Hello, we have a following integration in place: GuardDuty -> EventBridge (no transformation)-> Firehose (no transformation) -> Splunk (cloud) HEC sourcetype = aws:cloudwatch:guardduty HEC source override = aws_cloudwatchevents_guardduty Despite source override sometimes we see events with aws.guardduty source, and in those cases the message format is different (thus search outputs no results so we do not get an alert). Single source events start with: {"schemaVersion":"2.0","accountId":"<some_account>","region":"<aws_region>","partition":...} Double source events start with (additional header/metadata preceding schemaVersion): {"version":"0","id":"<some_id>","detail-type":"GuardDuty Finding","source":"aws.guardduty","account":"<some_account>","time":"2022-09-07T11:55:02Z","region":"<aws_region>","resources":[],"detail":{"schemaVersion":"2.0","accountId":"<some_account>","region":"<aws_region>","partition":...} AWS has been excluded as the source of the issue. Any ideas on how to have only one message format (Splunk Support ticket has also been submitted) ? ... View more

Hi, I'm using splunk web to check some searches/alerts: 1. | rest /servicesNS/-/-/saved/searches/ splunk_server=local | table title <-- displays a list of saved searches then I pick one from the list and launch: 2. rest /servicesNS/-/-/saved/searches/alert_without_white_spaces splunk_server=local. <-- and it works But when querying for a differently named alert I get an error: 3. rest /servicesNS/-/-/saved/searches/alert with white spaces splunk_server=local. <-- does not work - error message: Error in 'rest' command: Invalid argument: '-' 3a) rest /servicesNS/-/-/saved/searches/'alert with white spaces' splunk_server=local.   <-- does not work - error message: Error in 'rest' command: Invalid argument: '-' 3b) rest /servicesNS/-/-/saved/searches/"alert with white spaces" splunk_server=local.   <-- does not work - error message: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/-/-/saved/searches/alert with white spaces?count=0 from server=https://127.0.0.1:8089 - Not Found 3d) rest /servicesNS/-/-/saved/searches/alert\ with\ white\ spaces splunk_server=local.  - error message: Error in 'rest' command: Invalid argument: '-\' 3e) | eval alert1="alert with white spaces"          | rest /servicesNS/-/-/saved/searches/alert1 - error message (splunk didn't use the variable value but the variable name) Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/-/-/saved/searches/alert1?count=0 from server=https://127.0.0.1:8089 - Not Found Is there a way to use variables or to query for a search name containing white spaces without getting an error ? ... View more

Hello, I have created a few indexes, each containing data only from one source with one sourcetype. From a search performance point of view - Is it necessary to include the sourcetype in each search if there is only one sourcetype "associated" with a specific index ? Is Splunk's internal "engine" slower when I do not specify that ? ... View more