You can also replace your license file @ C:\Program Files\Splunk\etc\licenses\enterprise with the new .license file you have just received from Splunk.   Restart Splunkd   ... View more

awesome !! ... View more

or if you want to use \s then it should be "^(\w+\s){3}(?<status>[^\s]+)" ... View more

An interesting document at - https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&ved=0ahUKEwiQtNakzbzLAhWsnIMKHVmVAVUQFgg-MAM&url=http%3A%2F%2Fwww.thecre.com%2Fcm%2Fwp-content%2Fuploads%2F2012%2F05%2FSplunk_Best_Practices1.pdf&usg=AFQjCNGM19hVrlR-AMxHJQqMVkAArF6pKg&bvm=bv.116636494,d.amc&cad=rja It says - Splunk License Management - PRE-4.2 Use a different Splunk license on each indexer. Re-using a Splunk license violates the AUP and breaks distributed search as well as other Splunk-to-Splunk activities. ... View more

Thanks for all the assistance with this. ... View more

If this answered your question, could you mark this as Answered so people searching for it afterwards will know it was yet another wonderfully correct answer by the awesome martin_mueller? ... View more

also if your instance is setup to authenticate with a third party LDAP/ AD / SAML then you cannot change those users passwords from Splunk. ... View more

Generally, try to limit the data you search over as early as possible. In your case, instead of index=test | where Value>=95 you do index=test Value>=95 This will speed up your searches a lot, because splunk has to fetch a lot less events from disk. ... View more

No, i will do span=1mon -ALF ... View more

I've date_hour and date_wday fields. Thanks for your time. ... View more

It's work. Thanks you so much, Vasildavid. ... View more

I will try this out. Thank you so much and I will let you know if I got it to work. ... View more

I try track the Windows Security Event Logs and look for logins/logouts. But not combie Logs logon and logout? Ples help! ... View more

I saw what I did See this: LINE_BREAKER = ([nr]+)((d{4}-d{2}-d{2}) ) More specifically this: ([nr]+) Should be: "([\r\n]+)" once I changed it and updated, it is breaking correctly. ... View more

Maybe try using dedup to return only the latest event with those fields? sourcetype=accesslog user=* | rex field=src_ip "(?<subnet>\d+\.\d+)" | dedup src_ip, user sortby -_time | stats dc(subnet) AS netcount values(src_ip) AS workstations by user | where subnet > 1 | table workstations, user ... View more

Kormot, try this for the SEDCMD in your props: SEDCMD-win_dns = s/\(\d+\)/./g Note the escaped parenthesis and the \ before the d as well. These look to be missing from wbfoxii's props.conf due to formatting. ... View more