Hello @martynjlewis , Go to the Support Portal and submit a New Case.  ... View more

Hello @anandhalagaras1 , If you're creating a custom app, you'll need to write the configuration in your default directory; otherwise, it will give you an error during validation, and the app won't pass the vetting process in Splunk Cloud. ... View more

Hello @anandhalagaras1  I believe that while changing the default value directly may not be possible, we can still achieve the desired outcome. Instead of adjusting the default setting, we can create a scheduled search with the preferred value of 20. This means that whenever the search is scheduled to run, it will automatically use the desired setting without needing to be manually adjusted each time. This ensures a consistent experience for users without worrying about the default value being reset. If this reply helps you, Karma would be appreciated. ... View more

Hello @Nimi1 , Below 2 points might be the reason for duplicate events ingested in Splunk - 1 - It might be possible that if you have multiple forwarders and you've enabled the same input (like ELB access logs) on all of them, it could lead to duplicate events being sent to Splunk. This duplication may occur because each forwarder is independently sending the same logs, resulting in repeated entries in your Splunk data. 2 - By mistake If you've enabled multiple inputs for the same source within Splunk, like ELB access logs, it could result in the same logs being ingested multiple times, leading to duplicates in your Splunk data. If this reply helps you, Karma would be appreciated. ... View more

Hello @Dattasri , You can use the below mentioned search query in which I have used the random function to generate values between 0 and 100, and then applied the `stats count` command. | makeresults count=10 | eval rand=(random() % 100) + 1 | stats count(eval(rand > 60)) as count_greater_than_60, count(eval(rand < 60)) as count_less_than_60 If this reply helps you, Karma would be appreciated. Thanks, Surbhi   ... View more

Hello @billy , Can you please use the configuration provided below, where I've added the sourcetype in inputs.conf:   [WinEventLog://Security] disabled = 0 current_only renderXml = 1 whitelist = 4624, 4634 sourcetype = XmlWinEventLog:Security     2 - You can also configure the files using source instead of sourcetype   inputs.conf - [WinEventLog://Security] disabled = 0 current_only renderXml = 1 whitelist = 4624, 4634 props.conf - [source::XmlWinEventLog:Security] TRANSFORMS-Xml = send_to_3rd_party transforms.conf [send_to_3rd_party] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = foobar   If this reply helps you, Karma would be appreciated. Thanks, Surbhi ... View more

Hello @vishenps , First, upgrade the add-on builder version. Then, move all configurations to the default directory within the custom app from the local directory, and then remove the local directory. Finally, proceed with the vetting process. Let me know how it goes 🙂 Please accept the solution and hit Karma, if this helps! ... View more

Hello @sushraw  Can you please try appending below -  | makemv CmdArgAV | eval CmdArgAV = replace(CmdArgAV, "\n", ", ")   The final results based on the sample event you shared would be - | makeresults | eval _raw="Mar 26 15:37:59 <device_IP> <device_name>_Passed_Authentications 0045846127 2 0 2024-03-26 14:37:59.011 +00:00 06024423114 5202 NOTICE Device-Administration: Command Authorization succeeded, ConfigVersionId=1398, Device IP Address=<device_IP>, DestinationIPAddress=<device_IP>, DestinationPort=49, UserName=<user>, CmdSet=[ CmdAV=show CmdArgAV=running-config CmdArgAV=interface CmdArgAV=Ethernet1/19 CmdArgAV=<cr> ], Protocol=Tacacs, MatchedCommandSet=Unsafecommand, RequestLatency=10, NetworkDeviceName=<device_name>" | rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]" | rex field=CmdSet max_match=0 "CmdArgAV=(?<CmdArgAV>[^\s]+)" | makemv CmdArgAV | eval CmdArgAV = replace(CmdArgAV, "\n", ", ")   Below screenshot for your reference -   If this reply helps you, Karma would be appreciated. ... View more