thanks! | rest /services/authorization/roles | search srchFilter="foo foo foo foo"|fields title srchFilter ... View more

good idea! If i wanted to get a time chart to see if a source type is lets say 20% more than it was last week would MLTK be able to do that as well? ... View more

thanks for your input! it was helpful to get started. I am thinking i am getting close if i can just take the search i made a few years ago and get it to work with the sourcetypes and alert off the -volume_p1 when "Where pct_diff > 20.0" we will be in working shape! wish me luck! index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | stats sum(b) as b by _time, pool, s, h, idx | search pool="Splunk Production" | timechart span=1h sum(b) AS volume | eval "volume"=round (volume/1024/1024/1024, 2) | reverse | autoregress volume | eval pct_diff=1.00*(volume-volume_p1) | Where pct_diff > 20.0 ... View more

You just have to map the LDAP groups to spunk roles, it works great in my experience. Only down side is if someone is pushing a role/mapping from the SHC Deployer and someone using the SHC GUI to apply/adds roles, this will cause issues and will remove all index access to the role that sees configs from the deployer and the local SHC configs. its easy to run audits with Splunk rest commands. ... View more

cool, so when i work with VM's I black list the VM they build the golden image on and then and white list the ones you want to manage via the deployment server. (i only place the deploymnetclient.conf file on the golden image) You also should be running ./splunk clone-prep-clear-config on the golden image, this will remove the server names and other unique things. also setting the app to auto restart when the clients check in and grabs the updated apps will be needed, its just a check mark box in the dep server https://docs.splunk.com/Documentation/Forwarder/7.2.5/Forwarder/Makeauniversalforwarderpartofahostimage One thing to be aware of is... The "check sum" in the .conf files can "out of sync" if you deploy .conf files via SCCM or have them set in the golden image. We found this out the hard way with SCCM, none of our deployment files were applying because they looked the same on the deplyer and i assume the UF would say " yah i am good so no need to update my files... ever again." we fix by adding a comment like #FROM SCCM and then when they check in it over writes the .conf files. hope this helps! ... View more

I would make a summary index, accelerated searches take a lot of indexer resources. https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Usesummaryindexing https://www.splunk.com/view/SP-CAAACZW ... View more

looks like its only for Splunk Versions: 6.5. and its not a supported app, i don't think you are going to find a solid answer. 😞 ... View more

if splunk set deploy-poll <IP_address/hostname>:<management_port> then running splunk restart is not working... I would just edit the deploymentclient.conf file directly. Is this only happening on one host? [deployment-client] phoneHomeIntervalInSecs = 500 [target-broker:deploymentServer] # Change the targetUri targetUri = dep.server.com:8089 ... View more

Are these VMs? ... View more

are you using the windows TA? in the defaults the Splunk_TA_windows are as follows, you might be able to drop this (with a few edits to index and disabled) hope this helps. Splunk 5.0+ Performance Counters CPU [perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 1 instances = * interval = 10 object = Processor useEnglishOnly=true index = perfmon ... View more

i think this answer may help, its should be a quick props.conf and transforms.conf setting, we do this to filter out huge debug logs and other things application owners cant adjust on there side. https://answers.splunk.com/answers/223818/how-to-write-the-regex-in-transformsconf-to-filter.html ... View more

you can do this with eval commands; https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Eval https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usetheevalcommandandfunctions you can do a ton with eval, i would start there. ... View more

127.0.0.1 is just a loop back for the local host, do you have splunk web enabled in web.conf? and whats in server.conf? the command for enabling web; ./splunk disable webserver or ./splunk enable webserver i would also check to ensure the local firewall on the server if off or allow the correct splunk ports that you need. ... View more

have you dove into this doc? https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Parsemultivaluefields ... View more

I downvoted this post because removed data to fix data issue is not a answer. ... View more

i am trying to find out what servers have local input.conf files that are not being pushed out from our deployment server. I would like to use something like the btool app so we can grab the stanzas and wrap them up into a deployment app then, have the server admins remove the local inputs.conf configs. ... View more

config quest would be amazing if it was for universal forwarders. My question above is for the Btool Scripted Inputs for Splunk. ... View more