Hi, did u check the connectivity? where did u install the  Add-on? is it in HF? index=_internal source=*aad* did u check the internal logs?    ... View more

Hi, Ingest data through the Add-data option. And apply below six attributes on it. SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\<\?xml version= TIME_PREFIX=\<TransactionDateTime\> TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3Q+%z:%z MAX_TIMESTAMP_LOOKAHEAD=30 TRUNCATE=20000 ... View more

Hi, Try the below one the drilldown will not apply to the entire table. <drilldown> <condition match="'click.name2' == &quot;Training_Link&quot;"> <set token="testing">$row.Training_Link$</set> <link target="_blank">(Mention dashboard link here)?count=$row.testing$</link> </condition> </drilldown> ... View more

Hi, Can you try the below one. <input type="dropdown" token="user"> <label>field1</label> <prefix>user_token</prefix> <fieldForLabel>username</fieldForLabel> <fieldForValue>username</fieldForValue> <search> <query>| rest /services/authentication/current-context splunk_server=local | fields roles username | mvexpand roles | fields username</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> ... View more

Hi, Try the below one it will work.  Mention the filed name in the place of result.And field value in the condition. And we are passing the field value  "Newyork"  explicitly to the token. <drilldown> <condition match="'click.name2' == &quot;result&quot; AND 'click.value2' == &quot;Newyork&quot;"> <set token="testing">$row.Newyork$</set> <link target="_blank">(Dashboardlink)?result="$testing$"</link> </condition> ... View more

Hi, change the admin password and restart the service then you can able to put the server in manulal detention.Please follow the below steps. open the command prompt/terminal of your system. Find the passwd file( $SPLUNK_HOME/etc/passwd ) of Splunk and rename it as passwd.bk. mv /opt/splunk/etc/passwd  /opt/splunk/etc/passwd.bk Create a .conf file names user-seed.conf  in your $SPLUNK_HOME/etc/system/local directory.  cd /opt/splunk/etc/system/local/user-seed.conf [user_info] USERNAME=admin PASSWORD=<new_password> /opt/splunk/bin/splunk restart ... View more

Hi, use the below regex. | rex "response_from_above\s+(?<status>\d+)\s+user.*\s+(?<user>\w+)\s+\w+\s+\d" ... View more

Hi, Can run the below command in all the search heads and see what is the result it is showing? ./splunk show server name ./splunk show default-hostname ... View more

Hi, did u use the custom sourcetype? And the props.conf did you placed in indexers? I don't find any issue in the props.conf settings.     ... View more

Hi, check internal logs of the TA if there is any error you will be able to find it. ... View more

Hi, Can you take a sample data and ingest it through Add data option. And Go to Advanced settings and Apply the Magic 6 and see where exactly is the issue.  ... View more

Hi, Can you try with below changes. SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\<\?xml version= ... View more

This might help you.   ... View more

Hi, Can you follow the below steps given in the document. The Macro is using the Aws indexes and you need to replace all with custom indexes which you have created for aws logs. https://docs.splunk.com/Documentation/AWS/6.0.2/Installation/Useacustomindex ... View more

Hi, Please check in macro.conf is there any other index name is mentioned. And also in the below screenshot shows the warning like the required inputs has not been configured. You may get the data from the aws.But that data may not be useful for the app. So enable the below mentioned inputs in the hf and get those logs to the index.     ... View more

Hi, Whether logs are coming to index?  If logs are coming then I believe the app is not fetching the logs from correct index.Just check the default config of app is anywhere mentioned the index name in macro or eventtype. ... View more

Hi, You can use the below filter in the Syslog config. And it will filter only required logs. filter test{ match( "sgt=4" value("MESSAGE"));}; If you need to add an additional filter you can just use OR operation. filter test{ match( "sgt=4" value("MESSAGE")); or match( "provide your keyword" value("MESSAGE"));}; if this answer helps you then upvote it. ... View more

Hi, I am not sure how this will help you. But you can try with the below syntax which will assign all of your lookup values to a single field. eval newfield = fieldname1 + fieldname2 + fieldname3 + fieldname4 + fieldname5 ... View more

Hi, Is the server is red hat or Ubuntu? Can you check is there any extension after messages like mesages.log? Is there any error in splunkd.log? If everything is right can you remove the blacklist and ignoreOlderThan from the stanza and restart the forwarder and check again.  ... View more

Hi, You can write a correlation search for missing forwarders and select the alert type as a notable event.And you will get all the missing forwarder alerts as a notable event. ... View more

Hi, Try  below props and transforms. props.conf [sourcetype] TRANSFORMS-docker = eventsRoute Transforms.conf REGEX= $DockerNodeHostName (If this doesn't work try to give a unique keyword that can differentiate from other events) DEST_KEY = _MetaData:Index FORMAT = New index name If this reply helps you please upvote it. ... View more

Hi, If you need tutorial on kvstore.You can watch it in the below link. https://www.google.com/amp/s/hurricanelabs.com/splunk-tutorials/creating-and-cruding-a-kv-store-in-splunk-part-1/amp/ ... View more