Hello Friends, I am consistently receiving alerts that the README file found in the path /opt/splunk/etc/system/lookups/ within my SHC is missing. When hit that directory I can confirm that it is gone, and while I believe it to be a default file, when I take a copy of it from another instance that has no issue, the file is removed after 5 or so minutes. I have confirmed that file owner and group are splunk and while the file is present, I can cat it without issue. Would anyone have seen this themselves or have any ideas on how to remediate it? Thank you. ... View more

Hello friends, Splunk is cranky with errors stating: Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event. This is related to my Cisco estreamer ingest and there are no timestamps in any of the events. Is there a way to tell the Indexer that there are no timestamps, that it should not use the lookahead, and configure the index time as the event time for the specific index and sourcetype? Thank you. ... View more

Hello folks, I'm fighting some events in the future and am having some trouble breaking the code for parsing an event. I have the following event (with a little redaction) and have tried some flavors of the the stanza below primarily messing with the TIME_PREFIX to no avail. For every change I make (and a Splunk restart after the fact), Splunk just wants the event in UTC and it is not considering my timezone offset. Does anyone have any suggestions or thoughts at to why I cannot get Splunk to recognize that time properly? Thank you.   {"id": 141865, "summary": "User's password changed", "remoteAddress": "X.X.X.X", "created": "2025-06-12T14:13:19.323+0000", "category": "user management", "eventSource": "", "objectItem": {"id": "lots_of_jibberish", "name": "lots_of_jibberish", "typeName": "USER", "parentId": "10000", "parentName": "com.AAA.BBB.CCC.DDD"}, "associatedItems": [{"id": "lots_of_jibberish", "name": "lots_of_jibberish", "typeName": "USER", "parentId": "10000", "parentName": "com.AAA.BBB.CCC.DDD"}]} [my_stanza] TIME_PREFIX = "created": " TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ TZ = UTC ... View more

Hello folks, My organization is struggling with ingesting the Cisco Firepower audit (sys)logs into Splunk, we've been able to successfully ingest all the other sources. With the Firepowers only offering up 514udp which is unavailable according to Splunk, or a HEC configuration without tokens so Splunk is (would?) drop the events our option appear limited. Has anyone else come across this issue and solved it?    ... View more

  Hello folks, I have a series of event results which take the format as shown below: appDisplayName: foo appId: foo0 appliedConditionalAccessPolicies: [ [-] { [-] displayName: All Users Require MFA All Apps enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo1 result: success } { [-] displayName: macOS Conditional Access Policy enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo2 result: success } { [-] displayName: Global-Restrict enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo3 result: notApplied } { [-] displayName: All_user_risk_policy enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo4 result: notApplied Is there a way to cycle through the specific event to extract and maintain the correlation of field:value and then repeat for one or more event blocks? Effectively it would look like this: displayName: All Users Require MFA All Apps - id: foo1 - result: success displayName: macOS Conditional Access Policy - id: foo2 - result: success displayName: Global-Restrict - id: foo3 - result: notApplied displayName: All_user_risk_policy - id: foo4 - result: notApplied Thank you to all. ... View more

Hello folks, I trying to use a base search within a dashboard but it consistently returns no results. However, when I click Open in Search the results appear as expected. Any of you fine people have any suggestions? <dashboard version="1.1" theme="dark"> <search id="recycle"> <query> index=o365_sharepoint AND (Operation=FileRecycled OR Operation=FolderRecycled OR Operation=FileVersionsAllDeleted) </query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <label>Test Dashboard</label> <row> <panel> <title>Abnormal File Deletion and Recycle Patterns</title> <table> <search base="recycle"> <query> | stats count as "Object Deletions" BY UserId | search "Object Deletions" &gt; 50 | sort - "Object Deletions" </query> </search> <option name="drilldown">cell</option> </table> </panel> </row> </dashboard>   ... View more