Below one works for me.  | gentimes start=1 end=5 | eval [| makeresults | eval foo="test" | return foo] ... View more

Hi @rasikmhetre , You can add 'secret key' for the addon in the 'passwords.conf' file. The password will be encrypted once you restart the Splunk service.  Can you explain the issue that you are facing with CLI? ... View more

@mattcosa  Thanks for the response. I've managed to successfully authenticate Splunk using 'Auth0' a few weeks ago. Happy to share the config if required.  ... View more

Try out in the below format in the 'request headers'. (Replace the strike-out value with your token)     ... View more

@ghlogger  Try below config in 'authentication.conf' file.    [authenticationResponseAttrMap_SAML] role = http://schemas.auth0.com/roles   The attribute value is fetched using 'SAML Tracer' addon.  Also, make sure to create a 'Auth Pipeline' rule in Auth0 with below code to pull the roles during authorization. function (user, context, callback) { // Get the user roles from the Authorization context const assignedRoles = (context.authorization || {}).roles; // Update the user object. user.roles = assignedRoles; callback(null, user, context); }   ... View more

@ilyaresh Thanks for the guide. I followed the steps. But, I am getting below error when I hit my Splunk instance URL. Can you please assist? invalid_request: The SAML Request AssertionConsumerServiceURL is invalid: 'https://my-splunk-domain.com/saml/acs' ... View more

You can try 'Format'->'Row Numbers'.     ... View more

1. Make the app 'Splunk App for AWS' visible to all. 2. Also, check whether the lookup table 'cloudfront_edges' is populated. If not, run/schedule the report - 'AWS Description - CloudFront Edges ' ... View more

@datasearchninja Thanks a lot. It works. ... View more

Thanks. For me the error occurred, when we migrate 'Splunk_TA_aws' addon to a new server. The encrypted password in the 'passwords.conf' seems corrupted. When we re-configured the 'Key ID' and 'Secret Key' in the 'passwords.conf' file, the error disappeared. ... View more

Answer to this question will be helpful. However, @petersonjared , Can you raise this query as a separate question? ... View more

As per Microsoft Azure Add on for Splunk's documentation, the add-on is compatible to below versions. When I tried the add-on (EventHub data-input) in Splunk Enterprise 7.2.9.1, its works. COMPATIBILITY: Products: Splunk Enterprise, Splunk Cloud Splunk Versions: 7.3, 7.2, 7.1, 7.0 ... View more

Is this add-on works in Splunk 8.0.2.1? ... View more

Same here. Any assistance will be helpful. ... View more

I am looking for the same solution. May be a custom command using Python script will help. ... View more

Another interesting blog that guide to ingest 'AWS GuardDuty' data into Splunk https://www.splunk.com/en_us/blog/cloud/serving-it-up-with-aws-and-splunk-aws-serverless-application-repository-now-available.html This solution uses: AWS Serverless Application AWS Kinesis stream Splunk GuardDuty Add-on Splunk Http Event Collector ... View more

Where does the '#' comes from? ... View more

_audit index has file system changes info. You can start with something like below and refine the search query accordingly to your requirement. index=_audit action IN ("add","update","delete") ... View more

In my case, the error was due to expired user credential. ... View more

I'm glad you figured it out. ... View more

As per Splunk Docs, below syntax seems preferred. .. | where like (foo, "bar") ... View more

Yes, for changes in inputs.conf file, you have to restart Splunk instance. Alternatively, you can refresh Splunk instance without restart using '../debug/refresh' endpoint. But, it may not be applicable for all config file change. http://<yoursplunkserver>:8000/en-US/debug/refresh Reference: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Configurationfilechangesthatrequirerestart ... View more