Hello Splunkers, I have switches from which the logs are getting ingested into splunk. So when the specific multiple interfaces are down it should trigger me only one alert. At present i am using the below query index="switches"| spath Message |search Message="*Interface GigabitEthernet0/21 · ** Connected to AD Server ** for node DISTRIBUTION is Shutdown." OR Message="Interface GigabitEthernet0/23 - Gi0/23 for node DISTRIBUTION is Shutdown." OR Message="Interface GigabitEthernet0/24 - Gi0/24 for node DISTRIBUTION is Shutdown." OR Message="*Interface GigabitEthernet0/22 · ** Connected to DHCP Server ** for node DISTRIBUTION is Shutdown." |table _time Message Device_Name Here when any one interface is down or multiple interface is down then the number of alert is getting triggered depending on the number of interfaces down. Now what i need is that if there are multiple interfaces down, it should raise only one alert in alert manager.  I have attached the screenshot of the alerts when the multiple interfaces are down.     Thanks in Advance..   ... View more

Hi Splunk Experts, I tried to create the search but can't be successful in it, I need a search, if in case the interface of an Cisco switch is down and doesn't came to up state within 5 minutes it should throw an alert. The logs are as below screenshot. I tried to write the query only for one scenario i.e if the switch status changed state to down i can get the alert but i can't merge the both message fields back to back. Required Alert scenario: when first log containing the message field with changed state to down appears and within 5 minutes the next log containing the message field with changed state to up doesn't appear then i must get an alert.     Thanks in advance.....   ... View more

Hello everyone, In Splunk GUI when i run health check its showing one error like One or more source types has been found to present events in the future. All the sources are giving the correct timestamp with timezone UTC +0:00 but when i checked the devices that are configured with the source types with the error, the devices are in the other timezone i.e UTC +08:00, and we are receiving the logs that are also in the future timezone. so how can i overcome this problem with the future timestamp. the Splunk indexer time zone is UTC +0:00 please refer the screenshot. Thanks in advance............ ... View more

Hello there,   Recently i have restarted the splunk from then splunk is showing an error message regarding Palo Alto network add on. And if i removed that add on, the problem will be resolved. But my query is how can i check that the add on is working in background for any purpose or not??? We are using Palo alto firewall, is this add on useful to collect the data from the palo alto firewall?? If i removed this add on does the logs of splunk will not be displayed in splunk? Please help me with this query...  Thanks in advance. ... View more

Hi splunk experts, Can anyone elaborate this below event and tell me why this event is getting triggered? the user name in this event has left the organization and we removed his access and transferred the knowledge objects to other person also but we are getting his name in the below event. and please help me how to avoid this type type of alerts also. 127.0.0.1 - **User name*** [30/Mar/2022:09:29:54.891 +0000] "POST /servicesNS/nobody/search/saved/searches/Single%20User%20Failed%20Attempt/notify?trigger.condition_state=1 HTTP/1.1" 200 1933 "-" "Splunk/8.1.0 (Linux 4.15.0-1023-azure; arch=x86_64)" - 2ms   this event is getting displayed when we search by using the query: index=_internal sourcetype= splunkd_access user=*.   thanks in advance. ... View more

Hi there, One of my colleague having admin access has created a dashboard for audit to know that who logged into Splunk and how many times does the user login into Splunk for the last 7 days for all the users. One of the users left the organization in January and we deleted the account with admin login and transferred all the knowledge objects to the other user also but Now we are seeing his name in the dashboard and alerts were triggering on his name also. We have again checked the user list but his name was not available, but we are still seeing his name in the alerts and dashboard. Can anyone help me with it…  the search query used for creating the dashboard is   index=_internal sourcetype=splunkd_access  | timechart span=6h count by user   The Raw Event displaying while searching the query is: 127.0.0.1 - name of the user* [28/Mar/2022:05:28:17.505 +0000] "POST /servicesNS/nobody/search/saved/searches/Single%20User%20Failed%20Attempt/notify?trigger.condition_state=1 HTTP/1.1" 200 1933 "-" "Splunk/8.1.0 (Linux 4.15.0-1023-azure; arch=x86_64)" - 2ms   Please help me to resolve it and thanks in advance...... ... View more