About Keith_wgtn

Keith_wgtn · ‎08-04-2024

This one seems better as it exclude scheduled searches. index="_audit" [search index=_internal source="*web_access.log" user!="-" | stats by user | fields user] | search action="search" OR action="rtsearch" | stats values(action) as Action, values(info) as Info, max(timestamp) as lastTime, min(timestamp) as firstTime by user

faRRe · ‎06-01-2023

You can include in your searches splunk_server=local this will let you retrieve the information from the indexes without the need for the dispatch_rest_to_indexers since this capability is not added to the Cloud users due to security purposes.

richgalloway · ‎12-07-2022

Downloading apps was a feature in Classic stacks that appears to have been removed from VIctoria. File a Support Request to get a tarball of the app.

richgalloway · ‎09-22-2022

The account does not have to be local. I've had customers create LDAP/SAML service accounts for Splunk.

Keith_wgtn · ‎11-07-2021

and line 19

Keith_wgtn · ‎09-01-2021

Hi, I am moving a client from onprem to cloud. One of the apps they use is TA-windows_eventsize_reducer (app number 3500). On Splunkbase that app is marked as Splunk Cloud compatible but it is also marked as Archived. Any idea why it has been archived? Also how can I install it to Splunk Cloud? The usual "Manage Apps > Browse More Apps > Install" doesnt work beause it canty find the app - probably because it is inactive. I tried downloading then installing from file but got rejected and told to use the vetting approach. Should I vet it or should it be loadable from Manage App? Thanks

Posts	8
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎09-01-2021

Online Status	Offline
Date Last Visited	‎08-05-2024 01:49 AM

Custom app management in Splunk Cloud

How to set time zone for user "nobody"?

Paychex Cover Your Assets - losing alert Time Rang...

Why is the app TA-windows_eventsize_reducer archiv...

Re: Users who are logged in right now

Re: Splunk Cloud rest dispatch_rest_to_indexers

Re: Custom app management in Splunk Cloud

Re: How to set time zone for user "nobody"?

Re: Paychex Cover Your Assets - losing alert Time ...

Why is the app TA-windows_eventsize_reducer archiv...