Hi, you can not just use (?.) as a group. You need to add a name for at least one group like this: (?<name>.+) which would extract the results of the group to a field called "name" in Splunk. If you want to match everything in a group without giving a name you might be able to use (?:) . Greetings Tom ... View more

I will give you an example. You can copy this and run it in your splunk: | makeresults | eval field="C:\\Windows\\a,F:\\Foo" | makemv delim="," field | eval path=mvfilter(match(field,"C:\\\\Windows.*")) Everything up to | makeresults | eval field="C:\\Windows\\a,F:\\Foo" | makemv delim="," field should look like your result and the | eval path=mvfilter(match(field,"C:\\\\Windows.*")) filters down the result to the C:\Windows* match. ... View more

Then you might use mvfilter to filter down your multivalue fields to what you need in the end? Like using a regex with mvfilter that filters out only paths that start with C:\\Windows* . ... View more

Looks like your field is a multivalue field because the way through your JSON Object is the same for all fields called "path". You can select a value from a multivalue field with the help of eval and mvindex: source=test| search "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path"="C:\\Windows*" | eval path=mvindex('behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path',0) | table path Does this work for you? ... View more

Hi, do any error messages appear for the two users with inconsistent views? Most of the time a small yellow or red triangle is seen in the upper right corner of the panel if the search behind the panel has any problems. Could for example be a problem with one indexer, so only the data of one indexer is shown. But i can not know exactly, cause i do not know how much indexers you have. Also make sure the users do not have any personal copies of the dashboards in the users local folder, as you already mentioned. the dashboards xml file should be located in the apps default or local folder, where local has preference over default. But if a user got a version of the xml in the user/app/local folder, this would overwrite the one in the app. Double check if all extracted fields, lookups and other knowledge objects used in the search have the same permissions for all users. ... View more

Hi, open up a splunk dashboard and use your browsers developer console to take a look at the class attributes. For example in Chrome right click on the navbar in the splunk dashboard and chose inspect element. You can also test your selectors "live" in the browsers console. ... View more

Hi, looks like they changed the class attributes of the header and the navigation. Try something like this: $("header > div > div:nth-of-type(2)").prepend('Test') ... View more

No, you should create a user and a group called "splunk". With the chown command you can change the owner of a folder to another user and group. in this case to the the user splunk and the group splunk = splunk:splunk. Simple: you install as root, but since best practise is not to run splunk as root, you change back to an other user after installation. As mentioned, there is a step by step guide in the docs: https://docs.splunk.com/Documentation/Splunk/7.2.6/Installation/RunSplunkasadifferentornon-rootuser#Set_up_Splunk_software_to_run_as_a_non-root_user ... View more

Looks like your problem is not the tar itself. Seems like your user does not have enough rights to create a folder at /opt/apps/splunk. Try sudo tar -xzvf ... And when you finished, change the owner of the splunk installation path back to the desired owner (e.g. a user called splunk). This is also shown in the splunk installation manual: https://docs.splunk.com/Documentation/Splunk/7.2.6/Installation/RunSplunkasadifferentornon-rootuser#Set_up_Splunk_software_to_run_as_a_non-root_user ... View more

You can use this search: index=main earliest=-5d sourcetype="Perfmon:CPU Load" counter="% Processor Time" |timechart span=5min avg(Value) as "CPU Processor Time" |predict "CPU Processor Time" AS "Predicted value" algorithm=LLP5 upper95=high lower95=low future_timespan=2880 But it could be hard for the algorithm to figure out a good prediction for 10 days and more in the future, when the history of your search is only 5 days (earliest=-5d). Use a larger time span and try to play around with the different algorithms the predict commands offer and try to use the predict option "period", which adds seasonal information to the prediction. You can take a look in the documentation for predict: https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Predict It is hard to give you more details to improve your search, since predictions are always individually and modelled according to your historic data, which i do not know. Greetings Tom ... View more

Hi, the user role is per default limited to a small amount of searches that run in parallel and the results of a user can also only take limited space in the splunk dispatch folder. The lifetime of a search is 10min. As an example: A user starts a search which returns alot of results, so the 100mb space in the dispatch folder is used up. The user have to wait 10min until the lifetime ends and the search is removed from dispatch folder. You can edit those values in settings -> access control -> roles, there you can select the role you want to edit. The options "User-level concurrent search jobs limit", "User-level concurrent real-time search jobs limit", and "Limit total jobs disk quota" are of interest in your case. You can increase them, but this will increase the load of your splunk machines if the user make heavy use of more searches. Greetings Tom ... View more

Hi, you use future_timespan=70, which means 70 * 5 min is predicted into the future, since you are calculating 5min buckets with timechart. Also you have configured holdback=30, which means you are not using the last 30*5min for your prediction. If you just want to predict more points in future increase future_timespan and do not use holdback. For an even better prediction, try out the new algorithm in the machine learning toolkit "StateSpaceForecast". You can see an example of usage here: https://www.splunk.com/blog/2019/03/20/what-s-new-in-the-splunk-machine-learning-toolkit-4-2.html In short, it makes better use of seasonal pattern, like weekends, holidays, time of the day. Which is typically applicable for CPU usage. Greetings Tom ... View more

Hi, you can not create a data model from a query and i don't think it will be much faster than the accelerated report. But i do not think, that you want to show 1million rows on your dashboard, this is not very helpful. Is your dashboard rather showing aggregated values? something like number of unique vulnerabilities, number of clients, ...? If so, you should calculate those accelerated values, store them in a summary index or lookup and use them as a basis for your dashboards. Greetings Tom ... View more

Hi, i promoted it to an answer, so you can vote on it 🙂 Sorry for the duplicated link, the second one should have been this one: https://answers.splunk.com/answers/617407/how-to-configure-a-time-based-lookup-temporal-look.html ... View more

Hi, if you want a result for every host in your lookup, you need to change the join type to outer. This will show every entry from the main search (your inputlookup) even if it does not find a match in the subsearch (your incident data). There is a nice image in the documentation, that shows how the types of join works: https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Join#Optional_arguments So you need to make sure to have all known hosts into your lookup table. ... View more

Hi! If you want to use INDEXED_EXTRACTIONS = JSON you need to use it in the props on the UF. You do not need any other line breaking settings (in fact i think they will be ignored). But the file you want to read needs to be in the correct json syntax! As far as i remember it is a array of json objects. If you want to do the line breaking by hand, you need to do it on the indexers as usual. If you set INDEXED_EXTRACTIONS = JSON on the UF, do not set KV_MODE=JSON on the SH. This will extract fields at index time AND at search time, which will give you fields with duplicated values. Greetings Tom ... View more

Just as a quick tip, the website crontab guru is very useful to create and manage cron schedules. For your example: https://crontab.guru/#3_21_1-7,15-24_*_0 ... View more