Hi all, I'd like to create an alert that checks whether, as a triggered action of an alert, an email is being sent with an empty attachment. It would be also nice to check whether the alert fails for any reason and the email is not being sent at all. I've found the status of the saved search in scheduler.log, but I wasn't able to find anything regarding attachments. Any idea? Thanks! ... View more

Hi Community, I have this global setting in inputs.conf:   [http] enableSSL = 1 port = 8088 requireClientCert = false serverCert = $SPLUNK_HOME/etc/auth/my_certificates/certificate.cer     I have 2 [token_name] stanzas configured working fine but now I have the need to use a different server certificate for one stanza. So I'd like to do something like this:   [http://stanza1] token = token1 index = index1 sourcetype = sourcetype1 [http://stanza2] token = token2 index = index2 sourcetype = sourcetype2 serverCert = $SPLUNK_HOME/etc/auth/my_certificates/certificate_2.cer     I'm not sure it is possible though since in the doc it is written that per-token settings are only these: connection_host disabled index indexes persistentQueueSize source queueSize sourcetype token   Any hint?   Thanks, Marta   ... View more

Does anybody know a good way to filter out AWS Cloudtrail events? I'd like to send to null queue events that contains eventType=AwsApiCall. My input is configured as "Generic S3" (https://docs.splunk.com/Documentation/AddOns/released/AWS/S3) This is what I have on my HF where the Splunk_TA_AWS is installed and configured: transforms.conf   [eliminate-AwsApiCall] REGEX = \"eventType\":\s+\"AwsApiCall\" DEST_KEY = queue FORMAT = nullQueue   props.conf:   [aws:cloudtrail] TRANSFORMS-eliminate-AwsApiCall = eliminate-AwsApiCall     Doesn't seem to be filtering ... any thoughts?   Thanks Marta ... View more