1.(host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id 2.[search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1]   3. | eval platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate.   This is you want me do sir or anything else do I need to do  Can you give me  suggestions Thanks in advance     ... View more

Normally Splunk stores indexed data in cold buckets until the retention period expires. When that happens, Splunk moves the data to "Frozen" storage. Frozen storage can be either an archive system or just deletion. It sounds to me like you're asking how to set up Frozen storage to store data after the retention period in Splunk. Depending on the archiving system, there are many ways to do this. Perhaps this helps?  https://community.splunk.com/t5/All-Apps-and-Add-ons/Frozen-archives-into-Amazon-S3/m-p/41024 https://www.splunk.com/en_us/blog/tips-and-tricks/shuttl-for-big-data-archiving.html ... View more

OK so he added the permission, now seen this error on a one-off basis:   2021-04-09 13:56:10,464 ERROR pid=136881 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_user.py", line 76, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/input_module_MS_AAD_user.py", line 36, in collect_events users_response = azutils.get_items_batch(helper, access_token, url) File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/utils.py", line 55, in get_items_batch raise e File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_azure_utils/utils.py", line 49, in get_items_batch r.raise_for_status() File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/aob_py3/requests/models.py", line 940, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/users/ ... View more

This worked very well for me, thanks. One modification though if your HEX value may contain upper and lower case is to add A-F to the regex.   eval ascii=urldecode(ltrim(replace(value,"([a-fA-F0-9]{2})","%\1"),"0x"))   ... View more

The workaround works for the statistics table. However, I have to adjust the other panels' XML...can you explain why we have to have it in a table first? Thanks ... View more

Yep, ignore that, I could only copy from a different machine in this case, so was typing all this out. (Fixed) ... View more

Can you set up the "| ldapsearch " command in your Splunk environment, so that it can perform LDAP queries to your AD? https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.2/User/Theldapsearchcommand https://www.splunk.com/en_us/blog/tips-and-tricks/integrating-active-directory-into-splunk-with-sa-ldapsearch.html Once that is complete, you can search for users with a "accountExpires" time: | ldapsearch domain="default" search="(&(objectclass=user))" attrs="cn,displayName,title,department,whenCreated,mail,lastLogonTimestamp,accountExpires" | table cn mail displayName title department whenCreated lastLogonTimestamp accountExpires ... View more

I assume you are using the Splunk DB Connect app, and it is able to execute SQL queries to your database. Are you able to make a new data input which has id(int) as the rising column, instead of modifying the old one? ... View more

Are you talking about this app? https://splunkbase.splunk.com/app/273/   If you have access to the app config files, you should be able to swap the netstat command with "ss," though I couldn't tell you exactly how without knowing which app you are referring to. ... View more

I would suggest upgrading these servers if possible. But if that's impossible, I would look into setting up Windows Event Forwarding, so that these 2003 and 2008 servers send their logs to a different windows machine running a later version of windows, which then indexes the events into Splunk. You may have to set up the following Stanzas in your cluster master and deployment server apps so that Splunk knows to re-write the host field so that it reflects the 2003 and 2008 servers rather than the collector server: # in inputs.conf in deployment server app [WinEventLog://ForwardedEvents] disabled = 0 sourcetype=XmlWinEventLog:ForwardedEvents host=WinEventLogForwardHost index = forward_event_index # in props.conf in cluster master app [host::WinEventLogForwardHost] TRANSFORMS-change_host_windows = WinEventHostOverride # in transforms.conf in cluster master app [WinEventHostOverride] DEST_KEY = MetaData:Host REGEX=<Computer>([^.<]+).*?<\/Computer> FORMAT = host::$1   ... View more

Yes, Splunk Heavy Forwarder will have a web interface by default, unless it is disabled in /splunk/etc/system/web.conf    https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Webconf ... View more

Thank you for solving my problem 😄 ... View more

Thanks Dave that is working.  ... View more

What is your search query? index=_internal Are you seeing anything when searching "index=_internal"? I'm not see anything ... View more