Hello, The issues got resolved. The port 8088 was used by other services causing that issue, had to kill that service to resolve that issue. Now working as expected. Thank you so much all. ... View more

Below is how an inputs.conf would look like. [http://adt] disabled = false sourcetype =adt:audit token = 977xx0B5-E5xx-4xx1-A894-B5DA75XX3A31 indexes =adt_audit index =adt_audit  For creating a token you can use  token generator tools like thishttps://www.uuidgenerator.net/  -  Each token has a unique value, which is a 128-bit number that is represented as a 32-character globally unique identifier (GUID). Agents and clients use a token to authenticate their connections to HEC.  Another way is can create something from web via data inputs >http> and it get saved on the etc/apps/splunk_http_input/local/inputs.conf to see what it looks like.   Hope this helps, please upvote or solved if this solution is helpful. ... View more

Your existing props.conf settings are good for telling Splunk how to extract _time from the events.  Don't try to put _time into human-readable format.  That's done automatically at search time.  Forcing it at ingest time will break how Splunk stores and retrieves events. If you need another field to contain a human-readable form of _time then do it at search time using EVAL in props.conf. [myprops] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) TIME_PREFIX = "timestamp": TIME_FORMAT = %s%3N EVAL-timestamp = strftime(_time, "%Y-%m-%dT%H:%M:%S.%3N") This applies to all apps, not just Enterprise Security ... View more

The number of backslashes in the data doesn't matter, it is the number of backslashes in the regex string I was talking about. Backslashes normally need to be escaped (with a backslash), however, sometimes these backslashes have to be escaped as well, hence the need for 4 backslashes to represent a single backslash. Try something like this (which allows for escaped (backslashed) commas in all the columns). (?<Col1>.+?(?<!\\\\)),(?<Col2>.+?(?<!\\\\)),(?<Col3>.+?(?<!\\\\)),(?<Col4>.+?(?<!\\\\)),(?<Col5>.+?(?<!\\\\)),(?<Col6>.+?(?<!\\\\)),(?<Col7>.+?(?<!\\\\)),(?<Col8>.+?(?<!\\\\)),(?<Col9>.+?(?<!\\\\)),(?<Col10>.+?(?<!\\\\)),(?<Col11>.+?(?<!\\\\))$ Again, it might be that you only need two backslashes each time instead of four. ... View more

The you should use the index with list of indexes to search as the subsearch, i.e. put your meta search in the subsearch and it will return the index you want. [ | search index=meta_info sourcetype=meta:info | search group_name=admingr AND spIndex_name=admin_audit | rename spIndex_name as index | fields index ] In the form above, it's totally hard coded, but I assume the spIndex_name= statement is variable.   ... View more

Try with coalesce | eval nameA=coalesce(nameA, nameB), addressA=coalesce(addressA, addressB), cellA=coalesce(cellA, cellB) | eventstats count by accid nameA addressA cellA | where count==1 ... View more

Looks like you don't have nested json events in there, so have you tried to just regex by the } and { characters? Try this: [your_sourcetype] SHOULD_LINEMERGE = false LINE_BREAKER = \}\s+\{ ... View more

Hi @SplunkDash , I don't know why, but the form adds a part to the address. remove all the chars after 742 in the url address. or go in apps.splunk.com and search Splunk Add-On for Windows. Ciao. Giuseppe ... View more

To be fully honest, if your data is a well-formed XML, I'd just go for KV_MODE=xml ... View more

Hi @SplunkDash  I can see a few things... 1. This is a search time extraction so need to be specified it on the search head (maybe you have)      - this can be done via the SH UI too 2.  You've specified the REGEX like an inline field extraction (see props.conf.EXTRACT) so you would not have to use transforms configuration for this (though I believe it does work in transforms). 3. The regex is not quite right Try this instead (inline or transforms)    {"UserID":"(?P<UserID>\w+)","UserType":"(?P<UserType>\w+)","System":"(?P<System>\w+)","UAT":"(?P<UAT>.+?)","EventType":"(?P<EventType>.+?)","EventID":"(?P<EventID>.+?)","Subject":"(?P<Subject>.+?)\","EventStatus":"(?P<EventStatus>.+?)","TimeStamp":"(?P<TimeStamp>.+?)","Device":"(?P<Device>.+?)","Msg":"(?P<Message>.+?)"}   Having said that, the example events are a good example of using the power of transforms to match reoccurring patterns and extract them as key value pairs.   In that case the transforms.conf settings would be something like this.   [fieldEtraction] REGEX = "([^"]+?)":"([^"]+?)" FORMAT = $1::$2   The REGEX specifies two capture groups and the FORMAT extracts each group as field = value, repeatedly (up to 10000 times, by default). Some doc links as reference https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Transformsconf#transforms.conf.example https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Propsconf#Field_extraction_configuration Hope that helps ... View more

Hi @SplunkDash, I mean that, if you already have a Splunk Partner, you can ask to it a quote for the license. If not, you can see in the splunk.com site footer where you can find "Contact sales". Ciao. Giuseppe ... View more

Hi I haven’t seen any recommendations for ingested files. More important is how much events come to it and could UF read it faster than new events come! This situation could cause delays for source events on this host especially if there are lot of files. 2.2GB/day isn’t any issue for UF if your source node can handle to generate that log. r. Ismo ... View more