. ... View more

please suggest the add on used to get pharse data for the following devices,   1. Cisco Switches 2. Cisco WLC 3. Cisco Routers 4. Cisco Firewalls/IPS 5. windows AD 6. Windows DNS 7. Windows DHCP 8. Cisco VOIP 9. Cisco Umberlla 10. Cisco EDR 11. SAP ERP 12. Cloud services - Azure ... View more

Details of the event Please tell me how to pass the time of the search result in "Link to search" on the dashboard. For events that include time in search results, such as the attached sample dashboard When searching using the "link to search" function, I would like to pass the time of the event as a parameter. Currently, earliest / latest is specified for SPL as shown in the sample. However, in this case, the time range picker when executing the search is not the earliest / latest specified by the parameter. The time range picker on the dashboard will be set. In the actual search, the earliest / latest specified in SPL is prioritized, so the result is as expected, but Since the range of the time range picker is different from the actual search result, users are confused. question 1 How can I pass the earliest / latest specified in SPL to the time range picker when executing a search? Question 2 In this sample, $ click.value $ is used because the time field is on the far left. Please tell me how to specify when passing the time field in any column. For reference, if you specify "$ row._time $", unlike the case of $ click.value $, it is not UNIX time. The displayed time has been set as a parameter. ... View more

Heavy Forwarder is installed to acquire Azure AD logs. Add-on uses the following. Splunk Add-on for Microsoft Office 365 Please tell me the following description of the above Add-on troubleshooting. It is a recognition that duplicate log capture may occur, What are the conditions under which duplicate logs occur?  ... View more

what is the need of metadata files under /etc/apps/appname/metadata, why it is modified continuously? @all ... View more

I would like to know about the permission files under the metadata directory of each app.$ SPLUNK_HOME / etc / apps / <App name> / metadataThe permission file under the metadata directory is updated when any operation is performed.Will it be done? <Background of inquiry> When checking the Splunk configuration file, the search head permission file mentioned aboveI noticed that it has been updated.After checking the contents, the authority is set individually for the lookup table etc . it  seemed that the number of stanzas related to knowledge objects was increasing.Because I was confused because I did not know when the contents of the permission file were updated, please contact me. for splunk version 7.3.2 ... View more

In the environment where Splunk is running, it is called "splunk-powershell.exe" The process is running. What role does this process play? This executable file was in the following folder, When I looked up the property, there was no information. → C: \ Program Files \ SplunkUniversalForwarder \ bin \ Please tell me more about this process. ... View more