Hi @toporagno , did you find a solution? I am looking for answers for the same case. ... View more

Apart from all the valid remarks from @gcusello and @richgalloway , think about what you need. If you want to build on the search shown by @gcusello notice that yours groups login attempts by source (which means that it will show multiple attempts to log in using different usernames but from the same IP as one result) whereas the other one groups by username which means that it will aggregate login attempts to the same account launched from different IPs but split different account login attempts from the same IP as separate results. So it's a question of what you are looking for. ... View more

Hi @toporagno , let me understand: you have an eventtyle like "index=my_index src=10.0.0.1" that tags these events with a tag like "MY_TAG", you have a search that uses the above src and it runs, you want to replace the condition "src=10.0.0.1" with the condition tag=MY_TAG, and it doesn't run, is it correct? If this is your use case, as also @ITWhisperer asked, the first thing is sharing the search and the eventtype associated to the tag. Then, tag is the only field case sensitive, are you sure that the tag value is correct? Second check: did you tried to replace the condition "src=10.0.0.1" with the eventtype associated to the tag? maybe the two conditions aren't compatible. Ciao. Giuseppe ... View more

Indexers will automatically copy buckets from local storage to SmartStore/S3 when they roll from hot to warm.  You can try to tune the hot bucket lifetime to 30 days, but I don't recommend it.  Let them roll normally and size your SmartStore cache so it's large enough to hold 30 days' of data. Use the frozenTimePeriodInSecs setting in indexes.conf to specify the lifetime of the data.  Buckets will be removed from S3 when the newest event in the bucket is older than the specified time. ... View more

allow_skew won't stop alerts from triggering every 5 minutes.  To stop the alerts you have a few options 1) Stop whatever is triggering the alerts 2) Change the threshold of the alert so it's less likely to be triggered 3) Run the alert less frequently 4) Some combination of the above ... View more

Hi @toporagno, Icould be more detailed if you share your inputs.conf in the forwarder. anyway, you should have somethig like this: [monitor://C:\my_directory\my_file.log] index=my_index sourcetype=my_sourcetype disabled=0 As I said, if you have few Universal Forwarders, you can manually modify all the inputs.conf, if they are many, you should think to use a Deployment Server, but this is another project. For more infos about DS, you can see at https://docs.splunk.com/Documentation/Splunk/9.1.2/Updating/Aboutdeploymentserver Ciao. Giuseppe ... View more