That doesn't seem right. Those fields should not be empty so something must be overwriting it in search-time (or your indexes are damaged but let's assume they aren't). Try | tstats count where index=dfini by source sourcetype host That should show you what are the indexed fields. You have to search your search-time definitions to see what overwrites those values. ... View more

LINE_BREAKER must contain a capture group. Everything before capture group is considered "previous event", capture group is treated as event breaker _and is removed from your data_ and everything after the capture group is part of the "next event". Also - you still didn't say what constitutes a new event in your example. ... View more

Hi @vijreddy30 , see in the Splunk Validated Architectures document (https://www.splunk.com/en_us/pdfs/tech-brief/splunk-validated-architectures.pdf) what Splunk means for HA and how to implement it. For your requirements, it's really difficoult to answer to your question! Maybe there are some replication mechanisms, based on VM-Ware, to do this, but I'm not an expert on VM-Ware and this isn't the location for this question. Ciao. Giuseppe ... View more

Hi @vijreddy30 , as I said, use the Add Data feature to define the correct sourcetype. Also because, viewing your screenshout, you have a timestamp at 6/12/24 0:37:54 and the Date column at 04/06/2024 and the Time column at 10:48:00. In Add Data, you can configure and test the timestamp and the line breaking. Ciao. Giuseppe ... View more

Hello @vijreddy30 , This may be possible because of following setting in the alert: Trigger   If this is set to Once, change it to "For each Result" and it should trigger alert for all the records. Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

@vijreddy30 - Please check for following things in order: Check whether Splunk is running or not? ./bin/splunk status (Run from Splunk installation folder / SplunkHome) If Splunk is not active then ./bin/splunk start (Start the Splunk service) ./bin/splunk status (Check the Splunk status Again Once completed and you still don't see the Splunk, look for issues in your splunkd.log file.   Just to point out in your web.conf, there is an extra a in front of privKeyPath.   Checking above should be able to help you find and fix the issue. I hope this helps!!!  ... View more

Hi just send all events to SCP as in any UF. If you need also dbxquery on SCP then you must install DB Connect and needed dbdrivers also into it and of course open FW from SCP search head(s). r. Ismo ... View more

Hi @vijreddy30, what do you mean with Splunk DB Logs, are you meaning queries on a DB done with DB-Connect or what else? If you have the data from a DB in a Splunk index, you can search them as usual. Ciao. Giuseppe ... View more

Hi there, Option 1: Deployment Operator The Splunk Kubernetes Operator simplifies UF deployment and management. Check out the official guide: <invalid URL removed> Option 2: Manual Deployment For more control, follow these steps: Create Pod spec: Define a Pod spec with the UF container image and configurations. Use inputs.conf and outputs.conf for log forwarding rules. Deploy using kubectl: Apply the Pod spec using kubectl apply. Manage resources: Use kubectl commands to scale, update, or delete the UF deployment. Additional Tips: Consider using a DaemonSet for wider deployment across nodes. Secure your deployment with pod security policies and network policies. Explore Fluent Bit for advanced log processing and routing within Kubernetes. Remember: Choose the option that best suits your needs and expertise. Refer to Splunk documentation and community resources for detailed instructions and troubleshooting. ~ If the reply helps, a Karma upvote would be appreciated ... View more

If I understand you correctly, you want the settings you defined on your DS to propagate to forwarders across your environment (or at least to some designated UF(s)). You did the first step correctly - you created an app in etc/deployment-apps (I hope the "deploymentapps" in your description is just a typo). But now you have to define a server class tying app(s) to deployment client(s) and deload deployment server. See the https://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver document (read thoroughly the pages about creating server classes and deploying apps). ... View more

Hi team ,the  screen shot user(Read-only Access) able to access the delete option and edit the query also, our requirement user not able to  see delete option(hide),  please help me ... View more

Hi @vijreddy30 , let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the Contributors 😉 ... View more

Hi Team,   I am trying to below query, it showing the all servers are up, I tested one server stopped and checked  it's not showing Down status, please fine the below query index="_internal" | eval host=lower(host) | stats count BY host | append [ | eval host=lower(host) ] | eval status=if(total=0,"Down","up") | table host status   Please letme know exact query on that. ... View more

