It depends on load. This may help.. https://www.outcoldsolutions.com/blog/2021-04-21-configuring-hec-for-performance/ ... View more

Below link shows exact details for upgrading to 8.0.1 https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST Splunk Enterprise and Universal Forwarders must be version 7.0.x or higher to upgrade to version 8.0 Applicable components: Splunk Enterprise and Splunk Universal Forwarder Applicable OSes: all Version introduced: 7.3 Upgrades to Splunk Enterprise and Universal Forwarders version 8.0 require the existing installation to be version 7.0.x or higher. If the existing installation is version 6.6.x or lower, then you must upgrade to version 7.0.x as an intermediate step. See Upgrade paths to version 8.0 for more information. If you need to upgrade to 7.0.x first, then read the READ THIS FIRST topic for version 7.0 for important information on potentially breaking changes for that version. ... View more

Hi @ank15july96 , You can try spath as suggested by @to4kawa as it will extract all the fields json & xml. Below may help to extract the second occurrence... |rex field=_raw max_match=0 "errorCode\\\\\":(?<code>\d+)")  | eval code=mvindex(code,1)     ... View more

Great !! Appreciate if you could accept as solution....:) ... View more

Can you try changing the below..  In props.conf   [vmw-syslog] Tranforms-routing=discarlog,vmwarelogs ... View more

append command may help..  Query1 | eval Name="first"  | append [|search query2| eval Name="second"]  index=_internal | stats avg(kbps) as avg, max(kbps) as max,sum(kbps) as total | eval Name="_internal"| append [search index=_audit| stats avg(kbps) as avg, max(kbps) as max,sum(kbps) as total | eval Name="_audit"] | table Name avg max total ... View more

This seems to be sql syntax error, changing the below is getting validated in the below url. LI.created_on >= sysdate -1 https://www.eversql.com/sql-syntax-check-validator/   ... View more

This may help... Query 1 | appendcols [ search Query2] | appendcols [search query3] e.g:  index=_internal | stats count as col1 | appendcols [search index=_introspection | stats count as col2] | appendcols [search index=_audit | stats count as col3] ... View more

This may help.. index=main errorCode | rex field=_raw "errorCode\\\\\":(?<code>\d+)" | table code   ... View more

Thanks a lot for your quick help @esix_splunk. ... View more

Hi @esix_splunk,  Is the above state still true with newer version of Splunk. Can Splunk decrypt the encrypted data coming from external? ... View more

Yes. We need to add the base search with index, sourcetype & other filters to extract the events and get the forwarder ip value as mentioned.  Eg: Forwarder (field name) 123.456.78.912,+45.675.3.123,+32.123.456.55  ... View more

Please check if the below query helps. |makeresults count=10 | eval forwarder="123.456.78.912,45.675.3.122,32.123.456.54,12.45.78.912,45.675.3.122,32.123.456.54" |makemv forwarder delim="," | mvexpand forwarder | stats count by forwarder ... View more

You can try cron with the below to add /remove udp input. ./splunk add udp 514 -sourcetype yyyy -index xxxx -auth user:pass ./splunk remove udp 514 -sourcetype yyyy -index xxxx -auth user:pass ... View more

This may help... |makeresults | eval forwarder="123.456.78.912,+45.675.3.123,+32.123.456.55" | makemv delim="," forwarder (or) |makeresults | eval forwarder="123.456.78.912,+45.675.3.123,+32.123.456.55" | rex field=forwarder max_match=0 "(?<Forwarder>[^\,]+)" ... View more

Try adding the parameter max_match=0    base search | rex max_match=0 "regexexpression"   ... View more

I got into the same error...Has there any solution for this issue.... ... View more

we can use like below.. | stats count(HOSTNAME) | rex field=count(HOSTNAME) mode=sed "s/,//g" ... View more

This may help.. | rex field=count mode=sed "s/,//g" ... View more

The impact would be that the dispatch directory(/opt/splunk/var/run/splunk/dispatch) which stores this results set will get filled. Search head bundle will not have this result set.  https://docs.splunk.com/Documentation/Splunk/8.1.1/DistSearch/HowconfrepoworksinSHC#How_replication_works ... View more

This may help.. "value:\s+.{6}(?<val>.{2})" ... View more

This may help.. index=my_network sourcetype=snmp_trap_log (host="10.0.0.1" OR host="10.0.0.2" OR host="10.0.0.3") traffic=* |  timechart span=1m avg("(Mbyte per second)") ... View more

Hello, Is the table command outside gives still raw events of both the index. index=systemA NOT [search index=systemB | stats count by customer_ID | table customer_ID] | table customer_ID, systemA_Timestamp ... View more

This may help... base search  |stats count by src_ip src_port dst_ip dst_port | eval src=(replace(src_ip,"\.","").src_port) | eval dst=(replace(dst_ip,"\.","").dst_port) | table src_ip, src, src_port,dst,dst_ip,dst_port | eval commonid=if(src>dst, src.src_port.dst.dst_port, dst.dst_port.src.src_port) | eventstats count by commonid | where count > 1 ... View more