stoomart, your script appears to be exactly what I need, when I run the script in a RHEL 9 box it immediately transitions to the fsck command with a single bucket option, then displays an error message "path is not extant".  Your thoughts?  Also please clarify where you show "{index-name}", are you using the brackets to indicate placeholders or are they to be used in the thawed bucket path and at the end?   Thank you in advance for your help!   ... View more

Nope. It uses Python 2. ... View more

Thanks! This works great unless the SAML role mapping has been deleted. ... View more

This appears to still not have been fixed, even though we are at version 8.2.7. This is very disappointing from Splunk as it fills our logs with garbage and important logs get pushed out of the historical records.  Splunk engineers: This needs to be fixed now. ... View more

Hi , I would like to onboard MAC PC all Browser's history in to the Splunk. Please suggest best way to onboard those logs. ~/Library/Safari/  ~/Users/<username>/Library/Application /Support/Firefox/Profiles ~/Users/<username>/Library/Application/Support/Google/Chrome/Default/History ... View more

@RDAVISS That search doesn't work if you have the Splunk_SA_CIM installed because "action" will never equal "login attempt" [audittrail] EVAL-action = case(match(_raw,"action\=login\sattempt") AND match(_raw,"info\=succeeded"),"success",match(_raw,"action\=login\sattempt") AND match(_raw,"info\=failed"),"failure",match(_raw,"action\=add"),"created",match(_raw,"action\=delete"),"deleted",match(_raw,"action\=update"),"modified",1=1,action) EVAL-app = if(match(_raw,"action\=login\sattempt"),"splunk",app) Try it without action= index=_audit "login attempt" "info=succeeded"   ... View more

Just to update this thread and share that this stills working My context: I deployed recently a cluster env. and did not noticed that i my filesystem was getting close to the limit I realized when all my indexers status=AutomaticDetention As i was aware that the data was useless i followed your approach and worked ... View more

Hello, We have the same issue, we are currently using a Regex line breaker to remove the outer layers of json added by the event-hub (as well as the x-opt-sequence-number, x-opt-offset and x-opt-enqueued-time fields) and only get the events themselves. It is not ideal, but it works so far.   (\s*\{\"body\"\:\{\"records\"\:\s*\[)|((?<=\}),(?=\{\s*\"))|((?<=\})\]\},\"x-opt.*\}\s*\{\"body\"\:\{\"records\"\:\s*\[)|((?<=\})\]\},\"x-opt.*\})   First group catches the first of new messages, second group catches the events nested in records, third groups catches the end of a message and the start of a new one, fourth group catches the end of the last message. Hope this helps, it might need to be tweaked depending on the resource. ... View more

If you're talking about having the Inputs pull the data again, the checkpoint info is stored here $SPLUNK_HOME/var/lib/splunk/modinputs/sfdc_object. You can go there and delete the individual directories/files or just the ones you want to reset. ... View more

@agcorreia i converted @ncarey comment to an answer, kindly review and let us know if it works for you. if it does, please accept the answer. otherwise, please provide more information ... View more

We updated /opt/splunk/share/GeoLite2-City.mmdb and started getting these errors. sha256sum in installed on RHEL so we did this. Get the new checksum. Change the checksum in the manafest. Validate. Restart. sha256sum /opt/splunk/share/GeoLite2-City.mmdb c38113090d1910279f0eff39f0f4e69b8e1e76d9676a16d31d5735c7c9d15d37 /opt/splunk/share/GeoLite2-City.mmdb vi /opt/splunk/splunk-*-manifest f 444 splunk splunk splunk/share/GeoLite2-City.mmdb c38113090d1910279f0eff39f0f4e69b8e1e76d9676a16d31d5735c7c9d15d37 splunk validate files Validating installed files against hashes from '/opt/splunk/splunk-*-manifest' All installed files intact. splunk restart ... View more

