Review this link https://www.w3schools.com/cssref/css_selectors.asp And also review this link https://www.w3schools.com/cssref/trysel.asp When you configure the input for the website input app the third part on the gui called Define CSS Selector. You want to create you CSS Selector to extract data from the page. For example if you want the header. Click on the selector box and type h1 and then click on preview result. It will show you the result broken down to a field and a value. match and then the value (Cryptocurrency Market Capitalizations) In your case let's say you want Name, Market Cap, Price, Volume(24h) , Circulating Supply, Change(24) Simply Select the Bitcoin Tab and it will be highlighted while holding the shift key Next select the Change value first tab and it will extract all the values you want An alternative is that you can just enter .no-wrap in the selector tab and it will show you the columns it will extract Hit the preview output to see what your results will look like. Once you are done just answer the prompts to the rest of the boxes and that is it you can then use the extracted data to perform searches. Have fun with the crypto market 🙂 ... View more

What i did in my environment for systems where the Splunk forwarder was utilizing high cpu was i went into the server in question and cleared out the old log files or archived them to a different directory that splunk was not monitoring. This took care of high CPU usage for the splunk forwarder. Hopefully this helps you out ... View more

For powershell if you want to do it via the input file. You will need a path file, this is the easiest solution. step 1 create a script and store it in a directory. For this example i will use C:\temp\bin\test.ps1 Step 2 create a path file(file.path). C:\temp\bin\testpath.path Step 3 Store this in your path file . Store this in the path $SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -command " C:\temp\bin\test.ps1'" Step 4 Create the inputs.conf file ... View more

It does not seem to work. It is displaying 3 charts instead of 2 ... View more

I have seen an issue like this before. Review your maximum amount concurrent searches you are able to perform in your enterprise. ... View more

Did you get a chance to review the splunkd logs for any errors or things of that nature. If the interval time is setup on the input file with the exact time you want in seconds. That would be the next place to look at ... View more

If you can't use something like inotify to update you. The next best thing i can think of is to monitor the history command for any time the rm command is called. That is the next best thing i can think of. This way you can setup a search for anytime the remove command is used and this can be a report or an alert based on the condition you would like ... View more

I had an issue when i upgraded dbconnect. My configurations were pretty much wiped out. I had to basically restore my configs, inputs.conf from the back up and restart dbconnect. Functionality worked like a charm after that. ... View more

Depending on your OS. Use either keytool explorer or the key tool command to convert your certs to the format you want and then using this document to implement your new certs. http://docs.splunk.com/Documentation/Splunk/7.0.0/Security/Self-signcertificatesforSplunkWeb ... View more

No splunk does not do this. However you can write a script outside splunk and use that script to validate the file meets the format you want before moving it to a folder splunk is ingesting. This is the work around i used to get around files with weird or unreadable formats to splunk ... View more

Look closely at the apps you use. Some splunk apps require java, so i will suggest starting there. However splunk itself does not require it ... View more

Definitely has to do with a token not either spelled correctly or not properly called. Screenshot and the xml will make it alot easier to point out or you can review those two factors. Mainly at your search and the token. If you look closely you will find it. ... View more

i used custom scripts to populate my sas logs. You can track stuff like disk usuage by users on the SAS work or SAS data spaces. I use it for admin tasks such as cert expiration, start up of sas, shutdown of sas. From an admin point of view that was how far i was able to go with it. With VA available not sure how much deeper i can suggest. ... View more

I make use of notepad ++ to test regex i develop. One other thing i will suggest is having your own personal playground, and deploy logs to that playground under the new sourcetype. You can always just wipe the index of your own playground when you are done with it ... View more

There is actually an app from splunk that monitors nix environments. You can review the inputs.conf file to get the information you want. But since it is your os, i will suggest deploy it and you can see all the information you want from your os and add to it. https://splunkbase.splunk.com/app/833/ Splunk TA NIX ... View more

I had a doh moment with this early on. I figured the props and tranform conf files were not the correct ones being loaded. Try using the btool to make sure your configuration are not being overwritten by locally deployed conf files ... View more

It was not breaking properly because of how powershell formats it output. I converted the output to csv and then ingested it into splunk. It worked like a charm ... View more

This was completed by writing regex statement to break properly and extract them into new words. ... View more

Closest thing i came to this, was utilizing the splunk ta windows and monitoring event log. To checking for these error windows error 4825 or 6273. Had to do with remote denial for access and network policy denial. ... View more

I am trying to do index-time extraction. When i try to use to extract tool it extracts poorly. Description : Security Update HotFixID : KB3212646 InstalledBy : NT AUTHORITY\SYSTEM InstalledOn : 1/20/2017 12:00:00 AM For example I am trying to extract the contents for description and make it a field and i am trying to extract installedby contents and make it another field. I used this regex pattern ^\w+\s+:\s+(?P\w+) but i was able to extract only one word. The tool appears to not be providing me the desired effect. ... View more