Hello Splunkers, My clients are experiencing issue because of the formatting of the results which is present Splunk vs which is sent as a part of attchment. This is how it is showing in Splunk   jacquetta@evie.com LOU - HONG hong-lou-victorina-sid-001k1.active.zenobia hong-lou-victorina-sid-000r1.active.zenobia hong-lou-victorina-sid-001e1.active.zenobia hong-lou-victorina-sid-003f1.active.zenobia hong-lou-victorina-sid-004i0.active.zenobia hong-lou-victorina-sid-002d0.active.zenobia hong-lou-dvpqlqwpy005-001k1.active.zenobia hong-lou-dvpqlqwpy005-000r1.active.zenobia hong-lou-dvpqlqwpy005-001e1.active.zenobia hong-lou-dvpqlqwpy005-003f1.active.zenobia hong-lou-dvpqlqwpy005-004i0.active.zenobia hong-lou-dvpqlqwpy005-002d0.active.zenobia hong-lou-dvpqlqwpy005-004r1.active.zenobia hong-lou-dvpqlqwpy005-006z0.active.zenobia hong-lou-stephany-001k1.ae.active.zenobia hong-lou-stephany-000r1.ae.active.zenobia hong-lou-uvyycdyjewys-001k1.ae.active.zenobia hong-lou-uvyycdyjewys-000r1.ae.active.zenobia hong-lou-uvyycdyjewys-001e1.ae.active.zenobia hong-lou-uvyycdyjewys-003f1.ae.active.zenobia hong-lou-jackeline-001k1.ae.active.zenobia hong-lou-jackeline-000r1.ae.active.zenobia hong-lou-jackeline-001e1.ae.active.zenobia hong-lou-jackeline-003f1.ae.active.zenobia hong-lou-proxy-001k1.active.zenobia hong-lou-proxy-000r1.active.zenobia Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs jacquetta@evie.com AE Member Services - HONG hong-member-001k1.ae.active.zenobia hong-member-000r1.ae.active.zenobia hong-member-001e1.ae.active.zenobia hong-member-003f1.ae.active.zenobia hong-jackeline-001k1.ae.active.zenobia hong-jackeline-000r1.ae.active.zenobia hong-jackeline-001e1.ae.active.zenobia hong-jackeline-003f1.ae.active.zenobia hong-ymefvuphccrj-001k1.ae.active.zenobia hong-ymefvuphccrj-000r1.ae.active.zenobia hong-ymefvuphccrj-001e1.ae.active.zenobia hong-ymefvuphccrj-003f1.ae.active.zenobia hong-raymonde-001k1.ae.active.zenobia hong-raymonde-000r1.ae.active.zenobia hong-raymonde-001e1.ae.active.zenobia hong-raymonde-003f1.ae.active.zenobia Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs jacquetta@evie.com AE Member Services - HUI hui-member-001k1.ae.active.zenobia hui-member-000r1.ae.active.zenobia hui-jackeline-001k1.ae.active.zenobia hui-jackeline-000r1.ae.active.zenobia hui-ymefvuphccrj-001k1.ae.active.zenobia hui-ymefvuphccrj-000r1.ae.active.zenobia hui-raymonde-001k1.ae.active.zenobia hui-raymonde-000r1 Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs Insufficient Logs MgDzvf   And this is how it is going in attachment, as single line which is disturbing my output a lot Can anyone please advice how to correct it.  Thanks in advance.     ... View more

Hi Team Getting this error message frequently in internal logs of Splunk. Error in 'where' command: The expression is malformed. An unexpected character is reached at '*) OR match(indicator, *_ip) OR match(indicator, *_host)) Any hints will be appreciated. Thanks in advance   ... View more

Hi Team, I am planning to integrate Fireeye HX and Splunk and for the same I have installed the app from Splunk Base "FireEye App for Splunk Enterprise v3 | Splunkbase" on Heavy Forwarder and Search Head. Also as mentioned in the document performed the below steps  The HX appliance logging cannot be set from the GUI as of right now, please use the CLI: hostname # logging <remote-IP-address> trap none hostname # logging <remote-IP-address> trap override class cef priority info hostname # write mem On internal index I could see the below error and logs are not reflecting on Splunk ERROR SearchOperator:kv [17796 TcpChannelThread] - Cannot compile RE \"<malware\sname=\"(?<malware_name>[\w-\.]{1,30})\"\s*(sid=\"(?<malware_sid>\d*)")?\s*(stype=\"(?<malware_stype>[\w-]{1,30})\")?\" for transform 'EXTRACT-malware-info_for_fireeye': Regex: invalid range in character class. Any assistance for this issue will be much appreciated ... View more

Hello Splunkers I am trying to execute a SQL Query, however is it throwing  "com.microsoft.sqlserver.jdbc.SQLServerException: The query has timed out." error. I had also increased the timeout windows still no luck   Can anyone please assist how to resolve this issue   ... View more

If I want to create the pooling based upon the Indexes instead of Indexer Is it possible? ... View more

Hey Splunkers!!! We are planning to deploy DB connect app to get the data from Oracle Database and for the same I have below queries related to Splunk DBConnect App. Please assist. 1) Can we increase data fetch limit from 300 to 1000 or any other higher value? fetch_size = <integer> # optional # The number of rows to return at a time from the database. The default is 300. 2) Will this increased fetch size in db_inputs.conf will effect the Database Performance? 3) Does this fetch limit differs depending upon the databases? 4) If we are having existing scripts to get the same information using some other tool, then what will be the advantages of having SplunkDB Connect App over it? ... View more

Hi Team, I am trying to take the backup of lookups using search head console and for the same I have tried two ways. a) Using below Rest Command | rest /servicesNS/-/-/properties/lookups Issue :- Since we have only limited permissions, hence the links of lookups are not working. b) | inputlookup abcd.csv | append [inputlookup wxyz.csv] Issue:- I could see the output of both the .csv files but unable to identify the content from where abcd.csv or  wxyz.csv is starting. Can anyone please suggest the best possible way to do it from splunk gui since we have only power user access. ... View more