Hello. I like the idea of assigning different labels for separate teams but this also means that if the other role does not have the access to my team's label, I wont be able to escalate/assign the alert to anybody in the other team, right?  ... View more

There was some maintenance activity which blocked the page from loading. Now I am able to access the web page. ... View more

Would you look at Payload parameter. Result has many strings with spaces. ... View more

Hi , I have placed both the transforms and props at indexer layer. We are getting the CSV data through UF's ... View more

Here are the content of the local.meta file: [app/install/install_source_checksum] version = 9.2.1 modtime = 1719187793.873274000 [] access = read : [ * ], write : [ * ] export = system version = 9.2.1 modtime = 1719188413.914413000 ... View more

Ok, to simplify it as easy as possible : There are two indexes: INDEXA FieldA FieldB INDEXB FieldA FieldC to create a relation between indexes I need to modify INDEXB.FieldA eval FieldA1 = mvindex(split(FieldA, ","), 0) and now want to group by FieldA/FieldA1and FieldB and count FieldC ... View more

Hi @glc_slash_it , here it is. Although I am not getting the specific lines, instead the whole log is getting indexed.   transforms.conf [err_line] REGEX = ^(?!.error) DEST_KEY = _MetaData:Index FORMAT = error_idx props.conf [err_src] TRANSFORMS-err_line = err_line     ... View more

You're right! my mistake, I didn't read the entire query. Thanks for pointing out my mistake! ... View more

Beautiful. Thank you, this worked and now I understand how to pass the time in when it gets stripped out earlier. ... View more

Any suggestions by anyone or any query to suggest which I can use to leverage to convert and enforce user's input time to UTC time format only ? ... View more

First load the lookups and then group both realms using stats. Try to do something like this and adjust it to your needs,  assuming there is a field that is common in both data sets:   |inputlookup lookup1 |inputlookup lookup2 append=true | stats values(fieldA) AS fieldA (...) by fieldB_common_in_both_datasets     If there is not common field, use rename or eval to create that common field before the stats: | inputlookup lookup1 | inputlookup lookup2 append=true | rename fieldC as fieldB | stats values(fieldA) AS fieldA (...) by fieldB       ... View more

Holy Cow! Per that document, I tried enabling: mc_auto_config = enabled ...and it removed all my indexers from the cluster. Good times. I think I'll just learn to live without those volume dashboards, wouldn't be the first time I had to ignore missing functionality. Pro tip:  don't bother taking the advanced troubleshooting class at Splunk.conf -- didn't prepare me for anything useful... ... View more

Great! Thanks for your help, i had checked the article, but each bucket consist of raw data and tsidx file only. i am asking after the raw data is parsed and normalized, should they stored in somewhere in the parsed form. ... View more

Having a HF with a higher version than the Indexers is not recommended by Splunk. Obviously you can do it, and if it's just between minor versions you may get away with it, but you will probably encounter problems that may seem "bugs" but are just compatibility problems. Check the docs: https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers   I would suggest install a v7 HF as a quick fix, but then upgrade Indexers asap to current version as they are EOL. ... View more

Try this | rex field=message "reqPath\\\":\\\".*/(?<reqPath>\w+)" where the .* is a greedy capture up to the final / character ... View more

My bad, it was missing the 'g' (global) flag at the end | makeresults | eval ip=split("010.1.2.3,10.013.2.3,010.001.002.003",",") | mvexpand ip | rex field=ip mode=sed "s/\b0+\B//g"   ... View more

Obviously it depends on the types of logs you are monitoring: - if its static files, UF/HF will save a checkpoint of where they stop reading, and will continue whenever you start them again - if is tcp/udp or syslog-like, you need to adopt other strategies like setting up a distributed Splunk environment with a cluster of Indexers or a Syslog server to receive the tcp/udp logs and write them to files. ... View more

Hi, Single Splunk instance. I searched for that in Splunk, a couple of results from metrics.log, but nothing came out as Warning. The log_level is INFO for all. ... View more

Hi @phanTom  thanks for the suggestions, they help!   ... View more

Also please note (it's worth mentioning because that's not obvious) that if you aggregate some values into several multivalued fields (like in your case - multivalued VM field and col2 field) the contents of those multivalued fields are from now on independent on each other. So you can't for example - sort one using the order of the other. Again - it's not a spreadsheet. ... View more

Do not treat structured data such as XML as string text is my usual advice.  Splunk's built-in routines designed to process XML (e.g., spath) is much more robust than any regex you can construct. If you have difficulty with using spath and such, post sample/mock data (anonymize as needed) and explain what search you use and what result you get, how the result is different from your desires. ... View more

Well, yeah, I understand how I can convert the time from epoch, but I am trying to do this inside of a workflow action.  Someone searches "index=firewall", and then they click on "Event Actions" to click on the workflow action.  How does the time get converted through that mechanism? ... View more

@andrewtrobec  Are you sure all power user has the same issue or only a specific user, please check that. If only this user is having this issue, there is a great deal of chance that the user has navigation in his/her etc/user/local folder. Which is overriding what the App's default navigation. If all power user is having this issue, then you may have changes some capability for roles in your environment..   I hope this helps!!! ... View more

thanks this solution is working for some test cases. in other test case like in this one count field is zero , so i want custom message if count field is zero , any suggestions. ... View more

i tried couple of time for the same error but seen the same error. after that i tried above work around   $SPLUNK_HOME/etc/apps/ForensicInvestigator/default/data/ui/views iconv -f UTF-16LE -t UTF-8 portsservices.xml -o portsservices1.xml i removed the old file and renamed the portsservices1.xml to portsservices.xml and it worked for me  after that i started the splunk everything is working as expected. ... View more