If your event data includes a mixture of languages, a straightforward approach is to restructure your reference table. In this new setup, the first column should encompass all conceivable combinations of "Tools" values, including English. The second column should store the corresponding English translations for each item, denoted as "TranslatedTool." With this arrangement in place, you can effortlessly incorporate a lookup command into your search process or establish an automated lookup mechanism to generate the "TranslatedTool" field, featuring the accurate English translations. ... View more

@TheGU wrote: How to extract the log example below: 2010-09-29 16:23:44 2 172.16.106.54 exam.ple Filter-ID==4 - OBSERVED "Search Engines/Portals;News/Media" http://market.example.com/product/1439306 200 I got this from bluecoat server. I can't use DELIMS=" " to extract KV because some fields have a " " (spacebar) too. for extraction example : 2010-09-29 16:23:44 2 172.16.106.54 exam.ple Filter-ID==4 - OBSERVED "Search Engines/Portals;News/Media" <<<<<<<<<< this field make a problem!!! http://market.example.com/product/1439306 200 bluecoat server is awsome man  ... View more

@dpreston31 wrote: Did some research and found out that automating VirusTotal lookups is restricted to 4 lookups per minute. Both via VirusTotal Checker's method of appending hashes o a virustotal.com search URL, and via the VT Public API 2.0 access. https://www.virustotal.com/en/documentation/public-api/#getting-ip-reports  Explains why in the screenshots he limited the search to 10 events "head 10". Which by the way, successfully works and retrieves VT results only after I go to VirusTotal.com and do the CAPTCHA. i also wanna know why in the screenshots he limited the search to 10 events "head 10" ... View more

@Christians86 wrote:     Hi, I have had this problem twice now on two different computers.    I install debian/ubuntu  Then I use the .deb file from splunk.com - the newest you get when you start your trial I then make a VM based on a distro of ubuntu/debian and install Everything workes fine, I use my own user, not the root user to install I follow the steps of  https://www.bitsioinc.com/tutorials/install-splunk-linux/ Splunk starts and works fine. No problems..until I restart the VM. Then localhost:8000 and the external ip both stop working and splunk web gui is not possible to connect to. I use the same account both for installation and for login when restarting   What am I doing wrong? Other VM's don't report problems on the machine, its only splunk, and only after restarting of the vm. The VM itself has internet and works fine, its only splunk that has issues.    i am also facing this problem man  ... View more

@harimadambi wrote: Hi All, I'm receiving Distributed search health assessment warning while performing the Health Check in Splunk 6.6.8 Mine is a multi-clustered environment with totally 5 search heads and cluster master which is also identified as a search head by Splunk. I'm receiving the warning for cluster master. For more information about the warning message, please see the attached images. Could anyone please help me on why I'm receiving this warning message and what actions I should take to resolve this issue?]1  Thank You! that is very informative man i love the comment  ... View more

@vikramyadav wrote: It always amaze me how much time people waste searching endlessly for magic shortcuts to success and fulfilment when the only real path is staring them right in the face. Yes, I know that’s hard. It's a lot of work. What can I say, that’s life. Besides, look on the bright side: You get to do what you want and you get to do it your way. There’s just one catch. You’ve got to start somewhere. Ideas and opportunities don’t just materialize out of thin air.   I early started developing my interest in Data Analytics and Splunk when I joined energetic start up organisation - Avotrix . The only way I know to get started is by learning a marketable skill and getting to work. I completed my initial courses from Splunk and started exploring advance features of it. My motivation is simple really. I just want to secure a well-paying career that allows me to support my family and be able to take them on good holidays. I’m willing to put in the time to achieve that.   I started giving courses to the unemployed and new Grads students from various countries. My obsession is providing tools knowledge to the youth to support their development and initiatives for career aspiration. Because My company believes that individuals work optimally in different ways, it allows me to design my own interest towards Splunk technology. With this inspiration I have initiated "Mumbai Splunk User Group" to gather Splunk Ninjas from various location to share  thoughts and grow together. This conviction and determination helped overcome insurmountable odds and become vivid group in Splunk community. I believe  accumulating a diverse set of experiences can help you run your business best.   I always explore various ideas to develop app which can make day to day data analysis easier for every individuals. As a outcome I have developed "Gogs App for Splunk" for Opensource Version Control Service. I am glad to share the recognition and reward from Splunk for this innovative work. I would like to take this opportunity to Thank Splunk for recognising my contribution towards Splunk community.   You never know what journey life is going to take you on or how technology could end up allowing you to share your passions with the world. The journey I went on may have taken years but it led me to create the app that has more than 100+ downloads from users worldwide. 😊 I will be happy to connect with you all. Linkedin Facebook Instagram it  is very informative man ii love reading your comment ... View more

@piebob wrote: you've asked a number of very general questions in this forum, please go through the documentation first, starting with the Search tutorial, here: http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial  thanks for sharing the search tutorial man i was looking for such thread ... View more