Updated query for 2024 looks like this:   index=_audit sourcetype=audittrail action=remove_user | stats values(_time) as _time values(user) as removed_by by username ... View more

I found it in this folder structure --> C:\Program Files\Splunk\etc\system\default\web.conf   ... View more

apply to data input instance where data is first read by Splunk props.conf [too_small] PREFIX_SOURCETYPE = false PREFIX_SOURCETYPE = <boolean> * NOTE: this setting is only relevant to the "[too_small]" sourcetype. * Determines the source types that are given to files smaller than 100 lines, and are therefore not classifiable. * PREFIX_SOURCETYPE = false sets the source type to "too_small." * PREFIX_SOURCETYPE = true sets the source type to "<sourcename>-too_small", where "<sourcename>" is a cleaned up version of the filename. * The advantage of PREFIX_SOURCETYPE = true is that not all small files are classified as the same source type, and wildcard searching is often effective. * For example, a Splunk search of "sourcetype=access*" retrieves "access" files as well as "access-too_small" files. * This setting applies at input time, when data is first read by Splunk software, such as on a forwarder that has configured inputs acquiring the data. * Default: true   ... View more

Cloud Vetting is the process of review, including manual code review, that Splunk uses to determine if a Splunk app is fit for installation on a Splunk Cloud deployment. AppInspect is a static analysis tool that we use as part of the Cloud Vetting process and is available to you, the developer, for validating apps before uploading them to Splunkbase or to your own Splunk Cloud or Splunk Enterprise deployments.  AppInspect has the ability to flag specific patterns in a Splunk app as, among other things, "success", "fail", or "manual_check". When an app is run against the "cloud" tag  in the AppInspect API, if: no checks return "fail" or "manual_check", then the app is approved for Splunk Cloud automatically any checks return "fail", then the app is rejected and cannot be installed in Splunk Cloud no checks return "fail" but any checks return "manual_check" then the app must go through the full manual Cloud Vetting process As you're building your Splunk app, I would recommend submitting the app package to the AppInspect API during development and paying close attention to any "manual_check" results. If you have questions about any results that aren't answered by the documentation, you can always reach out to us at appinspect@splunk.com  ... View more

Is there a way to remove any day where the specific event count is 0? I would like to remove any day where the logs did not import. The days with events 0 are throwing off my averages.  ... View more

Could you please help me out how to search multiple words from raw data ... View more

done it mate. thanks ... View more

One other thing. Tomcat is a widely adopted and used application, so are you trying to tell me that Splunk cannot handle Tomcat logs without custom props and transforms? That seems like a waste. ... View more

Here is from splunkd.log: 09-16-2015 09:15:38.908 -0500 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\n hand.execute(info)\n File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\css_setup_handler.py", line 72, in handleList\n job = jobs.oneshot('search sourcetype=cisco:asa OR sourcetype=cisco:fwsm OR sourcetype=cisco:pix | head 1 | stats count')\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\client.py", line 2992, in oneshot\n **params).body\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\client.py", line 764, in post\n return self.service.post(path, owner=owner, app=app, sharing=sharing, **query)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 240, in wrapper\n return request_fun(self, *args, **kwargs)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 62, in new_f\n val = f(*args, **kwargs)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 658, in post\n response = self.http.post(path, all_headers, **query)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 1090, in post\n return self.request(url, message)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 1107, in request\n response = self.handler(url, message, **kwargs)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 1225, in request\n connection.request(method, path, body, head)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 995, in request\n self._send_request(method, url, body, headers)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 1029, in _send_request\n self.endheaders(body)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 991, in endheaders\n self._send_output(message_body)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 844, in _send_output\n self.send(msg)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 806, in send\n self.connect()\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 1194, in connect\n self.timeout, self.source_address)\n File "D:\Program Files\Splunk\Python-2.7\Lib\socket.py", line 571, in create_connection\n raise err\nerror: [Errno 10061] No connection could be made because the target machine actively refused it\n 09-16-2015 09:15:38.908 -0500 ERROR AdminManagerExternal - Unexpected error "" from python handler: "[Errno 10061] No connection could be made because the target machine actively refused it". See splunkd.log for more details. 09-16-2015 09:15:38.908 -0500 ERROR SetupAdminHandler - Error while fetching url=/servicesNS/nobody/Splunk_CiscoSecuritySuite/css_setup/css_setup_endpoint/default/?_strict=true;search=%20eai%3Aacl.app%3D%22%22%20OR%20eai%3Aacl.app%3D%22Splunk_CiscoSecuritySuite%22 ... View more

