Updated query for 2024 looks like this:   index=_audit sourcetype=audittrail action=remove_user | stats values(_time) as _time values(user) as removed_by by username ... View more

I realize this is an old thread but in case anyone is running into this, this is how I solve it: Do a running read of splunkd.log while searching for "while reading" tail -f /opt/splunk/var/log/splunk/splunkd.log | grep -i "while reading" Stop splunk and keep looking at the output of the tail command. Whichever file splunk was reading while it was shutdown, is your trouble file. ... View more

This technique doesn't appear to work in 9.2.0. Is there a new technique to mirror dashboards from one app to another? I did have to navigate deeper and into the .../ui/views folder but just assumed that is due to this post being five years old. TIA! $SPLUNK_HOME/etc/apps/<source app>/local/data/ui/views/<source dahsboard>.xml   ... View more

Fair enough. I wish there was a Splunk way to push these changes to system/local that didn't include a third party application.   Would you recommend show config vs btool in this case? ... View more

Can you explain the regex? it looks like (?::) looks for any field identifier... but what about {0}? Is that for zero of that field identifier? I am asking because I am trying the stanza below and it doesn't seem to be working: [source::(top)|(ps)|(bandwidth)] Context: sending ta_nix data from UF to HF, then using RFS to send to flat file. The stanza aboves simply routes the data to the destination using ingest actions.  Thanks! ... View more

Thanks, but I looked at both links below and see no mention of it...should I be looking somewhere else? https://docs.splunk.com/Documentation/Splunk/9.2.0/ReleaseNotes/Knownissues https://docs.splunk.com/Documentation/Splunk/9.1.3/ReleaseNotes/KnownIssues  ... View more

Any documentation on this error? I did not see it in any of the Release Notes or Fixed Issues ... View more

This is also an issue for me (not using aggregations). All the $trellis...$ tokens don't work when passing to a custom search. My workaround was to copy the URI generated for my search, and insert the $trellis...$ token in the proper place (I used a |u for URL encoding but not sure it's necessary). When using the "Link to Custom URL" drilldown, the tokens work just fine. Downside is that now the user gets the  "Redirecting Away From Splunk" message prior to being redirected. ... View more

Thank you @richgalloway and @bowesmana  - I'd accept both as the solution if I could as I learned about the return and format commands from you both. I accepted return as the solution since I wanted to use the IN search, and couldn't format the format command to remove the column names from the generated string. Not sure this is right, but I ended up having to use an eval command to append quotesa and commas to my values, prior to the return statement. In the end, it was something like...  index=syslog src_ip IN ( [ | tstats count from datamodel=Random by ips | stats values(ips) as IP | eval IP = "\"".IP."\"," | return $IP ] )  Thanks again! ... View more

Not sure if this was the right solution, but on the base search, I changed it from "metrics search" to "ad-hoc" and the prepopulated search has eval statements that create the "Free MB /" and other fields, making my KPIs populate. ... View more

[bump] would be nice to get an answer to this. I haven't been able to figure it out ... View more

Hey, if I ended up here, someone else might too and maybe, just maybe, I saved them 5minutes of work.  ... View more

