×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sawwinnaung
Explorer
Member since: ‎10-26-2023
‎06-15-2025
Community Statistics
Posts 5
Solutions 2
Karma Given 0
Karma Received 1
Member Since ‎10-26-2023
View All

Re: Auditd logs are not being discarded as expecte...

by in Getting Data In
‎06-16-2025 03:00 AM
‎06-16-2025 03:00 AM
When I applied below confs in HF, PROCTITLE has been discarded successfully .  Thanks for your help and suggestions. props.conf [linux_audit] TRANSFORMS-set = discard_proctitle [source::/var/log/audit/audit.log] TRANSFORMS-set = discard_proctitle transforms.conf [discard_proctitle] REGEX = ^type=PROCTITLE.* DEST_KEY = queue FORMAT = nullQueue       ... View more

Re: Auditd logs are not being discarded as expecte...

by in Getting Data In
‎06-16-2025 01:09 AM
‎06-16-2025 01:09 AM
@gcusello                 The props.conf and transforms.conf files are located on the indexer under the following path: /app/splunk/etc/apps/TA-linux_auditd/local/ These configurations previously worked successfully. However, after upgrading the Splunk version and migrating the Linux environment, the configurations no longer seem to function as expected. Thanks for your suggestions. ... View more

Re: Auditd logs are not being discarded as expecte...

by in Getting Data In
‎06-16-2025 12:46 AM
‎06-16-2025 12:46 AM
@PrewinThomas              Thanks for your help. Even though I updated REGEX = type=PROCTITLE in transforms.conf located on the indexer, the filtering still isn’t working.   ... View more

Auditd logs are not being discarded as expected!

by in Getting Data In
‎06-15-2025 09:53 PM
‎06-15-2025 09:53 PM
I am trying to setup props & transforms in indexers to send PROCTITLE events to null queue i tried below regex but that doesn't seem to work.  props.conf and transforms.conf location:   /app/splunk/etc/apps/TA-linux_auditd/local/ props.conf [linux_audit] TRANSFORMS-set = discard_proctitle [source::/var/log/audit/audit.log] TRANSFORMS-set = discard_proctitle transforms.conf [discard_proctitle] REGEX = ^type=PROCTITLE.* DEST_KEY = queue FORMAT = nullQueue sample event-   type=PROCTITLE msg=audit(1750049138.587:1710xxxx): proctitle=737368643A206165705F667470757372205B70726xxxxx   type=PROCTITLE msg=audit(1750049130.891:1710xxxx): proctitle="(systemd)" type=PROCTITLE msg=audit(1750049102.068:377xxxx): proctitle="/usr/lib/systemd/systemd-logind" Could someone help me to fix this issue?   ... View more

Re: Splunk Monitoring Console does not load all vi...

by in Dashboards & Visualizations
‎10-26-2023 08:42 AM
1 Karma
‎10-26-2023 08:42 AM
1 Karma
I also got that issue after upgrade the DMC. Find the missing js file from the developer console and copy those js from quarantined directory to the relevant directory. Then restart the server. My DMC resolve and visulizations are came back to norma.   Don't forget to turn off restriction under Settings > Server Settings > Internal Library Settings.  ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-15-2025 09:36 PM
Karma from
View All