I don't remember the defaults but in order to send different logs into different indexes you need to configure inputs.conf on the forwarder. Then the forwarder sets the destination index when sending data to indexer which simply obeys. ... View more

Question is if the users don't see any raw events in the collect_license index or do you have any searches/reports that are not working on that index. That's because by default the sourcetype is changed to "stash" for collected events and thus your field extractions from the source sourcetype (ugly wording, I know) won't work. Other possible issue is that the time of events might change. Though the docs say "If you apply the collect command to events that do not have timestamps, the command designates a time for all of the events using the earliest (or minimum) time of the search range", I find it not entirely true. For example, I did a simple index=winevents earliest=-1d@d latest=@d | collect index=test2 on my home splunk free installation and even though original events had the timestamp set, I got all events in destination index timestamped at current time (2021-12-17T16:06:41.000+01:00). So your events might also be getting timestamped at wrong point in time.   ... View more

What do you mean by "split the output"? You can normally forward events received from another UF and have them indexed separarely from local internal logs. You can do local log ingestion as well. I have many such setups - for example when a customer has a site from which he doesn't have direct visibility to splunk infrastructure due to network segmentation and filtering issues. We use intermediate forwarders and everything runs smoothly. ... View more

The ldapsearch approach is a proper one I think. It's better to create a good set at the start than trying to filter it later. Unfortunately I'm not that proficient with AD LDAP attributes to hint how to look for what you want. ... View more

You're right. I missed that. Just read "duration" 😉 ... View more

Please remember that though updating and patching your servers is a good practice on its own, this CVE depends on user-supplied input to be exploited. Therefore log4j included in splunk_archiver seems relatively unlikely to be abused this way. Which means that it's generally good to be on the safe side and have this vulnerability patched but this particular occurrence isn't that critical. ... View more

Why wouldn't you want the internal logs in the first place? They can be very helpful in troubleshooting (and are used in forwarder monitoring if I remember correctly). And they don't eat your license. ... View more

Depends on what you want to achieve. Technically, you could even use the same crypto material for all servers. But that's against any reasonable good security practices. As a rule of thumb every subject should use its own certificate. This way you have control over authentication and authorization. Especially if we're talking about uf's which might be installed in various environments. If you installed them all with the same cert, compromise of the key from one forwarder would result in necessity to replace certs on all forwarders. And yes, I know that management of several dozens or hundreds of forwarders with certificates is a huge PITA. ... View more

The syntax looks ok, but each of your subsearches returns different set of fields. If you want to have three columns as output, you have to return the same set of fields from each of subsearches. Do a rename at the end of your subsearches so that the returned fields are named consistently.   ... View more

Whg do you specifically want to do this as other sourcetype? ... View more

Unfortunately, this does not solve possible license consumption issues. It's a very unusual case and there is no ready-made solution for this (at least none that I know of). Splunk on its own does not implement deduplication on inputs. Also, you have to remember that "the same" event could be ingested from different sources/forwarders and get sent to other peers in a cluster. Splunk would have no way of knowing that the event is duplicated. A slightly ugly solution would be to create your own modular input reading events from all those sources and performjng deduplication. But that would mean creating a SPOF in your infrastructure since you'd have to have a single collection point. Another possibility (albeit ugly as hell and even more license-consuming that the original one) would be to ingest the events initially into a temporary index and then periodically deduplicate them in search time collecting them into a destination index. Ugh. ... View more

Also, remember that you can show a string representation of a field while still keeping it numeric. For example | fieldformat percentage=(percentage.'%') ... View more

If you want it to match no value at all (immediate comma), change \w+ to \w*   ... View more

You have the values. Now all you need is to transform them to the proper format. If you have them like this: Message _time count failed 2021-12-15 1 failed 2021-12-14 1   You can do | xyseries Message _time count  To transform it to the table you want (ok, you'll still have ugly _time values so you might want to stftime it first). ... View more

