I tried the GUI and is just not feasible as the export is in txt format (limitations). Is there a way to just copy (create a backup) or tar existing data locally without having to use queries or cli tools? ... View more

Hi  thambisetty I tried the dump query and I can see the SID directory, but no dump or file is found after the search is completed (finished with 9 events). This is the query I'm using index=something sourcetype=something | eval _dstpath=strftime(_time, "%Y%m%d") | dump basefilename=something_something I will try to export using GUI and see how that works out for me.  ... View more

You're right, mount points were missing. thank you ... View more

Thanks for the information. This is what I'm getting from the logs ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/PureStorage-TA/bin/PureStorage_rest.py" /opt/splunk/etc/apps/PureStorage-TA/bin/requests/packages/urllib3/connectionpool.py:768: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html   how do I go about fixing this? ... View more

of course, keep in mind I'm not all that familiar with splunk config. This splunk infrastructure was passed down to me.   I installed PureStorage app and the TA. They were installed on a indexer and heavy forwarder, our infrastructure consists of 6 indexers, 6 search heads, 1 cluster master, 1 deployment server, and 2 heavy forwarders. To answer your inputs question, how do I look that up? is it under the installed app (inputs.conf). Where do I look for issues in the logs? is it the ones in splunkhome/var And, yes...I can see the data on the appliances and splunk would just feed off of that I suppose ... View more

Thank you, just had to use upper-case "c" and it worked. ... View more

Here is the field from the events ... View more

I already provided that info in my previous posts. ... View more

Thanks for replying, but unfortunately neither worked as the search returned all the values ignoring the input lookup file to exclude the sig id. Is there another way to exclude multiple values?    ... View more

Search    index=security-snort sourcetype="snort" | search NOT [ | inputlookup SnortSigEx.csv | fields signature | format] | stats values(name) as name by signature | dedup signature   ... View more

Thanks for replying, but unfortunetely I'm still seeing the IDs in the search results...which are supposed to be excluded.  Does the lookup file need to be in a certain format (header names)? Permission are set to all apps and for admin and power users Note: I'm an Admin ... View more