Hello, I would like to know about the pricing details for Splunk Enterprise Security. Can anyone share the details? Thanks in advance. Siddarth         ... View more

Hello, I have created a KVstore lookup, when I try to perform outputlookup on the kvstore, I get the following error. Error in 'outputlookup' command: Could not write to collection 'test1': An error occurred while saving to the KV Store When I refer to the log file, it gives the following information, 02-16-2023 16:56:51.841 ERROR KVStoreLookup [79866 phase_1] - KV Store output failed with err: The provided query was invalid. (Document may not contain '$' or '.' in keys.) message: 02-16-2023 16:56:51.841 ERROR SearchResultsFiles [79866 phase_1] - An error occurred while saving to the KV Store. Look at search.log for more information. 02-16-2023 16:56:51.905 ERROR outputcsv [79866 phase_1] - An error occurred during outputlookup, managed to write 0 rows 02-16-2023 16:56:51.905 ERROR outputcsv [79866 phase_1] - Error in 'outputlookup' command: Could not write to collection 'test1': An error occurred while saving to the KV Store. Look at search.log for more information.. Can you please advise on this. Thanks in advance. Siddarth ... View more

Hello, I am trying to install SSL certificate for Splunk to permit HTTPS access to the console. As part of the procedure, I have generated the CSR, Key and the signed PEM certificates. I uploaded the files to the Splunk host and created (and edited) the server.conf with the following information [settings] enableSplunkWebSSL = true privKeyPath = /opt/splunk/etc/auth/mycerts/mySplunkWebPrivateKey.key serverCert = /opt/splunk/etc/auth/mycerts/mySplunkWebCertificate.pem I also disabled the [sslConfig] stanza in server.conf. When I try to restart Splunk, the service fails with the following errors. Please advise on how to fix the issue. WARNING: Cannot decrypt private key in "/opt/splunk/splunk/etc/auth/mycerts/mySplunkWebPrivateKey1.key" with> Feb 03 17:09:16 frczprmccinfsp1 splunk[1559898]: WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifySer>   Thanks in advance. Siddarth ... View more

Hello, We are trying to build a dashboard for Incident SLA compliance. The data is ingested from JIRA. Tickets are created in JIRA, and Splunk retrieves the information frequently. At this point in time, the concerned fields for me are the Ticket Number and Creation Time. However, when an existing Ticket in JIRA is updated, the new values in Splunk are updated on the existing values. Hence, I lose the previously captured, in this case, I miss out on Creation time, and the same field is updated with New Time. How can I capture in the below format? Please advise. Ticket Number, Creation Time, Updated Time. -- Thanks, Siddarth ... View more

Hello, When I try to create a world map using the geo stats using Dashboard studio., I get the below error. However, when I use the same query on Classic dashboard, its functional. How can I resolve this. Please advise. Query: index="qradar_offenses"| spath | iplocation src | geostats count by src Splunk Version: 8.2.8 -- Thanks, Siddarth   ... View more

Hello, I have installed an App, and the data in APP is written to "MAIN" index. When I am search for DATA from the APP, it works fine. Below is the my search query index="main" source=jira However, when I search for the same data from Search App, the data is not visible, and hence when I try to create a dashboard, it is not functional. How can I make data searchable from Search App and from the App. Please advise. -- Thanks in Advance. Siddarth ... View more

Hello, We have developed a dashboard to monitor the source of attacks. The dashboard works fine, however, referring to the image on the left, when I hover over the indicator, it displays the count. How can I modify the search to capture the count as displayed on right? Below is my query. index="qradar_offenses" | spath | iplocation src | geostats count by src Thanks in advance ... View more

Hello, I have a new installation of Splunk 9.X. The instance is hosted on Ubuntu OS, on Azure Cloud. There is no Public IP associated with the instance. The instance can only be accessed via the associated Private IP Address (peering is established between Azure and my internal company network) I tried to telnet the Instance on port 8000, and it is accepting connections. In parallel, when I launch TCPDUMP and refresh the browser, I can see packets on TCPDUMP. Inspite, I am unable to access the instance via console. I get CONNECTION RESET on the browser. Please advise. -- Thanks, Siddarth ... View more

Hello, We are sizing a Splunk solution for internal usage. Referring to the documentation, it is said that Mid size Indexer will require 48vCPU and 64Gb RAM. However, I wanted to understand how much EPS will this kind of indexer handle. Please advise ... View more