Remember that during the ingestion phase Splunk mostly processes the event as a whole - extractions (unless you have indexed fields) are done in search time. So if you wanted to encrypt part of the raw message (for now even leaving aside the question how to do it), you'd have to extract a part of the message into a field, encrypt this field, replace the original part of the raw message with the encrypted field value and finally "forget" the extracted and encrypted field values (so they do not get indexed alongside the raw event). Very, very ugly and error-prone. And we haven't even touched the question about _how_ to encrypt the value. ... View more

@schose, apologies, I'm just seeing your reply. To test for high cardinality, I'm thinking the following would work: Packing an Index: Put a bunch of source/sourcetypes all into one index. Multiplying sources: If file based, use the filename, or transform the source by appending values. Multiplying sourcetypes/Packing a Source: Set the sourcetype by appending values (frequency appropriate) like day and hour. I'd imagine the above can be done with access to a large syslog server or some programmatic manipulation. ... View more

Hi @super_saiyan, I haven't an answer to this, you could open a not technical case to Splunk Support. Ciao. Giuseppe ... View more

As I said - this solution would be to go to the admins of the solution which is sending those logs to make it send in some more compact form - not so spread across separate lines. Or at least make the logs somehow better delimited. But of course this would only affect newly ingested events, not old ones that are already indexed. ... View more

Hi @human96, Universal Forwarders cannot parse events. Line breakers work on Indexer or Heavy Forwarders if they are receiving data from UF. Only EVENT_BREAKER setting works on UF, but this will only tell UF to tell where the events boundaries are and make it send full events to indexers.    ... View more

When you say "NULL" value, I am assuming you mean the value is blank/empty rather than literal. Try this to set all the empty values to null.  index="xyz" sourcetype="csv" | foreach * [eval <<FIELD>>=IF(<<FIELD>>="", NULL(), <<FIELD>>)] | fillnull value="unknownMan" field1 field2 field3 field4 | eventstats dc(field1) as xyz by field2 field3 field4 | table field1 field2 field3 field4 ... View more

@gcuselloAs a side note - with simple searches, splunk can sometimes optimize the search in some obvious cases. So search | search a=b will get optimized to search a=b  But of course I wuldn't rely on it and writing efficient searches is a good practice that should be followed. ... View more

See if you can use SDK because that would be much easier and take care of most of the best practices. - https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/    ... View more

OK. If your device counters show high volume of traffic but you don't see much traffic on the machine, there is definitely something wrong in your setup but it's way beyond scope of this forum. ... View more

I know User changes (password, name, roles update) could trigger the file to update but not without any reason. * Check with Splunk support if you think it is happening regularly and without any reason. * Though I personally have not seen such a bug with any version of Splunk. ... View more

What do you mean by "stop data replication midway"?  Midway between what and what else?  Why do you want to stop replication? What aspect of the timing of replication do you want to control?  Why? ... View more

Hi, Check the path of the image in the dashboard XML, eg- /static/app/abcd/images/abc.png , Go to your CLI and inside the search head app directory get the image out and put it on the same server where you wanted to move the image file.   One more way is to find the name of the image from XML and login to the CLI and run"locate <image Nmae>" it will show the image location where it's available, you can use WinSCP to move the image from cli to your local pc and put where ever you want. Please accept the answer if you find this helpful. ... View more

Hi @human96  On HF please configure below stanza in etc/system/local/inputs.conf  Inputs.conf [splunktcp:9997]  or using cmd  run follwoing commanf $SPLUNK_HOME/bin/ splunk enable listen 9997 -auth admin:password Link do doc https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Enableareceiver   ... View more

Windows Event Log (.evt) and Windows Event Log XML (.evtx) files that you exported from another Windows machine don't work. https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Uploaddata the better way would be- 1. convert your evtx files to csv using logparser ( by Microsoft )   $logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe" $query = "SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx" & $logparser -i:evt -o:csv $query  2. forward those converted csv file directly to splunk. ... View more

Hi @human96  Just one thing to highlight Persistent queuies are not avaiable to all inputs ex: file monitoring ,  it only works with follwing inputs  and regarding your question for queue size   it would be 10 GB for all, it doesnt depend on forwarder count  Persistent queuies location    ... View more

Hi  @human96  Lols using karma points as bait splunk standlone is all the components in one server ie SH, IDX and this is more relevant to test and development environmentstandalone concept or architecture is never suggested for production environment As standlone will not support the concepts of High availibiity and Disaster recovery which is an imp feature for a functionality of an application in a production environmentEnd of the day you always want you application to be Up and running 24 X 7 .there is always a chance if any component like software or hardware of the server fails then the whole splunk application might collapse and whatever use case you are trying to achieve using splunk like log monitoring or alerting or dashboard might fail not just for splunk but for the source application And in real world scenarios you don't want you application to have downtime so you prefer distributed architecture Hope this helps ... View more

Hi @human96  Splunk Cloud Supports Mircrosft  Azure Authetication  Following documentation might help you  https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SAMLConfigJWT  https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Security/Setupauthenticationwithtokens  https://www.splunk.com/en_us/blog/tips-and-tricks/configuring-microsoft-s-azure-security-assertion-markup-language-saml-single-sign-on-sso-with-splunk-cloud-azure-portal.html  --- If this reply helps you, an upvote/Karma would be appreciated. ... View more

hi @SanjayReddy , thank you so much for your quick response. i already encountered with this add-on.  would it be possible for you to simulate this and let me know the step-by-step process  how to do it ? ... View more

Sorry, I haven't used these add-ons either. ... View more

Hi @human96, when you make an upload of a csv in a lookup, the last versions of the lookup are saved and you can reload one of them. You can access them using a button on Lookup File Editor App. Ciao. Giuseppe ... View more

Hi @human96, probably your search is correct, even if i don't exactly understand what't your Use Case, what's series? and generally, why invent hot water? in the Monitorinbg Console you have all the searches to calculate all the needed metrics (indexing speed, license consuption, etc...). I'd prefer a standard solution, but you could also use your search. Tell me if I can help you more. Ciao and happy splunking. Giiuseppe P.,S.: Karma Points are appreciated 😉 ... View more