Hello! I have a log that shows locking/unlocking PCs: 1710320306,u09,unlocked 1710320356,u09,locked 1710320360,u10,unlocked 1710320363,u10,locked 1710320369,u11,unlocked 1710320374,u11,locked 1710320379,u09,unlocked 1710320384,u09,locked 1710320389,u10,unlocked 1710321119,u10,locked 1710321126,u11,unlocked 1710322754,u11,locked 1710322760,u09,unlocked 1710324580,u09,locked 1710326550,u09,unlocked 1710328364,u09,locked The first field - unix timestamp, second - user, third - action. I need to get a statistics for PCs beeing unlocked by users. So it will the sum of seconds between unlocked-locked actions for each user. Please, help with search query ... View more

I have proxy logs, in which I am interested in 4 fields: the ip address of the user's computer, the category of the site he visits and the total amount of incoming and outgoing traffic for each category. Now I got such a table, but I needed it to be like in the second table on the screenshot. I just can't find a solution, I ask the SPL guru to help me))) My query: index=proxy  | stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut, values(category) by src_host ... View more

Hello!  I need to collect some data from PCs, that are the part of the industrial machines. These computers run Windows XP (x86) and 7 (both x86 and x64), which are no longer supported by either Microsoft or Splunk. Also, the organization has deployed Splunk Enterprise version 8.1, that is, I eventually need to enter data from these computers into Splunk server. To summarize, I need installation files of the latest releases of Splunk for: 1. Splunk UF for Windows XP x86 2. Splunk UF for Windows 7 x86 3. Splunk UF for Windows 7 x64 4. Splunk Enterprise (x64) which is compatible with Windows XP UF (for HF deployment) 5. Splunk Enterprise (x64) which is compatible with Windows 7 UF (for HF deployment) Also, I found that Splunk didn't remove installation files from download site, only remove the links from download page. For example, I found the direct download link for 6.2.0 version, but I don't know for which Windows version it is: https://download.splunk.com/products/splunk/releases/6.2.0/windows/splunk-6.2.0-237341-x64-release.msi I would be very grateful if someone shares such links or the installation files themselves, because the Splunk Support replied that "nothing can help"... ... View more

Hello! I want to ping some host on the Internet from every UF in my network to quickly find out about its availability/unavailability. The simplest way would be to write a script, but no matter how much I tried to write a bat, nothing came of it. Perhaps someone has already solved this issue and can share the script, or else help to write it correctly. No matter what format the output of the script will be, the main thing is that this output can be used to determine the availability of the host. Here's what I tried:         ping -n 1 www.google.com @echo off ping -n 1 www.google.com | find "TTL=" > nul if errorlevel 0 echo Ping successful         Both scripts inject the system into recursion and do not output any ping results. I am a noob in bat scripts, please, help me... ... View more

We have Splunk Light Cloud instance with ~2TB of collected data. We want to migrate to on-prem Splunk Enterprise. Is there the possibility to export all data (indexes) from Splunk Light Cloud (very important data for us) and import its to Splunk Enterprise? How can we do it? Will it cost some extra money? ... View more