Hi All, Based on this query I want to filter out wineventlog before ingesting into Splunk. So that i can save some licenses. So the condition is something like for two of the sourcetypes and for the particular eventcodes (4624,4634) I want to filter out if the logs comes from Account Name= - & *$ for the particular set of hosts. index=abc sourcetype IN (winev,wind) EventCode IN (4624,4634) Account_Name="-" Account_Name="*$" host=*xyz*   So do we need to write the blacklist stanza in the inputs.conf file or do we need to specify the props and transforms separately.   Actually for all Windows client machines we are ingesting the wineventlog with the help of Deployment master server. So from Deployment master server we used to push the configurations to all windows machines so kindly help with the stanza for the same.     ... View more

Hi Team, I am aware that we can able to pull the license usage stats in splunk for index, host and sourcetype for a day. But whereas I want to pull the license usage stats in GB for last 30 days. I have two requirement seperately to pull the exact license usage stats for last 30 days in Splunk. 1.)The first one would be based on the app and severity of how much logs are ingested in GB for last 30 days for both the index. index=abc OR index=xyz app IN (splunk,"Splunk-Daemon") severity=informational ================================================================================ 2.) The second condition would be based on a index for two sourcetypes with a particular keyword.  2.) index=abc sourcetype IN ("efg","ijk") "www.splunk.com*"   So for each requirement how can I be able to pull the license usage in Splunk for last 30 days. Kindly help on the same. ... View more

Hi Team, We have recently upgraded our Deployment Master server from 7.3.1 to 8.1.2 version. The upgrade seems to be success whereas if i perform any of the commands below I am getting an error. Refer below for more information. Commands: splunk restart splunk start splunk stop splunk reload deploy-server   Errors: [splunk@servername bin]$ splunk reload deploy-server Error processing line 1 of /opt/splunk/lib/python3.7/site-packages/zc.lockfile-2.0-py3.7-nspkg.pth: Fatal Python error: initsite: Failed to import the site module Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site.py", line 168, in addpackage exec(line) File "<string>", line 1, in <module> File "/opt/splunk/lib/python3.7/importlib/util.py", line 14, in <module> from contextlib import contextmanager File "/opt/splunk/lib/python3.7/contextlib.py", line 5, in <module> from collections import deque File "/opt/splunk/lib/python3.7/collections/__init__.py", line 27, in <module> from reprlib import recursive_repr as _recursive_repr File "/opt/splunk/lib/python2.7/site-packages/reprlib/__init__.py", line 7, in <module> raise ImportError('This package should not be accessible on Python 3. ' ImportError: This package should not be accessible on Python 3. Either you are trying to run from the python-future src folder or your installation of python-future is corrupted. During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site.py", line 579, in <module> main() File "/opt/splunk/lib/python3.7/site.py", line 566, in main known_paths = addsitepackages(known_paths) File "/opt/splunk/lib/python3.7/site.py", line 349, in addsitepackages addsitedir(sitedir, known_paths) File "/opt/splunk/lib/python3.7/site.py", line 207, in addsitedir addpackage(sitedir, name, known_paths) File "/opt/splunk/lib/python3.7/site.py", line 178, in addpackage import traceback File "/opt/splunk/lib/python3.7/traceback.py", line 3, in <module> import collections File "/opt/splunk/lib/python3.7/collections/__init__.py", line 27, in <module> from reprlib import recursive_repr as _recursive_repr File "/opt/splunk/lib/python2.7/site-packages/reprlib/__init__.py", line 7, in <module> raise ImportError('This package should not be accessible on Python 3. ' ImportError: This package should not be accessible on Python 3. Either you are trying to run from the python-future src folder or your installation of python-future is corrupted.   So kindly help to check and let me know how to resolve the issue. But our Deployment server has been upgraded successfully to 8.1.2 but couldn't able to perform any commands due to this issue.   Whereas if we ran the command with (./) as prefix then i can able to execute all commands: ./splunk restart ./splunk start ./splunk stop ./splunk reload deploy-server   So kindly help me to fix this issue. ... View more

Hi Team I have set of 5 hosts which are coming from an index=xyz and with sourcetype=iis so for example if any of the host logs from index=xyz and sourcetype=iis is getting stopped then we need to get an email notification from which server the logs has stopped getting ingested into splunk. Timespan is for last 15 minutes. 5 host information: abc, def, ijk, lmn, opq.   So can you kindly help to build the query.   ... View more