@whitecat001 Confirm the SPL used in the alert. ... View more

Hi @whitecat001 , sorry but there's something strange in your request: are you speaking about how to ingest json files in a forwarder or how to parse json files in Search Heads Cluster? you spoke of Deployer that's used in Search Head Cluster, if your requirement is to parse a json file, you have to add INDEXED_EXTRACTIONS=JSON to the sourcetype using the web gui and this configuration is replicated to the hother Search Heads. If instead you are speaking about how to ingest and parse a json file, you have to add INDEXED_EXTRACTIONS = JSON to the sourcetype in props.conf, in the forwarders using the Deployment Server or manually. What's your requirement? Ciao. Giuseppe ... View more

If the same search on the same data ran within the same app (are you running both searches from the same app?) yields different results for two different users there must be some difference in configuration. It can be either due to one of the users having custom settings defined on a per user level or difference in permissions to the app the settings (probably either extractions or calculated fields) are defined in. Compare settings for relevant sourcetype with app and user context using btool. ... View more

You'll need to provide more information - are you exporting to CSV when you say null values, do you mean it has the word NULL or is there just an empty field in the exported data (i.e. ,, in CSV) how are you exporting the data, is it just using the export button underneath the search or are you trying to export using the Export button at the top of the dashboard   ... View more

Hi @whitecat001, Alerts (scheduled searches with alert actions enabled) can fail to run for many reasons. For example, searches can fail because of SPL syntax errors, searches can be skipped because of scheduling contention, actions can fail, or splunkd may not be running. What is your definition of "failed to run?"   ... View more

Assuming you don't have suitable admin permissions to directly manipulate knowledge objects, then the simplest way is to  Dashboard Edit the dashboard source, copy the dashboard Change to new app, create new dashboard and paste the data If you cannot edit the dashboard, but can clone it, then clone it privately, edit the dashboard and copy as above Lookup - assuming the existing lookup is app visible only and NOT global in the source app run  | inputlookup lookup_to_be_copied.csv | outputlookup my_tmp_copy.csv then in the new app space do | inputlookup my_tmp_copy.csv | outputlookup new_name_in_new_app.csv This assumes that when you do the  outputlookup, it will get private or global app permissions. If it gets global, then the new app will see this, but take care - you don't want 2 lookups of the same name with global scope. If it is output as private then you should be able to 'upgrade' the permissions to app scope in the new app. Much will depend on the permissions you have ... View more

there are several queries : for example sourcetype=Sample_sourcetype :  1- | metadata type=sourcetypes | search sourcetype=Sample_sourcetype | table index, sourcetype 2- | tstats count where sourcetype=Sample_sourcetype by index | table index   ... View more

index=wineventlog sourcetype=WinEventLog EventCode=4624 user="svc*" | eval EventTime=_time | eval EventTime=strftime(_time, "%m/%d/%Y %H:%M:%S %Z" | stats latest(EventTime) as lastlogon by user | table lastlogon, user ... View more

Hi this is quite often asked question. You could find answers from community by google. But shortly, you couldn’t find that information from splunk audit logs. Here is couple links to tell more about the reason. https://community.splunk.com/t5/Splunk-Search/Data-used-by-searches/m-p/687785#M234581 https://community.splunk.com/t5/Splunk-Search/How-to-find-which-indexes-are-used/m-p/674510 r. Ismo ... View more

Hi That’s almost mission impossible with standard setup as you could do queries without defining any indexes into it. You could also use eventtypes etc. to hide real index names. If you star to index all your search logs from sh side and look litesearch part then that could give to you more accurate index list? r. Ismo ... View more