Events are ingested one at a time and there is no "state" which could be carried over from one event to another. So limiting your ingestion this way directly in Splunk is not possible. If you can define it not as "ingest only first 3 events" but as "(don't) ingest events (not) matching given patter", that's another story. ... View more

Hi @vijreddy30, let me understand: do you want to mask some events or part of event in permanent way or in reversible way? if in reversible way, you have to preprocess your data using a script and a certificate and then index your data using Splunk. If you only want to anonymize a part of your data, follow the instructions at https://www.splunk.com/en_us/blog/learn/data-anonymization.html or https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata?_gl=1*b5bay4*_ga*MTY1NjIzMDM3OC4xNjk3MjA1MzU0*_ga_GS7YF8S63Y*MTY5OTUyODU5My41MjcuMS4xNjk5NTI4ODA3LjI3LjAuMA..*_ga_5EPM2P39FV*MTY5OTUyODU2NC42NDAuMS4xNjk5NTI4OTg0LjAuMC4w&_ga=2.165103034.468842275.1697205354-1656230378.1697205354&_gac=1.117944699.1697439287.Cj0KCQjwm66pBhDQARIsALIR2zDDpMo42f4nQY5ylRFnUfEyW_h0bbBBKVDgM2rBU1cuYdYxGqfUTWkaAjkxEALw_wcB#Anonymize_data_through_a_sed_script Ciao. Giuseppe ... View more

Hi @vijreddy30, are you speaking of HA using a single site clusters (even if machines are located in more sites) or DR using a multisite cluster? they are really different! in the first case you have to configure your Replication Factor and Search Factor so in one site you have a full searchable copy of your data. Anyway, in both cases you can see at https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Multisitedeploymentoverview how to configure the Indexer Cluster and at https://docs.splunk.com/Documentation/Splunk/9.1.1/DistSearch/AboutSHC how to configure a Search Head Cluster. The management servers (Cluster Master, Deployer, Deployment Server, License Master and Monitoring Console) , are unique in the Splunk Architecture and the DR site will work also without them (for a little period): they aren't a single Point of Failure. Eventually, you could consider to have a turned off copy of them in the secondary site. You can find a description of these architecture at https://www.splunk.com/en_us/pdfs/tech-brief/splunk-validated-architectures.pdf  Ciao. Giuseppe ... View more

Hi @vijreddy30 ... pls check your Profile's inbox.. i have sent a msg to you.  this looks like a POC / test / dev environment setup.  most probably you may not need "high availability" at all.  we may need more details about what you meant by "high availability"..  thanks.    ... View more

How do they appear in Splunk right now? ... View more

Hi @vijreddy30, when you create a user and you don't want to see some objects, you have to assign him/her a different role so he/she can see only the enabled indexes and objects with read all grants. When you create the role, don't use inheritance from the user role otherwise the new role will have the same grants of user. Ciao. Giuseppe ... View more

@vijreddy30 - There is no concept of "Read access" in Splunk. In Splunk terms, you have to assign role which consist of capabilities.   This document describes all the capabilities - https://docs.splunk.com/Documentation/Splunk/9.1.1/Security/Rolesandcapabilities    BTW, I don't think you can create a role/user that has only read access based on available capabilities. But you try updating capabilities to that role to see if any combination capabilities. See if any combination works for you.   I hope this helps!!! ... View more

Hi @vijreddy30, it isn't possible to hide the Settings menu because there are some voices that are usually permitted to all users. Anyway, you can work in the Roles Permission menu [Settings > Groups] to exactly define the features of your role, in this way the not permitted Settings voices will be hided. Ciao. Giuseppe ... View more

Hi @vijreddy30, it isn't possible to hide the Settings menu because there are some voices that are usually permitted to all users. Anyway, you can work in the Roles Permission menu [Settings > Groups] to exactly define the features of your role, in this way the not permitted Settings voices will be hided. Ciao. Giuseppe ... View more

Hi @vijreddy30, check the sharing options: maybe you have different roles for some users. Did you checked tha the alias aren't private? Ciao. Giuseppe ... View more