While years late, hopefully this helps someone out in the future. This works: blacklist1 = EventCode="4624" Message="Logon Type:\s+3" blacklist2 = EventCode="4634" Message="Logon Type:\s+3"   ... View more

What is <TestField> here? ... View more

They are trying to combine one csv/lookup with the values of a second lookup.  If you were going to go the lookup route you would do the generating search, then run the lookup against the 'correct' priority data, to return the correct priority as something like 'new_priority', and then coalesce on that. ... View more

Bumping. Has anyone run into this before and successfully gotten the data to Splunk?  ... View more

Thank you very much 🙂 ... View more

You're right.  I left out an argument to the return command.  See the revised answer. ... View more

tnx you both for reply this is defiantly enlightening for me at this point have you been heard about 'wazuh'? it mention itself as "Comprehensive SIEM "! ... View more

You can use syslog to send data from the AS400 to a Syslog server. https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-from-IBM-AS400-to-Splunk-via-syslog/td-p/177454   There was an older app that has since been archived that provided field extractions. You may be able to tune it to work with your current Splunk version (or you might get lucky and it works right away). Worth a shot: https://splunkbase.splunk.com/app/633/#/overview ... View more

Hi @Jarohnimo, I don't know why is espressly required to not perform a direct upgrade of an UF from versions before 7 to 8, but this is clearly expressed at https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST#Key_points_for_upgrading_to_version_8.0 probably it equally runs, you could perform a test. Why don't you open a case to Splunk Support? Even if I'm sure that they will answer that this is and stop! Ciao. Giuseppe ... View more

The limits.conf are different on indexers and SH  we don't have /opt/splunk/etc/system/local/limits.conf    the updated file will be copied with cron to the deployment server    thanks a lot , will test it during the week  ... View more

For version you can go to the monitoring console (assuming that you have a centralized monitoring console) > Forwarders > Forwarders: Deployment and you'll see the versions of Splunk installed on your UFs and HFs.  Getting the date installed isn't as easy. But one way you could do that is to get the date of the first event from the host. This assume the install date was also the first date you got in data from that host.  index=main | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime That search will take awhile, but you'll get your answer. ... View more

I do this with sparkline. It's not based on time but on log count in the _internal index. No logs being sent by host in _internal generally means something is wrong. This isn't the 15m solution you were looking for but wanted to share in case you wanted to implement something similar. You could use bin to create 15m buckets of _time. index=_internal sourcetype=splunkd destPort!="-" | stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port", host as "Indexer", sourceHost as "Forwarder IP", version as "Splunk Forwarder Version", hostname as "Forwarder Host Name", sparkline as "Traffic Frequency" | dedup "Forwarder Host Name" | sort - count | where count < 20  You can play around with the count as well. I try to look for forwarders that aren't just completely dead but aren't communicating as much as normal as well. ... View more

Was just going to tackle a project to do this, thanks for linking! ... View more

Thanks @96nick ! that did the trick. ... View more

Victory: you are a STAR   ... View more

Have you checked out Splunkd.log on the new server? I'd grep for ERROR and see if it's telling you anything useful.  Are the Splunk versions the same old=>new? Things can get funky if you're going from 7.x to 8.x+ with the changes that Splunk put out (namely Python). If so try removing your apps (just move them to your home dir for now) and seeing if Splunk restarts.  Another thing to check is if something is up with your conf files you copied over in /etc/system/local. You may need to enter in the passwords in plaintext so they can be hashed again by Splunk itself.  ... View more

Thanks @96nick    Actaully we are using outputs.conf in other folder also (E:\APPS\SplunkUniversalForwarder\etc\system\local) apart from E:\APPS\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local due to that it is processing data to old indexer server ... View more

Did my follow up question make sense? ... View more

Rich, Troubleshooting question regarding this topic. I removed indexes.conf from the CM and placed it in ..etc/system/local of my old indexers and pushed a bundle out. I also placed the new indexes.conf on both of my new indexers. Upon adding a new indexer to the existing cluster I received the following error in splunkd.log on the new indexer: App='system' with replicated index='_introspection' is neither in the bundle downloaded from master nor managed by local deployment client. Either define this index at the master or  specify repFactor=0 on peer to skip replication. This error repeated for all indexes that we have. Since the CM doesn't have the indexes.conf and it's all local, does that change how I should approach this? Or would you have an idea on how to attach this?   Thanks! ... View more

Is some_index a new index that was recently set up? If so, did the errors start happening after some_index was introduced? That IndexConfig warning means that Splunk looked over your indexes.conf and found that some_index has some issues. This warning won't stop Splunk was starting, but your data in that index will become sad overtime. Looking at the output your maxDataSize is 750MB (meaning the max size your hot bucket(s) will reach before triggering a roll to warm), while your homePath.maxDataSizeMB is 256MB (which is the max size of hot+warm). Your cold storage is also set to 0MB, which will make Splunk sad. Your IndexerService error message may be related to some_index as per this answers post. I'd try and fix some_index's config and restarting to see if that error goes away.   Hope this helped!   ... View more

When your index hits 500000 MB (500G), data will be rolled over to frozen. If you don't have a frozen path/script in place when that occurs the data will be deleted. That 500G size limit comes from the default indexes.conf. The setting used to override that is maxTotalDataSizeMB.  You'll have to set that value to a value you're comfortable with in order to take advantage of the 750G settings you set for that index. The 500GB setting is applied regardless of the extra space you gave hot/warm. The max size of Hot/Warm/Cold is simply what it says. It is the maximum amount of space (in MBs) that can be taken up by each phase of the data lifecycle. These are broken up by homepath.maxDataSizeMB (hot/warm) and coldpath.maxDataSizeMB (cold). When those values are hit, the buckets are sent to the next phase in the data lifecycle. Side note, there is no way to separate out max values of hot and warm. maxDataSize works with hot buckets only as the setting is the size a hot bucket can reach before the bucket rolls to warm. Typically for high volume indexes, you would set auto_high_volume so that data rolls. If you set a inactive/slow index with auto_high_volume you risk the data staying in hot. This is bad since data retention policy is applied at cold, so your data will sit in hot buckets and be sad. More on that on this answer.   Hope that helped!  ... View more

Hello Chris, Thanks for sharing link. Seem after conf20 the content has been moved away. Would request you to share the new link or deck if it still exists on website.  ... View more