Hi,  I have a dataset with very poor qulity and multiple encoding error. Some fields contain data like "Алексей" which sould be "Алексей". My first idea to convert taht, was to search every falty dataset and convert this extermally with a script but I'm curious if theres a better way using splunk. But I have no idea how to get there. I somehow need to cet every &#(\d{4}); and I could facilitate printf("%c", \1) to get the correct unicode character but I have no Idea how to apply that to every occourance in a single field. Currently I have data like this: id name 1 Алексей   Where I wanno get is that: id name correct_name 1 Алексей Алексей   Any ideas if that is possible without using python sripts in splunk? Regards Thorsten ... View more

Hi,  Splunk Assist is producing a lot of execution errors in my search head cluster and on my intermediate forwarder. Since the first is part of a cluster I thought of deploying the app.conf via shc-d but that would not be enough since do doku say one must execute ./splunk disable app splunk_assist. Similar for heavy forwarders connected to a deployment server. Sadly the splunk doku on Splunk Assist doesnt seem to care that clustered environments exists. Kind Regards th ... View more

Hi, I have the Splunk_TA_nix installed and deployed. In generel it works. I activated the interfaces.sh which does give me IPv4-Adresses and IPv6 Link-Local-Adresses but none else. Since I have a primarily IPv6 environment I miss the most importent part but I don't understand why it delivers me the link-locals but not the public adresses? I could not find any documentation or anything about activating ipv6 for the interfaces.sh and since there are link-locals I guess it is activated but the script has maybe a bug. Can anyone tell me if theres a better documentation for this script anywhere or knows why it does not collect the ipv6 adresses? ... View more

Hi, I regularly have the problem, that I save searches containing regexes with $ characters to a dashboard where they are then not showing any result. I guess I have to escape them somehow. It seems while saving them the $ characters are automatically duplicated but it that is supposed to be some kind of escaping its not working. I could not find anything in the documentation but since there are plenty I was not shure where to look exactly. Can anyone tell me how to reliably use a | rex command in a dashboard? | rex field=_raw "\s(?<hash>\S+)$" ... View more

Hi, I took over a Splunk Cluster with Splunk on c:\program files\splunk which produces plenty of problems due to long path restrictions. Activating long path support does not work for splunk so I have to reinstall all instances on c:\splunk. But when trying to uninstall I get errors due to missing permission. I have admin priviliges, installed a test-cluster with all new instances but can't uninstall splunk for some reason. Of course I stopped splunk before trying to uninstall it. Can anyone tell me why even a freshly installed instance can't be uninstalled? I tried with 9.0.3 and 9.0.4. Kind Regards ... View more

Hi, I have a test instance of splunk - fresh out of the box. Only configure the essentials and imported a dump from the  OpenLibrary.org. I have the problem that every single line should be one event but plenty of lines are merged together and I can't figure out why. The source data has reliable linebreaks in so the default should work. I had the same issue in my enterprise environment and nobody could tell me why this is happening. After a while it magically disappeared and as far as I can tell it has vanished for good but I'd like to understand the reason why this is happening and prevent it from happening again. Regards Thorsten ... View more

I've tried to configure some reports to be send via email. I created a report which runs on a schedule an then send the report via mail. I receive an error like this: ERROR ScriptRunner [26364 AlertNotifierWorker-3] - stderr from 'C:\Program Files\[..]\sendemail.py "results_link=https://sea:443/app/search/@go?sid=scheduler__myuser__search__RMD5ca1c47b4433f8dbe_at_1675331100_258_5A6150E4-7C97-409F-AC0E-5BC487885B82" "ssname=xxx: myreport" "graceful=True" "trigger_time=1675331129" results_file="C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler__myuser__search__RMD5ca1c47b4433f8dbe_at_1675331100_258_5A6150E4-7C97-409F-AC0E-5BC487885B82\results.csv.gz" "is_stream_malert=False"': ERROR:root:[WinError 10061] Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte while sending mail to: [email protected] I thougt it might be the smtp-gateway but sending mails via | sendemail command works fine.  Also some, but very few, reports go through. Also I checked wether sendmail.py tried to open a connection to the smtp-server but it seems the error comes from sendemail.py trying to open the url in results_link. And that is the point where I do not know what to look for anymore. ... View more

Hi there, I created multiple field extractions, extracting values from different sourcetypes into the same field: sourcetype0: "field0":"(?<geolocation_code>.{7}) sourcetype1: "field1":"(?<geolocation_code>.{7}) sourcetype2: "field2":"(?<geolocation_code>.{7}) They are populated as expected, all looking like ABCDEF0, CDEFGH3 or ZDEGFH9. But when using them in search geolocation_code=ABCDEF0 I have zero hits even though the preview from the fields pane on the left shows me plenty of those values. Using geolocation_code!=ABCDEF0 on the other hand works exactly as inteded. Also geolocation_code=ABCDEF0* gives the result I expected from geolocation_code=ABCDEF0 even though this field only contains exactly the value I'm looking for. I don't really understand what is happening here and why only with this extraction but not with other.  ... View more