I have read about some limits you can come across when doing realtime searches. When trying to scale this out should you be editing these configuration files and increasing resources on the searchhead or the indexers? It seems like the indexers are doing all of the real searching. What exactly does the searchhead actually do in terms of the under the hood technical part of a search? Does it exist only to host the web gui and distribute searches to indexers? ... View more

Hello. I have events that have a field "Security_ID" that is a multi value field. It may contain something like: NULL SID user1 within that one field. I have found some commands to work with multivalue fields but what I am struggling with it trying to get a count. If I have an event with Security_ID containing (user1 and NULL SID) and another event with (user2 and NULL SID) - how can I get a table that contains the stats with a count of how many times each of those combinations shows up? ie i want a table looking like this: Row 1: user1 NULLSID 5 Row 2: user2 NULLSID 7 ... View more

The app says to go to data inputs and select the Slack one, but I've installed the app and restarted the service, and there's no Slack input type... ... View more

I'm having an issue taking a search I have and feeding one of the results to an LDAP search to generate a new field that resolves the account name to the display name. Does anyone have any examples of how this can be done? Below is an example of what i'm trying to do. This search results a field "user" which i want to use as the basis to search LDAP to resolve the displayname. However, i'm having some syntax errors index=events EventCode = 8004 | eval displayname = ldapsearch domain=test.local search="(objectClass=user)" attrs="displayName,sAMAccountName,userAccountControl" | where userAccountControl = "NORMAL_ACCOUNT" AND sAMAccountName = "$user$" ... View more

I have looked at various solutions such as editing the conf files for an app to increase the 10K limit on emailed search results but it seems more is needed than that. Does anyone have a definitive guide on what all is needed to increase the limit from 10K on a standard splunk install? I've seen references to changing all kinds of stuff everywhere and it's pretty confusing. ... View more

A splunk engineer told us to deploy an app with the deployment server (to universal forwarders) that contained the outputs.conf file. the problem is that even with this app deployed running btool still shows that the config is being taken from system/local/outputs.conf --which is what I expected based on the documents from Splunk....maybe he was confused.... Anyway the real problem is I don't understand the correlation between a few values in outputs.conf [target-broker:deploymentServer] targetUri = clustermaster:8089 [tcpout] defaultGroup=my_indexers [tcpout: my_indexers] server=1.1.1.1:9997,1.1.1.2:9997 [tcpout-server://1.1.1.1:9997] [tcpout: my_LB_indexers] autoLBFrequency=30 server=1.1.1.1:9997,1.1.1.2:9997,1.1.1.3:9997 useACK=true After reading the outputs.conf documentation on Splunk I'm confused about a few things: 1) What is the result of the above config? Does the default group attribute mean that it will never send to the my_LB_indexers group? Or does the universal forwarder always send to all output groups? Since duplicate values exist would it still only send to each one once? 2) is the single server stanza even needed? I saw one splunk document that said it was optional and another that said it's always needed. 3) If the config makes it only send to my_indexers, does it ever fail over to another group if the my_indexers group becomes unavailable? ... View more

I want to simply take an event and parse EVERYTHING between two strings and make it a field...the built in field extractor in splunk is garbage and does not help with this simple extraction. The string would be like below: suser=Joe blow cat=Upload Policy - On Corp sourceServiceName=Server01 How can I simply (within the field extractor, not a search), take everything between "cat=" and "SourceServiceName=" and make that into a field called policyName? ... View more

I've seen several posts here, but none that really have a concrete answer on this. I'm trying to blacklist certain accounts in my inputs.conf on the Splunk universal forwarder for Windows event id 4663 (object access). Does anyone know the correct way to blacklist several account names from appearing in the data forwarded to Splunk? I've seen some people say key off of user, others with message= followed by some regex with Account Name. The below obviously does not work. blacklist = EventCode="4663" Account Name="User, SERVER$, UserAccount1, UserAccount2" ... View more