Hi Everyone, after i select the source type i am getting below error while using ingest actions. I had to update the pass4symmkey as ingest actions required to setup custom pass4symmkey Connection testing failed in all remote clients: [https://*.*.*.*:8089]. This can be caused by misconfiguration of secret key or event capture is not supported in those remote splunk instances.   ANy idea what is happening? ... View more

Hi Everyone, When i am trying to update "Splunk App for Windows Infrastructure" the login screen where it asks to provide splunk.com credentials does not proceed further, i checked my credentials and they seem to be correct.   any idea why i am unable to update the app? i am able to update other apps fine ... View more

Hi, I have a bar graph which is not showing full y-axis value when the value have more words. Is there a way we can force dashboard to display full value   Example: Instead of "Monthly Patch Update" it is displaying as "Month...pdate" ... View more

Hi, I have below search, i have clubbed 3 searches into 1. Each individual search is working fine but when i clubbed its not able to pull data from previous year and the table shows empty values fore few months   index=dev AND "alpha" | dedup _time| eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as alpha | appendcols [search index=DEV AND "[beta]" | dedup _time|eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as beta] | appendcols [search index=dev AND "gamma" | dedup _time| eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as gamma]   ... View more

Hi, I have 2 searches where the dedup strategy is different, i want to combine the 2 searches but need help with dedup strategy.  Search 1: index=prod sourcetype=error AND "IOS" | dedup notification, source  Search 2: index=prod sourcetype=error AND "Android" | dedup _time -> For "IOS" i need to dedup with only notification, source  and for "Android" i need to dedup only with _time index=prod sourcetype=error AND ("IOS" OR "Android") | dedup ?????   ... View more

My Query:  index=test sourcetype=true AND private AND beta |rex field=_raw "\[private]\s(?<category>\S+\s+\S+\s+\S+)" |dedup category, source|eval category=upper(category)| stats count by category |rename count as count1| appendcols [search index=test sourcetype=true AND private AND alpha |rex field=_raw "\[private]\s(?<category>\S+\s+\S+\s+\S+)" |dedup category, source|eval category=upper(category)| stats count by category |rename count as count2]| eval Total=(count1-count2) So when the 2nd query doesn't have any events i am not getting the Total column Current output if the 2nd search doesn't have any events: category      count1       xxxx                  5   Desired output: category      count1         count2     Total xxxx                  5                    0                  5 ... View more

Hi, I have below log file, I would like to build a table out of it (Line1, Line2,Line3,Line4 are just for understanding) Line1: 2022-05-22 02:02:20 PM UTC False [Android] Password Expiration Notice Line2: 2022-05-22 06:05:49 PM UTC True [Home] [Android] Password Expiration Notice Line3: 2022-05-29 04:24:52 AM UTC False [Android] High Memory usage Google Line4: 2022-05-29 06:05:49 PM UTC True [Android] Password Expiration Notice Desired Table: Issue                                                             True      False Password Expiration Notice                     2          0 High Memory usage Google                     0           1   Caluclating False: Line1-Line2 i.e. i need to Subtract count of events with "True [Home]" from "False" Caluclation True: Number of events with "True" ... View more

Hi, I need help to extract the 3 words after [yyy] using regex,  True [xxx] [yyy] Issue with ios phone 11 False [yyy] Issue with android phone True [yyy] Issue with windows phone     ... View more

Hi, I have my current search giving below output, I want to have stats listed by Month. Can someone help on this one Current Search:  my search |  eval True=(total1-total2) | eval False=round(False/(True+False)*100,2) | table False Output:        False                         42.12   Desired Output:  Month      False August    42.12 July           xx.xx june           xx.xx . . . ... View more

Hi, My search is giving below output, Month  FieldA    FieldB Jan         285      1410 Feb         247      1934 Mar         215      2197 Can we create a new column with FieldA% and FieldB%, below is the example Month  FieldA    FieldB   FieldA% FieldB% Jan         285      1410        20%           80%       Feb         247      1934         22%          78% Mar         215      2197         15%           85% Eventually i will only be using Month and FieldA% in a column chart ... View more

Hi, So i am trying to index the log file data.log, log file is 2 days old and splunk is indexing only the latest events. Is there a way i can index the older events in data.log ? ... View more

Hi, I have configured my windows forwarder to use the custom CA and Server certificate. Below is the configuration and the forwarder is able to connect to indexer fine. File: C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = XXX:9998 clientCert = C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\testCertificate.pem sslPassword = XXX useClientSSLCompression = true sslRootCAPath = C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\myCAcertificate.pem [tcpout-server://XXX:9998] But still in the splunkd.log file i am seeing below message, X509Verify [14596 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates   Any idea if I am missing any configs here? ... View more

Hi, I have the below log entry, can you help with the regex to extract the line in Red. The regex i have is not working properly in props.conf   2021-09-23 19:03:40.802 INFO 1 --- [sdgfsdgsdfgsdfg] asdfasdfasdfasfasfgfdhdfhdf : Response --> { "claimId" : asfdasdfadf, "claimFilerId" : "sadfasdf", "vendorName" : "asfasfadfadf. ", "vendorId" : "aefadf", "vendorAddressId" : "asfafsd", "vendorAddress" : "sdfgsdgsfg", "preparedDate" : "09-22-2021", "receivedDate" : "09-22-2021", "enteredDate" : "09-22-2021", "assignedTo" : { "employeeId" : "sdfasdf ", "firstName" : "asfasf", "lastName" : "zsdfdf", "adUserIdentifier" : "zsdfvzdv" }, "correspondence" : { "type" : { "code" : 5947, "shortName" : "EOB", "longName" : "EOB" }, "dispatchCode" : { "code" : 5947, "shortName" : "NtRqd", "longName" : "Not Required" }, "emailAddress" : "abcd@g.com,       dgfh@a.in" } ... View more

Hi, I have the below source, values in Red will keep changing source="/Application/logs/b80be40606aa7860f7de0c7ffa6b9d740581ec6035bc450ff5dfa3/apply-service/example.google.local:9818/Application-services/applyy-service:build-000/apply-service-464-xmp/system-out-dev.stdout"   in props.conf i tried below definitions but it is unable to pickup, how can i use wild cards to pick the correct source? 1) [source::/Application*] TRANSFORMS-anonymize = address-anonymizer 2) [source::/Application/logs/*/apply-service/*/Application-services/*/*/system-out-dev.stdout] TRANSFORMS-anonymize = address-anonymizer     ... View more

Hi,   We have this same log entry, 2021-09-14 13:20:08.325 DEBUG [,88538eaa548c8b64,88538eaa548c8b64,true] 1 --- [tp1989219205-24] m.m.a.RequestResponseBodyMethodProcessor : Writing ["ping"] 2021-09-14 13:20:08.325 DEBUG [,88538eaa548c8b64,88538eaa548c8b64,true] 1 --- [tp1989219205-24] m.m.a.RequestResponseBodyMethodProcessor : Using 'text/plain', given [*/*] and supported [text/plain, */*, text/plain, */*, application/json, application/*+json, application/json, application/*+json] I want to mask MethodProcessor string so it is not visible in logs.  Can someone provide the regex i can use?     ... View more

Hi, I have below output with my search,  base search| stats count by User, action User action count Alex install 3 Alex uninstall 5   But i would like the table to display as below User install uninstall Total Alex 3 5 8   Please Let me know if this is possible ... View more