Oke Thankyou @isoutamo @PickleRick atleast in splunk can ingest everything. If want get specify data Analyst can regex it  ... View more

Hi @isoutamo  Thanks for your information, after i check it.  - Splunk Add-on for Unix and Linux [Installed] - Splunk Common Information Model (CIM) [Installed] - InfoSec App for Splunk [Not Installed] For the UF issue there is no problem at all, here I can get all the logs I need. It's just that the data I get has messy fields like this picture  I think it's not okay that's why i create topic for asking this problem   ... View more

Hi @PickleRick @marnall  Thankyou for your advice, but unfortunately i still can't change it even after i clear my cookies and/or cache. Can this issue solved using another method ? ... View more

I think there is no sensitive data, so here the full error message 2024-09-23 21:06:30,760 INFO [66f175e6c17fc8d479ab10] error:337 - 500 Internal Server Error The server encountered an unexpected condition which prevented it from fulfilling the request. 2024-09-23 21:06:30,760 ERROR [66f175e6c17fc8d479ab10] error:338 - Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 628, in respond self._do_respond(path_info) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 687, in _do_respond response.body = self.handler() File "/opt/splunk/lib/python3.7/site-packages/cherrypy/lib/encoding.py", line 219, in __call__ self.body = self.oldhandler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/htmlinjectiontoolfactory.py", line 75, in wrapper resp = handler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpdispatch.py", line 54, in __call__ return self.callable(*self.args, **self.kwargs) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-2042>", line 2, in help File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 41, in rundecs return fn(*a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-2040>", line 2, in help File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 102, in check if verify_session and not util.checkRequestForValidFormKey(requireValidFormKey=must_login): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 1481, in checkRequestForValidFormKey if not isValidFormKey(form_key) or not doesFormKeyMatchCookie(form_key): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 1452, in isValidFormKey logger.warn('CSRF form_key mismatch received=%s expected[redacted]=%s' % (key, getFormKey()[-4:])) TypeError: 'NoneType' object is not subscriptable Before that i would to say thankyou for reply this post and want to help me ... View more

i was download log file in `/opt/splunk/var/log/splunk/web_service.log` and i open with Notepad++ like this When i search 500 ERROR it showed too much data, could you please give me specify keyword? Because when i want to search macros it not show anything. Sorry very confuse about it    ... View more

Hi @PickleRick  As your information Yesterday if my inputs.conf will mess the sourcetype so i was assesment all sourcetype was generated in my searchhead.  Could you please correction my inputs.conf ? here  [monitor:///var/log/audit/audit.log] disabled = false index = NewIndex sourcetype = linux_audit [monitor:///var/log/auth.log] disabled = false index = NewIndex sourcetype = auth-too_small [monitor:///var/log/cron] disabled = false index = NewIndex sourcetype = kern-too_small [monitor:///var/log/kern.log] disabled = false index = NewIndex sourcetype = kern-too_small [monitor:///var/log/messages] disabled = false index = NewIndex sourcetype = syslog [monitor:///var/log/mongodb/mongod.log] disabled = false index = NewIndex sourcetype = mongod-2 [monitor:///var/log/nginx/access.log] disabled = false index = NewIndex sourcetype = access_combined [monitor:///var/log/nginx/error-NewIndex-fe.log] disabled = false index = NewIndex sourcetype = error-NewIndex-fe-too_small [monitor:///var/log/nginx/jm-click-fe.log] disabled = false index = NewIndex sourcetype = jm-click-fe-too_small [monitor:///var/log/nginx/NewIndex-ess-http-3001.log] disabled = false index = NewIndex sourcetype = NewIndex-ess-http-too_small [monitor:///var/log/nginx/NewIndex-ess-pakta-http.log.1] disabled = false index = NewIndex sourcetype = NewIndex-ess-http-too_small [monitor:///var/log/nginx/NewIndex-jmpd-http.log] disabled = false index = NewIndex sourcetype = access_combined [monitor:///var/log/nginx/NewIndex-be.log] disabled = false index = NewIndex sourcetype = access_combined [monitor:///var/log/nginx/NewIndex-cms-be.log] disabled = false index = NewIndex sourcetype = NewIndex-cms-be-too_small [monitor:///var/log/redis/redis-server.log] disabled = false index = NewIndex sourcetype = redis-server-too_small [monitor:///var/log/sssd/sssd_NewIndex.co.id.log] disabled = false index = NewIndex sourcetype = sssd_NewIndex.co.id-too_small [monitor:///var/log/syslog] disabled = false index = NewIndex sourcetype = syslog [monitor:///var/log/ubuntu-advantage-timer.log] disabled = false index = NewIndex sourcetype = ubuntu-advantage-timer.log-3 [monitor:///var/log/ubuntu-advantage.log] disabled = false index = NewIndex sourcetype = ubuntu-advantage-6 [monitor:///var/log/ufw.log] disabled = false index = NewIndex sourcetype = syslog [monitor:///var/log/unattended-upgrades/unattended-upgrades.log] disabled = false index = NewIndex sourcetype = unattended-upgrades [monitor:///var/log/vmware-vmtoolsd-root.log] disabled = false index = NewIndex sourcetype = vmware-vmtoolsd-root [monitor:///home/*/.bash_history] disabled = false index = NewIndex sourcetype = bash_history Or maybe you have best practice setting for my case ?  ... View more

Thankyou for your information, maybe i will checking it in latest Sourcetype generate default by splunk yesterday. So i can validating directory paths for inputs.conf ... View more

Thankyou for your information, reason why i create /var/log because i want ingest everything in /log and Splunk do it perfectly.  It will be named default by Splunk but its okay  And for .bash_history i input that because that's a request.  Once again thanks sir, now i no need worries anymore about this newIndex size.   ... View more

Could you please give me Format that lookup ?  ... View more

Anyone here ? ... View more

Hi @PickleRick  Thanks for your reply, and knowledge about source can called in the first position. Sorry i don't know that because in many case i got it always solved when i add index=* before the source.  And with your query i only get 0 count, so i think it because my client don't ingest in the Endpoint. Thankyou for your reply and your information.  Danke 🍻 ... View more

Thankyou for all information 🍻 Hope you have a nice day sir Ciao. Zake ... View more

Okay if like that, but did splunk 9.1.5 Compatible with 4.38.0 ? sorry because it's not my personal enviroment that's why i'm so careful before take action.   Ciao. Zake ... View more

Hi @gcusello Thanks for your reply when i check my "ES Content Updates" is version 4.0.0 and it available Update to 4.38.0 I have question if I update it, will it affect other use cases that have been enabled? Or will it be safe for other use cases? ... View more