I use this SPL to bring out the notes in findings.  index=notable |join source_event_id [|search index=_audit source=mc_notes | rex field=_raw "^(?<timestamp>[^,]+),(?<incident_id>[^,]+),(?<user>[^,]+),(?<model>[^,]+),(?<command>[^,]+),\"(?<json>\{.*\})\"$" | eval json=replace(json,"\\\\\"","\"") | spath input=json path=content output=content | spath input=json path=author.username output=author | spath input=json path=create_time output=create_time | spath input=json path=notable_id output=source_event_id | eval content=urldecode(content)|convert ctime(create_time) | table timestamp incident_id user command author content source_event_id create_time]|table search_name rule_description user parent_process process annotations.mitre_attack content create_time entity   ... View more

you're right! I kind of handle the OS problem but the real question is base on the mentioned architecture should I install Splunk on new hosts first? and then copy the splunk_home directory from my old host to it? and what a about Indexers? I just want change the OS . is it possible to unmount indexers bucket from old host and mount it on new host? ... View more

the error was related to fapolicy in linux. I made some changes in the policy conf file and now it's ok. to run splunk. the real question is base on the mentioned architecture should I install Splunk on new hosts first? and then copy the splunk_home directory from my old host to it? and what a about Indexers? I just want change the OS . is it possible to unmount indexers bucket from old host and mount it on new host? ... View more