@woodcock We recently move to S2 and our initital retention was set to 6 months. A month after the migration we decided to reduced the retention to 3 months but did not see any reduction in storage in s3. Support found out that versioning was enabled in AWS by the PS engineer during the migration and that caused this issue. Now the new data which is rolled over is deleted but we still have old cruft remaining in s3 which is costing us heavily. Support wants us to delete the data manually by running commands from CLI. Isnt there a better way in doing this? Does AWS lifecycle rules work only for old data which is still lying there? What are the ways to get rid of this old data apart from removing it manually.  ... View more

For the manual localize endpoint mentioned: curl -ku admin:changeme "https://localhost:8089/services/admin/cacheman/_localize" -X POST  Will it be localizing of all the buckets, of all the smartstore enabled indexes?  What are the specific endpoints for localizing an individual bucket or index? ... View more

If you could get the Forwarder field contains value: "123.456.78.912,+45.675.3.123,+32.123.456.55"   | rex field=forwarder "(?<numbers>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" max_match=3 max_match parameter should be maximum number since forwarder might have more than 10 values, depending on your use case. ... View more

At 9.0.1 it gives that actions as earlier index=_audit action=login* earliest=-4h | stats count by action   ... View more

https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore   an script for finding frozen bucket files in time range you gave shows folders + size + start time and endtime of logs contains on  each folder log + asks to unfrozen log  it may help you ... View more

I would like to take this moment to say that your best bet is to comment out this entry in the Nix TA until Splunk has a better way to get sourcetypes from linux - cron is a great source of data but it doesn't seem that Splunk cares about making the data actually useful, at least in this instance. If you can create your own sourcetype, you should definitely share it on Github, but other than that, I don't know that we're going to be seeing any tools for this any time soon. There may be a good use case for a supplementary TA that adds onto the linux TA which monitors standard files and assigns/defines the correct sourcetypes for them. ... View more

It depends on how busy the HF is, but it should be able to handle a HEC input. ... View more

Below link shows exact details for upgrading to 8.0.1 https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST Splunk Enterprise and Universal Forwarders must be version 7.0.x or higher to upgrade to version 8.0 Applicable components: Splunk Enterprise and Splunk Universal Forwarder Applicable OSes: all Version introduced: 7.3 Upgrades to Splunk Enterprise and Universal Forwarders version 8.0 require the existing installation to be version 7.0.x or higher. If the existing installation is version 6.6.x or lower, then you must upgrade to version 7.0.x as an intermediate step. See Upgrade paths to version 8.0 for more information. If you need to upgrade to 7.0.x first, then read the READ THIS FIRST topic for version 7.0 for important information on potentially breaking changes for that version. ... View more

Hello Sir, Based on the topic, I am trying to fetch the first time and the last time an error occurred in application logs, and thus used following query: - index="dummy" (search condition) |rex ...(?<error>.*?)...|stats count, min(_time), max(_time) by error I got for columns in results: error, count, min(_time) and max(_time). However, in column min(_time) and max(_time) I am getting values like: - 1631484056.103, 1631501959.541 respectively. Thus, I need your help to convert results of the two columns in readable format. Thank you ... View more

Can you check what is the character-encoding of that file, directly in the cli with command file -i lookup_name.csv? In my situation, the encoding type was different from  "text/plain; charset=us-ascii", was in fact "application/octet-stream; charset=binary". I opened the file in Notepad++, changed encoding to UTF8, loaded the file again to splunk with lookup editor, and it worked.   Let me know if this works for you also. ... View more

Dear friend, have you solved your problem ? I have the same requirements as yours. Hope you can share your stanza. ... View more

Please give me the entire log. There is also a way to do spath. ... View more

[vmw-syslog] Tranforms-routing=vmwarelogs,discarlogs [vmwarelogs] REGEX=(logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called) DEST_KEY=_TCP_ROUTING FORMAT=target1 [discarlogs] REGEX = . DEST_KEY = queue FORMAT = nullQueue   I have not been able to test on my own, but I believe your problem lies with trying to apply both transforms with one line of props.  It is possible for your events to match on both, so the the events are sent to the null queue, overriding the assignment to TCP ROUTING.  I would try reversing the order as @saravanan90 suggested, but also reducing the complexity of your [vmwarelogs] regex to one kind of event, until you have the routing down, then expand it to cover the other events. The example given in Splunk documentation supports this order. Props [source::/var/log/messages] TRANSFORMS-set= setnull,setparsing Transforms [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = \[sshd\] DEST_KEY = queue FORMAT = indexQueue https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues Lastly, check to make sure that the data is set to go through the parsing queue whereever you are attempting to apply props. ... View more

Great !! Appreciate if you could accept as solution....:) ... View more

append command may help..  Query1 | eval Name="first"  | append [|search query2| eval Name="second"]  index=_internal | stats avg(kbps) as avg, max(kbps) as max,sum(kbps) as total | eval Name="_internal"| append [search index=_audit| stats avg(kbps) as avg, max(kbps) as max,sum(kbps) as total | eval Name="_audit"] | table Name avg max total ... View more

This seems to be sql syntax error, changing the below is getting validated in the below url. LI.created_on >= sysdate -1 https://www.eversql.com/sql-syntax-check-validator/   ... View more

Thanks a lot for your quick help @esix_splunk. ... View more

It shouldn’t be too hard to bring it up for that port? Other option is use @saravanan90 option. Personally I don’t like to write admin credentials in plain text to servers! ... View more

thanks it works now!! ... View more

The impact would be that the dispatch directory(/opt/splunk/var/run/splunk/dispatch) which stores this results set will get filled. Search head bundle will not have this result set.  https://docs.splunk.com/Documentation/Splunk/8.1.1/DistSearch/HowconfrepoworksinSHC#How_replication_works ... View more

This may help.. "value:\s+.{6}(?<val>.{2})" ... View more

This may help.. index=my_network sourcetype=snmp_trap_log (host="10.0.0.1" OR host="10.0.0.2" OR host="10.0.0.3") traffic=* |  timechart span=1m avg("(Mbyte per second)") ... View more

Many thanks! ... View more