Maybe this is what you need. Note, as far as I know there are no fields that show the index used by a search,  that show the index used by searches, so you have to extract that from the SPL code,  and index= can be all over the place in the code and also in macros,  so its tricky, but may be this will work for you. This shows the count of searches by index_used | rest splunk_server=local /services/search/jobs | fields author title, updated, search, runDuration, provenance, latestTime, owner eai:acl.app, diskUsage | rename author AS user eai:acl.app AS app title AS search_code | rex field=search_code "(?<index_used>index\s*=\s*[^ ]+|index\s+IN|search\s*=\s*index=|search\s*=\s*inputlookup\s+in|index\s*=_\*)" | stats count(search_code) AS volume_of_searches_ran BY index_used | sort - volume_of_searches_ran     ... View more

Here's a query that will find most KOs owned by inactive users.  You may want to enhance it to also look for lookups.  Of course, change the '90' to whatever value you deem to be 'inactive'. | rest splunk_server=local /servicesNS/-/-/admin/directory | fields title eai:acl.app eai:acl.owner eai:type eai:acl.sharing | rename eai:acl.* as * | where (owner!="nobody" AND owner!="admin") | search [| rest splunk_server = local /servicesNS/-/-/admin/users | fields title last_successful_login | eval lastLogin = if(isnull(last_successful_login) OR last_successful_login=0,"never", strftime(last_successful_login, "%c")) | eval idleDays = round((now()-last_successful_login)/86400,0) | where (idleDays > 90 OR lastLogin = "never") | fields title | rename title as owner | format] ... View more

It could be a n umber of things as to why the data is not coming through or not showing. 1.Whatever your monitoring does it have read permissions? 2.Check for typos' (index name etc) You can also check the internal logs for clues index=_internal sourcetype=splunkd host=neo log_level=INFO component=WatchedFile | table host, _time, component, event_message, log_level | sort - _time   What is the output of this command - it shows whats being monitored (Assuming its a linux host) /opt/splunk/bin/splunk list inputstatus   Are you able to show us your inputs.conf and describe what you are trying to monitor? ... View more

Hi @whitecat001 , you can use the regex hinted  by @ITWhisperer , but when you ha a pais fieldnem=fieldvalue, as in your case, you could simply use the field for searching your data: index=your_index permission=Permission12345 | ... Ciao. Giuseppe ... View more

First things first - you're talking about deployer. Do you indeed have your apps on the search-head cluster deployer or maybe you meant the deployment server? ... View more

You should find all neccessary information about Splunk TAs and the kv store in your "_internal" index. As a second step you could check the "source" field for the TAs that you want to monitor. Most of the available TAs are writing logs in their own logfile under $SPLUNK_HOME/var/log/splunk.  For the kv store check the mongod.log. More information: What Splunk software logs about itself - Splunk Documentation ... View more

First, it might be better to just share the KO to global permissions so it can be seen by users of both apps, rather than to copy the KO to the other app - depending on your use-case.  In case that is not feasible, to copy a KO to other apps you have a few options: If there are just a few KOs to be copied, you can do this from the GUI: -Click Settings -> Searches, reports and alerts -search for your KO and click Edit -> Clone, then you can select the app to clone to from the App dropdown list. In case you need to copy KOs in bulk, it is easier to copy the config from the .conf file from one app to the other. You can also use REST to POST configs. ... View more

I want a sample query that will guide in creating one for both TA and Kvstore  ... View more

Then you should check this troubleshooting guide... https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/TroubleshootKVstore ... View more

You have two identical questions!  See the answer from that another one. https://community.splunk.com/t5/Alerting/Knowledge-Object/m-p/680852#M15802 ... View more

Hi You could try this https://github.com/harsmarvania57/splunk-ko-change But usually it’s easier and faster to do that via GUI. Just use Settings-> All objects -> Change ownership (or something like those, I can’t remember exact names). If that doesn’t work (there are some cases when this cannot change all KOs), you should use previous script. r. Ismo   ... View more

Yes. Verify your sources and their config in Splunk. Without more information we can't tell you anything more than that. ... View more

The first event that came in doesnt have a timestamp which is the reason for the error but the other events are extracted properly ... View more

Thank you for your response. I will check it out  ... View more