What if your environment has deployment\licenses on the same server. Will upgrading the server have any impact on the other servers on a lower version?  ... View more

He asked for the other way. Archer data to Splunk. Not Splunk to Archer ... View more

Has this been answered? Will the splunk app support 13.1 netscaler. ... View more

Sorry thought that was included. Technology Inventory Add-on for Splunk https://splunkbase.splunk.com/app/3032/ ... View more

Had to change the max_mem_usage_mb in the local\limits.conf file on each search head. Default was 500. [mvexpand] max_mem_usage_mb = 2500 index=something | eval soft_=Software_Installed | eval ver_=Software_Version | makemv soft_ delim=" ," | makemv ver_ delim=" ," | eval soft_zip = mvzip(soft_, ver_) | mvexpand soft_zip | rex field=soft_zip "(?.),(?.)" | table * ... View more

Looks like it is working now. Thanks for your help. ... View more

I changed the following on the search head cluster. [mvexpand] max_mem_usage_mb = 2500 the systems have plenty of ram. How high can we go for this setting? the report would run every 12 hours and output(overwrite) to a lookup. The error stopped but it still is not showing all of the data. there are over 4000 devices. Either still ram or the row returned max. before the change it showed 51400 rows which was only 19 device ( used Excel to remove duplicates). After the change it shows over 246k rows for 23 devices. But no memory error. ... View more

The SPL works. But is only returning 51400 rows. Root cause the max_mem_usage_mb in the limits.conf is 500 MB and the search exceeds this. May have to change both settings below. max_mem_usage_mb = 500 #default memory usage per search is 200MB probably need to increase to support that many rows [searchresults] maxresultrows = 86400 #default return for rows is 50000 ... View more

I got it to kinda of work. The delimiter in the data was " ," instead of ", ". However, when i run index=something and filter only items with something in Software_Installed. I get over 9,000 unique CI_Name items. the same search with the added extracts creates 52600 rows. But, only has 169 unique CI_Name items. index=something | table CI_Name Software_Installed, Software_Version | eval soft_=Software_Installed | eval ver_=Software_Version | makemv soft_ delim=" ," | makemv ver_ delim=" ," | eval soft_zip = mvzip(soft_, ver_) | mvexpand soft_zip | rex field=soft_zip "(?.),(?.)" | table CI_Name Software_Installed, Software_Version, soft, ver, soft_, ver_ ... View more

Parts of it work. But it only returns 15,000 CI_Name. soft = the Softeware_Installed and Software_Version ver= just the first value of the multi-value Software_Version Index=something | table CI_Name Software_Installed, Software_Version | eval soft_=Software_Installed | eval ver_=Software_Version | makemv soft_ delim=", " | makemv ver_ delim=", " | eval soft_zip = mvzip(soft_, ver_) | mvexpand soft_zip | rex field=soft_zip "(?.),(?.)" | table CI_Name Software_Installed, Software_Version, soft, ver, soft_, ver_ ... View more

That works as a stand alone search. But returns no data when adding our search. index=something | table Cl_Name, Software_Installed, Software_Version | eval soft_=Software_Installed | eval ver_=Software_Version | makemv soft_ delim=", " | makemv ver_ delim=", " | eval soft_zip = mvzip(soft_, ver_) | mvexpand soft_zip | rex field=soft_zip "(?<soft>.*),(?<ver>.*)" | table Cl_Name Software_Installed, Software_Version, soft, ver or since | makeresults must be the first command. the index=something returns over 15,000 CI_Name, but this search returns 0. If it would work I would expect 2 million rows. So CI_Name X (Software_Installed X Softeware_Version). | makeresults [| search index=something] | table Cl_Name, Software_Installed, Software_Version | eval soft_=Software_Installed | eval ver_=Software_Version | makemv soft_ delim=", " | makemv ver_ delim=", " | eval soft_zip = mvzip(soft_, ver_) | mvexpand soft_zip | rex field=soft_zip "(?<soft>.*),(?<ver>.*)" | table Cl_Name Software_Installed, Software_Version, soft, ver ... View more

The only way I found. Thanks to PS. Unfortunately, there’s no way to do this currently. The issue isn’t with the JSON format. The permissions on that particular KV Store collection are purposefully locked down. Changing those permissions is heavily advised against internally. Running the | rest command in Search against that endpoint will not produce any results. The only way to get that data is to run a curl command from the command line. The screenshots below show both cases. As for the command line output, that’s standard JSON that could be indexed and searched on. ... View more

In DBConnect 2 error t', params: 'None', caused by: Exception(\' com.microsoft.sqlserver.jdbc.SQLServerException: The value is not set for the parameter number 1..\',).',)" ... View more

I get the same error when changing password and using the local splunk admin account. We have a 2nd searchhead cluster for ES that had no issue, and all of the setting are the same. ... View more

We have the same issue. and change the start date to get it working. We also have the same issue with IP360 data being collected with DBConnect. ... View more

How does msad-dc-health translates to: eventtype=powershell sourcetype="MSAD:*:Health"? Returns data: source=powershell sourcetype="MSAD:*:Health" |stats count by DomainNetBIOSName,host|where length(DomainNetBIOSName)>0|rename DomainNetBIOSName as src_nt_domain|table host,src_nt_domain Returns nothing: eventtype=msad-dc-health|stats count by DomainNetBIOSName,host|where length(DomainNetBIOSName)>0|rename DomainNetBIOSName as src_nt_domain|table host,src_nt_domain ... View more

Also, if you have a object with the same name you will get this error. Like a report and alert with the same name. ... View more