Hello Splunkers,   I’m working on developing an app that requires making REST API calls to Splunk in order to gather information about saved searches, knowledge objects, and more. Could you please advise on the most secure method for authorization and authentication? Does the REST API support MFA, or are there other mechanisms available, with or without SAML? Is token generation the only secure way to make these API calls, or are there alternative methods? Thanks  Manish Kumar   ... View more

Hello All , Greetings   I am looking for perfect explanation of memk() function used with convert statement , how it works and where to pass the m,g,k (The letter k indicates kilobytes, m indicates megabytes, and g indicates gigabytes) . when i am trying this function to convert kb to KB , i am not seeing any change in values . Please help  index=_internal source="*metric*" |convert memk(kb) as KB |table kb , KB     Thanks Manish Kumar       ... View more

I am trying to access ACS services (Admin config services) on splunk cloud trial , But not able to do it ,  After acs login , i am getting an error : linuxadmin@linuxxvz:~$ acs login --token-user test_acs_user Enter Username: sc_admin Enter Password: An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=1ccdf228-d137-923d-be35-9eaad590d15c). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips. { "code": "500-internal-server-error", "message": "An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=1ccdf228-d137-923d-be35-9eaad590d15c). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips." } Error: stack login failed: POST request to "https://admin.splunk.com/prd-p-pg6yq/adminconfig/v2/tokens" failed, code: 500 Internal Server Error linuxadmin@linuxvm:~$ acs login --token-user test_acs_user Enter Username: sc_admin Enter Password: An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=5073a1f1-79d0-9ac1-9d9a-675df569846f). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips. { "code": "500-internal-server-error", "message": "An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=5073a1f1-79d0-9ac1-9d9a-675df569846f). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips." } Error: stack login failed: POST request to "https://admin.splunk.com/prd-p-pg6yq/adminconfig/v2/tokens" failed, code: 500 Internal Server Error Can some one please help here . ... View more

Hello team ,   I am having one event in which single field have multiple value like provided below:   {"body":{"records": [{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.0631470Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.252.16:64967 to 54.83.8.19:54443. Action: Deny"}},{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.4217670Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.34.12:62142 to 131.100.0.201:5938. Action: Deny"}},{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.9262290Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.252.196:13973 to 40.79.154.87:443. Action: Allow"}} Above is one single event from which i want to extract src ip and dest ip  for example 10.119.252.16 is src ip and 54.83.8.19 is dest ip , I want to extract all from backend i dont wana use  rex max_match=0 .   Please let me know how can i extract all from backend .   Thanks Kannu ... View more

Hello Guys , I have one json event in which there is subarray so i want to create one field which will have first index value of array for example { "data": {"task":"pullFrom", "from_repo":"https://abc.mxz.com:8089", "to_repo":"https://abc.mxzz.com:8089", "to_repo_change_count":20008, "asset_uri":["kannu","search","ui-prefs","search"] } } in above event i wnat to create the field which will have value only "kannu" from subarray "asset_uri" . I tried doing data.asset_uri[0] as a normal json parsing but splunk is giving error while doing like this Thanks in advance ... View more

Dear splunkers , I want to monitor my universal forwarder agent license expiry date . I am able to monitor it for linux system using scripted input on "openssl x509 -in /opt/splunkforwarder/etc/auth/server.pem -noout -enddate" But how to do the same with windows system , please help Thanks Manish Kumar ... View more

Hello Splunkers , I have one csv file which gets dumped to location being monitored by splunk UF . That csv contains content like this 19752,"TTYHUJIKNN",sdfsdfsdfsdfwer,sdfsdfsdf,,,"04-04-2019 12:11:31 PM","06-14-2019 09:30:18 AM" Time stamp present in above logs will get changed when every time CSV get appended by new entry of logs , But i dont want splunk to indexed the event based on timestamp present in logs , i want data to get indexed with the time of creation of file like provided below it should be Jul 9 01:28 -rwxr-xr-x 1 ccc ccc 13308953 Jul 9 01:28 Device_Report07-09-2019.csv -rwxr-xr-x 1 ccc ccc 13311527 Jul 10 01:27 Device_Report07-10-2019.csv For achieving this i have used props.conf at UF end . TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 1 But its not working as expected , Please help ... View more

Hello All , I have vmware environment setup and i make 10 vm's using vsphere client So I need help in monitoring applications installed on those vm's , like any db application installed on VM , Note : i cant install splunk UF on VM , but can install UF on vsphere , SO is there any way in which from Vsphere itself i can monitoring applications installed on VM . What to monitor : application running or not . Thanks in advance Manish Kumar ... View more