Hi, thanks for the question. Unfortunately metric indexes are not supported by Meta Woot at this time. This will be something we look into implementing in a future release. ... View more

To you perhaps, but the question only expressed a preference to keep the order, it wasn't mandated. ... View more

This is not possible currently. It might be something we add in the future. Current functionality will display the results within the body of the email. Thanks. ... View more

Meta Woot! leverages the meta data within Splunk and does not provide access to the fields within the data. However, once you have an idea of license volume per event from Meta Woot!, you could leverage the metasearch command to quickly get a count of events that contain the word "rule". For example: | metasearch index=panindex sourcetype=paloaltowhatever "rule" | stats count Obviously, you would want to customise the above to your index and sourcetype. However this will very quickly provide a count of palo alto events containing the word rule. Armed with this figure you can simply multiply that by the license per event amount to give you an idea of how much license volume those events are using! ... View more

There is a dashboard in Meta Woot! named Meta Woot! License Event Usage, that calculates the amount of license used per event. It does this by cross correlating your license data against event volumes for a given sourcetype. This gives a fairly accurate average license amount per event. Now if there are specific events identified by an eventtype and they are pretty much the same format/size as most other events in the sourcetype, then the average license amount per event fits fairly well. If the event is maybe double the size of other events, then you could probably just estimate the size. If you wanted to calculate the amount an event uses in storage (i.e. after compression), you could either just go with an arbitrary 50% compression as a ball park, or if you want accuracy you would need to look at the index sizes, and compare raw size vs disk size to figure out the compression ratio for the index in question, then apply that ratio to your event. A command like dbinspect will allow you to see raw sizes vs size on disk for a given index and/or buckets. ... View more

Good find. Its a shame Splunk couldnt just use [default] like everything else and instead needed to create a specific [WinEventLog] stanza to deal with global elements related to windows event log. ... View more

woot! amazing news ... View more

Yes super annoying. Still not fixed as of 7.2.4. Splunk please fix!! ... View more

Are you using the latest version of Meta Woot ? If not, then please upgrade. You can probably fix the issue by doing something like | inputlookup meta_woot | dedup _key | outputlookup meta_woot Thanks ... View more

This worked - thx ... View more

Agree - super annoying To add to the above solution. The search must also be scheduled for the above to work. ... View more

Did you get an answer on how to suppress these bulletin messages? ... View more

To add - In order to forward URL logs, it is necessary to forward Threat logs of Severity 'informational' to the Syslog server on the PaloAlto server. ... View more

Ok, so with a windows domain SQL account other than the account being used by Splunk, you have to use: MS-SQL Server Using jTDS Driver with Windows Authentication Then you must select to use port 1433, then edit the jdbc string to add in the instance and domain. jdbc:jtds:sqlserver://XXXXXXXXX:1433/master;instance=XXXXX;useCursors=true;domain=XXXXX;useNTLMv2=true Then it works on both Linux and Windows DB Connect environments. ... View more

I have the same issue at a customer - did you get anywhere with this? ... View more

Even though the props settings in the TA do work, I modified it to add a few extra best practice type settings. Not a massive fan of using TRUNCATE=0 as it isn't generally good practice. [cisco:estreamer:data] SHOULD_LINEMERGE = false TIME_PREFIX = event_sec= LINE_BREAKER = ([\n\r]+)rec_type= MAX_TIMESTAMP_LOOKAHEAD = 10 TRUNCATE = 999999 TIME_FORMAT = %s ... View more

Doing this cuts the bundle size down by about 70MB to the indexers. Seeing as the splunk_archiver app is part of every splunk install, not sure why Splunk really needs to bundle this up by default and send it down to all the indexers - especially because in 90+% cases most folks are not using hadoop archiving. ... View more

Having tried to disable monitoring of the metrics and splunkd logs today, it does look as though disabled = 1 doesnt work for these sources on the universal forwarder. There are monitors for these in both the splunk universal forwarder app on the splunk forwarder and in the system default. I put an entries in system local to disable all the them and checked btool after a restart to confirm they are disabled. However internal logs still get forwarded. I didnt try hardcoding into default, cos that is just a pain. I guess another option would be to nullqueue on the indexers. However it is frustrating that this doesnt appear to work in accordance with accepted Splunk rules. ... View more

Can confirm that you don't need to restart after deleting the entry from correlationsearches.conf. The errors go away the next day. ... View more

This can also be done via the REST API: http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTconfigurations#Updating_Configuration_Files Example: You have a stanza entry in correlationsearches.conf called "Access - My Test Search - Rule" List the stanza item first to check you have the right place. You might need to change the app from the below - depending on what app you saved your correlation search in. Additionally you will need to use URL encoded names due to the spaces ES uses in their search naming: curl -k -u admin:changeme https://searchhead.mysplunkenv.com:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/configs/conf-correlationsearches/Access%20-%20My%20Test%20Search%20-%20Rule Assuming you get back results and it matches what you want to delete, now run the following (note the addition of -X and "DELETE"): curl -k -X "DELETE" -u admin:changeme https://searchhead.mysplunkenv.com:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/configs/conf-correlationsearches/Access%20-%20My%20Test%20Search%20-%20Rule As with any time you delete something you are going to want to test this before you start pulling the trigger. For example, I ran a quick test on a local Splunk environment, creating a correlationsearches.conf and then adding in some stanzas, then having a go at deleting them via this command etc. The SH in question may also need a restart due to the conf change but not sure, maybe a debug refresh will suffice or maybe when you do things via REST like this, there is no need to do either. ... View more

You still cant (as of ES 4.1.0) do this from the GUI and it is a pain if you are a Splunk cloud customer as you have no access to the back end configuration files. If you remove the savedsearch, then there will be errors every day due to the correlation search not being mapped to a corresponding saved search. ... View more

This is still an issue as of ES 4.1 and agree it is frustrating in a customer's cloud environment where there is no access to the backend configuration files. Additionally, you cant change the application context from the GUI once it is initially set, nor can you change the notable event security domain after the first save of the search (all greyed out). As a result, unless you remember to set the security domain when first saving, the search is hard coded to the default "Access" domain. If you then delete the correlation search from the Saved Searches gui to try to start again, you get errors every day from Splunk complaining about how savedsearches for X correlation search cant be located etc. Super frustrating. ... View more

If you have multiple fields that you want to chop (i.e. to show a sample across all) you can also use something like this: | stats values(*) as * | foreach * [eval <<FIELD>>=mvindex('<<FIELD>>',0,10)] ... View more