Of course there are different approaches to support. I haven't used Splunk's support myself (I work for a partner and usually it's the customer who contacts the support if all else fails) so can't share my experiences with it. But. Well, Splunk Enterprise as such is a platform. A platform that can be used for many different things.  By comparison, you can't expect to set up a MSSQL server, give access to an SQL client to your employers and expect that they fully utilize its capacities, you can't expect that people who don't understand SPL and how the apps work and so on will be proficient Splunk power users. That's why it's typical for Splunk installation to have power users who can do many things on their own and also ordinary users who use preinstalled apps to get predefined reports and that's it. Just as with your typical RDBMS your users don't interact with the database itself but have some applications on top of it. If you want to learn, there's plenty of resources out there. The forum users here are helpful if they can answer the question. But as with any such voluntarily-provided help, you won't get far with demanding attitude 😉 But if your local Splunk environment doesn't have anyone to properly take care of it... well, that's mostly your internal problem and I'd strongly advise that you get some help from either Splunk's PS or your local Splunk partner if you don't have skilled people in-house. For the bugs, there's support. And no, end user is not the same as customer. Sorry, but that's how it works. As with practically every IT solution I know and I've ever deployed, you have a pre-defined list of people who are entitled to call the support. Why? Because support costs money. I suppose Splunk could offer your company a service with virtually unlimited number of people entitled to call support and file cases but that would cost so much that noone in their sane mind would pay it.   ... View more

There are usually two approaches you can take:  Account for all possible syntactically correct situations Just make minimum viable solution and adjust it possibly in the future if the one you have doesn't work anymore. Both have pros and cons. It's not that any of them is each time better than the other. It depends on what you're doing, where you're doing it and so on. One thing to take into account is that if you do something "wrong" in search-time, you can easily "fix" it later (I'm not sure how accelerated summaries react to that though) but if you're doing index-time extraction you can't "add" fields after the events have already been indexed. And as to the pattern itself... well, it's a bit tricky because I can't find a way to consume the quotes but not return them in a match. So you could do something like "field":(?<value>\w+|"(?:[^"]|\\")*") but that would capture the value of the field with the quotes. I don't know of any way to get rid of them without any postprocessing. (OK, maybe the conditional features of PCRE could allow that but that's ridiculous to write). ... View more

It seems you're overthinking it a bit 😉 Just use bin if you want fixed buckets and then do your stats count by message _time Oh, and if you compare to "-1d@d", it's not "last week", it's "yesterday" 😉 ... View more

I'm not exactly sure what you're trying to achieve. What should the subsearch resolve to? user_name="internal_user" AND Account_name="external-user" Just do your subsearch to include those two fields. If it's the same value, just add | eval Account_name=user_name at the end of your subsearch. If they are supposed to have different values, you have to look them up of course on their own. Can't tell you how though without knowing the lokup and its structure. ... View more

Mind you that this will also allow for any string not surrounded by quotes, not just null. But that on its own might not be that big of a problem, but it will also not work in general with any quotes delimited string possibly containing escaped quotes. ... View more

You say 3 but show 4 or 5 values. Since those results are (at least in your example) indistinguishable, there's no point in showing them separately. So it's either <your search> | sort website Duration | streamstats count by website | where count<=3 Or you could try <your search> | eventstats count by website Duration | sort website Duration | streamstats count as webcount by website | where webcount<=3 If you really want to have all values for the three distinct lowest values of Duration, that can probably be achieved but would be way uglier to perform. ... View more

Any device that can emit events in a fairly standardized way (most probably by syslog) is "compatible" with splunk. You just have to receive the events, parse them and react accordingly. ... View more

But you can get around this limitation. After the sort do | streamstats latest_time(eval(if(end="d",1,null()))) as lastd by ip | where end="s" and _time-lastd<300 I'm not sure if I didn't sort the wrong way or did the time comparison the wrong way around. But you should get the idea. ... View more