Thanks for doing the legwork here! Figured I'd post the results of your perl scrip to make it even easier. Also, here's an updated url for a matrix.  https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/privileged-access-manager/4-0/reference/messages-and-log-formats/syslog-message-formats/syslog-priority-facility-severity-grid.html code,facility,severity 0,Kernel,Emergency 1,Kernel,Alert 2,Kernel,Critical 3,Kernel,Error 4,Kernel,Warning 5,Kernel,Notice 6,Kernel,Info 7,Kernel,Debug 8,User,Emergency 9,User,Alert 10,User,Critical 11,User,Error 12,User,Warning 13,User,Notice 14,User,Info 15,User,Debug 16,Mail,Emergency 17,Mail,Alert 18,Mail,Critical 19,Mail,Error 20,Mail,Warning 21,Mail,Notice 22,Mail,Info 23,Mail,Debug 24,System,Emergency 25,System,Alert 26,System,Critical 27,System,Error 28,System,Warning 29,System,Notice 30,System,Info 31,System,Debug 32,Security,Emergency 33,Security,Alert 34,Security,Critical 35,Security,Error 36,Security,Warning 37,Security,Notice 38,Security,Info 39,Security,Debug 40,Syslog,Emergency 41,Syslog,Alert 42,Syslog,Critical 43,Syslog,Error 44,Syslog,Warning 45,Syslog,Notice 46,Syslog,Info 47,Syslog,Debug 48,Lpd,Emergency 49,Lpd,Alert 50,Lpd,Critical 51,Lpd,Error 52,Lpd,Warning 53,Lpd,Notice 54,Lpd,Info 55,Lpd,Debug 56,Nntp,Emergency 57,Nntp,Alert 58,Nntp,Critical 59,Nntp,Error 60,Nntp,Warning 61,Nntp,Notice 62,Nntp,Info 63,Nntp,Debug 64,Uucp,Emergency 65,Uucp,Alert 66,Uucp,Critical 67,Uucp,Error 68,Uucp,Warning 69,Uucp,Notice 70,Uucp,Info 71,Uucp,Debug 72,Time,Emergency 73,Time,Alert 74,Time,Critical 75,Time,Error 76,Time,Warning 77,Time,Notice 78,Time,Info 79,Time,Debug 80,Security,Emergency 81,Security,Alert 82,Security,Critical 83,Security,Error 84,Security,Warning 85,Security,Notice 86,Security,Info 87,Security,Debug 88,Ftpd,Emergency 89,Ftpd,Alert 90,Ftpd,Critical 91,Ftpd,Error 92,Ftpd,Warning 93,Ftpd,Notice 94,Ftpd,Info 95,Ftpd,Debug 96,Ntpd,Emergency 97,Ntpd,Alert 98,Ntpd,Critical 99,Ntpd,Error 100,Ntpd,Warning 101,Ntpd,Notice 102,Ntpd,Info 103,Ntpd,Debug 104,Logaudit,Emergency 105,Logaudit,Alert 106,Logaudit,Critical 107,Logaudit,Error 108,Logaudit,Warning 109,Logaudit,Notice 110,Logaudit,Info 111,Logaudit,Debug 112,Logalert,Emergency 113,Logalert,Alert 114,Logalert,Critical 115,Logalert,Error 116,Logalert,Warning 117,Logalert,Notice 118,Logalert,Info 119,Logalert,Debug 120,Clock,Emergency 121,Clock,Alert 122,Clock,Critical 123,Clock,Error 124,Clock,Warning 125,Clock,Notice 126,Clock,Info 127,Clock,Debug 128,Local0,Emergency 129,Local0,Alert 130,Local0,Critical 131,Local0,Error 132,Local0,Warning 133,Local0,Notice 134,Local0,Info 135,Local0,Debug 136,Local1,Emergency 137,Local1,Alert 138,Local1,Critical 139,Local1,Error 140,Local1,Warning 141,Local1,Notice 142,Local1,Info 143,Local1,Debug 144,Local2,Emergency 145,Local2,Alert 146,Local2,Critical 147,Local2,Error 148,Local2,Warning 149,Local2,Notice 150,Local2,Info 151,Local2,Debug 152,Local3,Emergency 153,Local3,Alert 154,Local3,Critical 155,Local3,Error 156,Local3,Warning 157,Local3,Notice 158,Local3,Info 159,Local3,Debug 160,Local4,Emergency 161,Local4,Alert 162,Local4,Critical 163,Local4,Error 164,Local4,Warning 165,Local4,Notice 166,Local4,Info 167,Local4,Debug 168,Local5,Emergency 169,Local5,Alert 170,Local5,Critical 171,Local5,Error 172,Local5,Warning 173,Local5,Notice 174,Local5,Info 175,Local5,Debug 176,Local6,Emergency 177,Local6,Alert 178,Local6,Critical 179,Local6,Error 180,Local6,Warning 181,Local6,Notice 182,Local6,Info 183,Local6,Debug 184,Local7,Emergency 185,Local7,Alert 186,Local7,Critical 187,Local7,Error 188,Local7,Warning 189,Local7,Notice 190,Local7,Info 191,Local7,Debug ... View more

GENIUS! ... View more

@rrthokala wrote: appended the cert information to cacert.pem in python lib to make it work. where is this python lib located? ... View more

this also works for ta-webtools. /opt/splunk/etc/apps/TA-webtools/bin/curl.py sed -E 's/verify=True/verify=False/' /opt/splunk/etc/apps/TA-webtools/bin/curl.py -i @rphillips_splk wrote: This looks like the server (jira side) is rejecting the request because the client (splunk hf with add-on for jira) has verify=True for ssl certificate and likely the client does not have the ssl cert that the server has. It looks like ssl cert verification is True by default in this add-on and needs to be changed from True to False to change this behavior. /users/splunk/etc/apps/jira/bin/libs/requests/sessions.py line 319 set self.verify to False "with a capital F" : SSL Verification default. self.verify = False /users/splunk/etc/apps/jira/bin/libs/requests/adapters.py line 329: def send(self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None): change verify=True to verify=False then restart splunk and see if you still get the SSL errors.   ... View more

Wow. This is why I didn't find answers to this on the internet, it worked with the spaces 🙄.  row.Customer Address.value. Thank you! ... View more

No dice, didn't work 🙂  ... View more

in  mvindex(value,1) , what does value represent? Couldn't find it in the documentation. Also, how did you account for the hex colors that are now a part of the results? ... View more

can you explain the point of coalesce() in the solution? Are you trying to account for null fields with blank instead of null? ... View more