Hello Splunk Community, I'm currently working on creating a search using the tstats command to identify user behavior related to multiple failed login attempts followed by a successful login. I want to use tstats for this due to its efficiency with high volumes of data, compared to the transaction command. In my case, I want to be able to detect an event sequence where a user has had, let's say, 10 or more failed login attempts, followed by a successful login attempt, within a specified time window (for example, within an hour). I understand that tstats doesn't provide the same level of detail as transaction for creating sequences of events. However, I'm looking for suggestions on how to use tstats, combined with other SPL commands, to achieve a similar result. Here's an example of the type of data I'm dealing with: _time user status 1622890560 user1 failure 1622890620 user1 failure 1622890680 user1 success In this example, the status field contains "success" or "failure", and the user field contains the user ID. Any guidance or suggestions would be greatly appreciated. Thanks in advance for your help! ... View more

Hello, What proxy rules I need to allow to install apps from Splunkbase what URL\s I need to allow?   https://*splunk.com* is that sufficient ? Thanks in advance, Ran ... View more

I have the following situation: I have an universal forwarder that were sent logs to (HF1 and index=idx1) Could you provide suggestions on how to configure this universal forwarder (UF) to send logs to both (HF1 and index=idx1) and (HF2 and index=idx2)? Any insights or advice would be appreciated. Thank you.   ... View more

I want to install HF or UF on our DMZ environment. The Indexer is on the LAN. I is not allow to communicate from the DMZ to the LAN . I need that the logs from the DMZ will be pulled to the Indexer in the LAN (using HF or any other solution). Please share your insight on how to setup this from your experience . Thanks in advance. ... View more

Hello, When I download a dashboard with dashboard studio it come out with the horizontal and vertical scrollbars. There is an option to download to pdf with full tables and and without the scrollbars? Or if there is option to make the height size dynamically based on custom variables? Thanks, Ran ... View more