You should contact support stating your issue. Presuming you are up to date on "maintenance", they will have no problem getting you an updated key. ... View more

This worked flawlessly for me in 7.3.1! Thanks for posting. I did see this while going through the process: C:\Windows\system32>C:\progra~1\Splunk\bin\splunk.exe cmd python c:\progra~1\Splunk\bin\genSignedServerCert.py -d c:\progra~1\Splunk\etc\certs -n splunk -c splunk -p **NOTE: This script is deprecated. Instead, use "splunk createssl server-cert"** Does anyone know if the commands are the same for "splunk createssl server-cert"? ... View more

The new link is here: http://apps.splunk.com/app/1538/ or here: http://pmdba.files.wordpress.com/2013/12/real-time-oracle-11g-log-file-analysis2.pdf ... View more

Thanks, your input is much appreciated! ... View more

I have tried the Eval method and that worked for me. Thank you. ... View more

Yes, absolutely. ... View more

A different type of output show hosts and installed software: sourcetype=package index=os | multikv noheader=t | rex field=_raw "^(?P[^ ]+)\s+(?P[^ ]+)\s+(?P[^ ]+)\s+(?P\w+)" | search NOT NAME NOT VERSION NOT RELEASE NOT ARCH | dedup host package version release arch |table host package version release arch ... View more

Thanks, i did raised a fresh post : https://answers.splunk.com/answers/673339/debug-timestamp-issue-for-data-coming-from-udp-por.html ... View more

Thanks for posting the sample log. That makes it easier. Here is a shot at the search: sourcetype="*WinEventLog:Security" Message="An account failed to log on*" | stats count by Account_Name | where count > 5 | table Account_Name, ComputerName, Workstation_Name You can put any of the fields listed on the left-hand side of the search in your table. ... View more

I would not recommend LINE_BREAKER = (?!) Instead, please use something like LINE_BREAKER = ()zqsxtp-will-not-be-present In other words, a paren pair, and text which will not be present in your event, preferably starting with a rare character. ... View more

You could easily run a CLI or API search that checks on event counts from each Splunk Server. Obviously, there will be a penalty of running the search. Similarly, you could check on known sources across all servers and report on those event counts by "splunk_server". For example, to check all servers to see if they are indexing I could do this search: index=_internal source=*metrics.log earliest=-2m | stats count by splunk_server Regarding auto load balancing, it works as follows... Assume I have 5 indexers, call them i1, i2, i3, i4, and i5. If my forwarder is running autoLB, it will do the following: Randomly select and indexer from the pool i1 - i5. In this case, let's assume we select i1. Send data to i1 for the autoLB period. Randomly select an indexer from the pool i2 - i5 (the indexer we previously sent data to is removed from the pool). In this case, let's assume we select i2. If a connection is established, send data to i2 for the autoLB period. If we cannot establish a connection, select another indexer from the pool i3-i5 (i2 is removed because we can't send data there, but i1 is also removed since we last sent data there). Let's assume we select i5... Send data to i5 for the autoLB period Randomly select an indexer from the pool i1-i4. Wash rinse repeat Notice that splunk removes the previously used indexer from the pool, and if the subsequent indexer fails, it is also removed from the pool until success. ... View more

Any ideas? Is it possible to do the query I need? I need to know when was the first occurrence for each Id, if it's a limits problem, what value should I change? ... View more