use of <>/<> that I have updated in passwd file using vi editor. I followed another approach by moving passwd file as a passwd.back and then updated as below using splunk docs reference: Edit the $SPLUNK_HOME/etc/system/local/user-seed.conf file as follows: [user_info] USERNAME = admin PASSWORD = then I did below verification and I could login successfully. To verify this I tried to login using ./splunk login auth --admin:<> ... View more