Hi all, Yesterday I had 8 Universal Forwarders visible in Forwarder Management. Today it shows 0. Environment Splunk Enterprise on Linux acting as a Deployment Server Mix of Linux and Windows Universal Forwarders Forwarder Management UI has no filters; “All versions” is selected Questions What are the first checks you recommend when the agent list suddenly drops to zero? Could this be related to license state, SSL on port 8089, or server classes? How can I quickly confirm whether forwarders are still phone-homing to the DS? Which logs or REST endpoints should I look at on the DS and on a UF? Any common misconfigurations that cause this overnight? Thanks for any guidance and a simple step-by-step to diagnose.     ... View more

Hi All,  i do create new index but the source data is from savedsearch let say i create savedsearch from index=ABC then the output i sent to index=BCD  then in index=BCD have result _raw field from index=ABC, like this. all the fields from index=ABC all is gone   Then when i try to create regex using SPL query all fields was created index=zake-alert sourcetype=alert:access | rex field=_raw "ComputerName:\s+\"?(?<ComputerName>[^\",\r\n]+)" | rex field=_raw "Locked Out User\s*ID:\s+\"?(?<LockedOutUserID>[^\",\r\n]+)" | rex field=_raw "User Full Name:\s+\"?(?<UserFullName>[^\"\r\n]*)" | rex field=_raw "Source of Lockout:\s+\"?(?<SourceOfLockout>[^\",\r\n]+)" | rex field=_raw "RecordNumber:\s+\"?(?<RecordNumber>\d+)" | rex field=_raw "Raw_Message:\s+\"?(?<Raw_Message>[^\r\n\"]+)" | eval mitre_tactic_id="TA0006", mitre_technique_id="T1110" | table _time ComputerName LockedOutUserID UserFullName SourceOfLockout RecordNumber Raw_Message mitre_tactic_id mitre_technique_id But when i set up using props.conf nothing happened...    Can someone explain me this ?  ... View more

Hi all, I’m extracting fields from an event using the Field Extractor with a pipe (|) delimiter for sourcetype=alert:access. The extractor produces many interim fields (field1, field2, … fieldN). I only need a subset of them and want to discard the rest. Example (redacted) raw sample: Detection: Suspicious Account Lockout Activity (T1110) _time: 1758185796 ComputerName:"MACHINE007.zake.com" | 666 | ... | mitre_technique_id:"T1110" | mitre_tactic_id:"TA0006" | RecordNumber:"307552707" | Raw_Message:"..." From this tokenized output I only want to keep: field2 → host (example: MACHINE007.zake.com) field4 → locked_out_user_id (example: 666) field10 → mitre_technique_id (example: T1110) field12 → mitre_tactic_id (example: TA0006) All other generated fields should be ignored/removed. What is the recommended approach to achieve this? Thanks in advance for your guidance! ... View more

Hi Everyone, I am in the process of installing Splunk UBA and have a question regarding the storage partitioning requirements. The official documentation (link below) states that separate physical disks, /dev/sdb and /dev/sdc, are required for specific mount points to ensure performance. Documentation Link: https://docs.splunk.com/Documentation/UBA/5.3.0/Install/InstallSingleServer#Prepare_the_disks However, my current server is configured with a single physical disk (/dev/sda) that uses LVM to create multiple logical volumes. Here is my current lsblk output: [zake@ubaserver]# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 2.7T 0 disk ├─sda1 8:1 0 1G 0 part /boot/efi ├─sda2 8:2 0 1G 0 part /boot └─sda3 8:3 0 2.7T 0 part ├─rhel-root 253:0 0 80G 0 lvm / ├─rhel-swap 253:1 0 16G 0 lvm [SWAP] ├─rhel-var_vcap2 253:2 0 1T 0 lvm /var/vcap2 ├─rhel-var_vcap1 253:3 0 1T 0 lvm /var/vcap1 ├─rhel-home 253:4 0 118.8G 0 lvm /home └─rhel-backup 253:5 0 500G 0 lvm /backup sr0 11:0 1 1024M 0 rom My question is: Can my existing logical volumes, /dev/mapper/rhel-var_vcap1 and /dev/mapper/rhel-var_vcap2, be used as a substitute for the required /dev/sdb and /dev/sdc disks? I understand the requirement for separate physical disks is likely due to I/O performance. Would using this LVM setup on a single disk be a supported configuration, or is adding two new physical/virtual disks a mandatory step? Thank you for your guidance. ... View more

Hi Everyone, I am trying to install SplunkUI to explore it, the documentation I followed is from the following link https://splunkui.splunk.com/Packages/create/CreatingSplunkApps And when I reached the 'yarn start' stage, everything went smoothly. However, when I restarted Splunk to see the results, I couldn't see any changes from before. Does anyone know about this issue?   ... View more