Thanks @dfronck , we'll update our version today and then check it again. ... View more

any chance you can share a properly redacted version? ... View more

Once you install the UF, you can use this simplistic script I wrote that pulls the logs I needed. It just uses the "log show" command to dump the logs and then greps out the stuff in the include file. Note: "log show" requires admin. My answer here has a tar file that contains the script. https://answers.splunk.com/answers/547865/mac-os-x-sierra-how-to-get-all-logs-from-the-unifi.html #!/bin/bash # Usage: ./mac_log_monitor.sh # Runs the Macintosh log show command to get Macintosh user logs from START_DATE to END_DATE. DATE_PATH=$SPLUNK_DB/persistentstorage/uf_macintosh # Setup the date file. DATE_FILE=$SPLUNK_DB/persistentstorage/uf_macintosh/last_run_date.txt # Setup the date file. if [ ! -e "$DATE_FILE" ] # Does the date file exist. then # No. date file does not exist. if [ ! -e "$DATE_PATH" ] then mkdir $DATE_PATH fi date -v -1w +"%F %T" > $DATE_FILE # Set start date to -1 week to get old logs. Redeploying overwrites this. fi START_DATE=`cat $DATE_FILE` # Set start date for log reading. date +"%F %T" > $DATE_FILE # Set new start date for next run. END_DATE=`cat $DATE_FILE` # Set end date for log reading. # File with keywords to grep from logs. INCLUDE=$SPLUNK_ETC/apps/uf_macintosh/local/include.conf # File with keywords to exclude from logs. EXCLUDE=$SPLUNK_ETC/apps/uf_macintosh/local/exclude.conf # Macintosh log command. Need to figure out predicaate so we can pull the logs we need instead of everything. #log show --predicate [] --style syslog --start [] --end [] --info --last [] # Should really have an if to check for the existance of include/exclude log show --style syslog --start "$START_DATE" --end "$END_DATE" | egrep -f $INCLUDE | egrep -vf $EXCLUDE ... View more

You should mark this as answered. ... View more

I found you can also edit the SplunkforPaloAltoNetwork/metadata/local.meta file and add these three stanzas: [props] export=system [transforms] export=system [lookups] export=system I'm guessing that because the default.meta has those specific entries, even though sharing the configurations through the GUI adds a global stanza [], it is not overriding those specific stanzas in the default.meta file. ... View more

I agree with hgrow. I don't think you can have 2 stanzas dealing with the same log source. So instead of using _TCP_ROUTING in inputs, use props and transforms. props.conf (Not sure about the source.) [source::///var/log/mule/.../*] TRANSFORMS-routingto2splunks = log_to_splunk1, log_to_splunk2 transforms.conf [log_to_splunk1] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = splunk_prod [log_to_splunk2] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = twd104 ... View more

Hello guys, could you confirm we should copy thawed buckets into colddb instead of thaweddb in 6.5.2? Thanks. ... View more

I am in Brisbane and don't want this timestamp how do I change the query to show ReceivedUTC +10 ... View more

It should also be noted that if indexer acknowledgement is enabled on the forwarder, you may also observe a historically large number of these events as a result of the high latency: "TcpOutProc - Read operation timed out expecting ACK from xxx.xxx.xxx.xxx:xxxx in 300 seconds" and "TcpOutProc - Possible duplication of events with channel=...", and therefore further complicating the Universal Forwarder falling behind on events. ... View more

The Citrix TA default inputs.conf should set the sourcetype to appflow. IPFix sets the source and host to Host:Port:Observer. I use a transform to set host to the IP address. [netscaler_appflow-change-host2source] SOURCE_KEY=MetaData:Source REGEX=source::(\d+.\d+.\d+.\d+):\d+:\d+ FORMAT=host::$1 DEST_KEY=MetaData:Host ... View more

Real-time alerts spammed our dispatch folder and ended up breaking the entire Splunk interface. Cleared /var/run/splunk/dispatch and modded the real-time alerts and boom, fixed. If anyone doesn't know cron schedules, setting to "* * * * *" should fix this problem. It's alerting every minute instead of real-time. ... View more