| inputlookup suspicious_win_comm.csv lookup table contents has only keyword keyword <- field name tasklist ver ipconfig net time systeminfo netstat whoami chrome   I want see result like this.   event.commandline matching keyword c:\program<file:///c:/program>; files (x86)\application\chrome.exe --signal-argument http............ chrome   I used this spl my local system. Index=crowdstrike [| inputlookup suspicious_win_comm.csv | eval event.commandline = "*".keyword."*" | fields event.commandline | format ]   ... View more

is it possible to splunk 6 version to version 9 rolling upgrade? ... View more

any idea of this error information? I can not find a message like this  what is the main issue this error???   2022-04-29 18:11:03, 533+0900 process: 10780 thread: MainThread ERROR [itsi.migration] [filesave_migration_interface:96] [migration_save_single_object_to_kystore] Exception adding inage 5e6eda58d3bc8 f4ad0af: HTTP 409 Conflict -- A document with the same key and user already exists host = ITSIOS source = /opt/splunk/splunk/var/log/splunk/itsi_migration queue.log sourcetype = itsi_internal_log     ... View more

I am using mobile linkage with splunk secure gateway. I modified the file etc/apps/splunk_secure_gateway/bin/spacebridgeapp/alerts/device_role_mapping.py as below to enable up to 100 accounts. AS-IS async def get_registered_devices(auth_header, user_list, async_kvstore_client, max_batch_size=20): TO-BE async def get_registered_devices(auth_header, user_list, async_kvstore_client, max_batch_size=100): Please check the reason for the limit of 20 accounts, whether there is any problem even if you change it to 100 as above, and if there is a problem, the possible impact. ... View more