We are using python 3.7 and multiple python versions are installed on the server, but in $SPLUNK_HOME/etc/system/local we set python.version = force_python3 ... View more

You can't just tweak limits.conf to make your schedules work efficiently. This symptom usually means that you either have too many scheduled searches (reports, alerts, corellation searches) defined altogether or - more probably - you have them squished into the same "schedule spots" as @kkrises suggested. For example - you're trying to run all your searches at 5 minutes past the hour. It's the typical case and you should spread the execution times more evenly throughout the hour, day, or however often your searches run. In some cases you could try to run more searches at once but that's more tricky and requires more troubleshooting and diagnostics. ... View more

@Jishnukn10 -  Search macros in Splunk are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. It's enclosed within acute/back quotes `macro_name` on your search like  `drop_dm_object_name(field)`. You can see these macros in Splunk and define them under Settings > Advanced Search > Search Macros. All about macros here :  Use search macros in searches - Splunk Documentation Hope this helps.  ... View more

You're welcome. ... View more

@kkrises - I think you need to setup the email server configuration - https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification   I hope this helps!!! ... View more

Sorry for the delay! Here is the answer: Yes, and yes! Also, here is the compatibility matrix:  https://docs.splunk.com/ Documentation/ VersionCompatibility/current/ Matrix/CompatMatrix ... View more

Yes, it is possible to upgrade from 7.2.6 to 8.2.4, but that can be a breaking change.  All of your apps must be compatible with Python 3 to install Splunk 8.  Run the Upgrade Readiness app (https://splunkbase.splunk.com/app/5483/) to see if your apps are ready.  As with any upgrade, you'll want to read the Release Notes for the version you're installing as well as each intervening version to see if there are changes that affect your environment.  The Release Notes may call for special steps you must take to upgrade to that version Likewise for Splunk ES.  Check the Release Notes and Upgrade Instructions for each version to see which steps must be performed. Detailed steps are too extensive for this forum and are something for which Splunk often recommends engaging Professional Services.  PS can advise the best upgrade process for your environment. ... View more

Here is your SPL query, let me know if it works for you. index=wineventlog sourcetype="Wineventlog:Security" EventCode=4625 OR EventCode=529 Account_Name!="" | stats count by Account_Name | sort -count | head 10 Event code 529 to capture failure events from Win 2003 or older versions Account_Name!="<put value which doesn't make any sense to you like blank/- etc> head 10 - for top 10 results. Hope this helps and happy Splunking! ... View more