2 Question on Admin Side : Question 1 : How many hosts are on each version of the Splunk Universal Forwarder ? index="_internal" source="*metrics.log*" group=tcpin_connections |dedup hostname |stats count(hostname) as TotalCount by hostname , version,os  |table hostname ,version,os TotalCount this query returning results but as confirmation need to be confirm it correct or not ?? Question 2 :  Which Splunk version each of our Splunk servers are on ? Tried rest query but it not working as need is i need to list down all the splunk instance means (SHC,IC,Deployer, Deployment server n all) they dont want to open Monitor console , they want to be have Custom dashboard for it     ... View more

Hello Team, Could you please help me upload this data in Splunk as I am passing into upload as JSON its unable to parse it. 2020-03-09T14:30:39+00:00 172.20.0.20 2020-03-09T14:28:13Z cos-darktrace.polarisalpha.com darktrace - - - {"pbid":313384,"pid":702,"time":1583764093000,"timestamp":"2020-03-09 14:28:13","creationTime":1583764287000,"creationTimestamp":"2020-03-09 14:31:27","name":"SaaS::Multiple SaaS Resource Deletions","components":[8352],"didRestrictions":[],"didExclusions":[],"throttle":3600,"sharedEndpoints":false,"interval":0,"sequenced":false,"active":true,"retired":false,"state":"New","commentCount":0,"triggeredComponents":[{"time":1583764092000,"timestamp":"2020-03-09 14:28:12","cbid":563836,"cid":8352,"chid":12738,"size":6,"threshold":5,"interval":1800,"logic":{"data":{"left":{"left":"A","operator":"AND","right":{"left":"C","operator":"AND","right":"D"}},"operator":"OR","right":{"left":"B","operator":"AND","right":{"left":"C","operator":"AND","right":"D"}}},"version":"v0.1"},"metric":{"mlid":306,"name":"saasrurcedeleted","label":"SaaS Resource Deleted"},"device":{"did":15727,"sid":-9,"hostname":"SaaS::Office365: cook@polar.com","firstSeen":1538579956000,"lastSeen":1583764287000,"typename":"saasprovider","typelabel":"SaaS Provider"},"triggeredFilters":[{"cfid":68892,"id":"A","filterType":"Unusual SaaS usage","comparatorType":">","arguments":{"value":40},"triggeringValue":"41"},{"cfid":68894,"id":"C","filterType":"Direction","comparatorType":"is","arguments":{"value":"in"},"triggeringValue":"in"},{"cfid":68895,"id":"D","filterType":"Message","comparatorType":"does not contain","arguments":{"value":"event=DeleteEvent"},"triggeringValue":"event=MoveToDeletedItems,user=cook@polar.com"},{"cfid":68896,"id":"d1","filterType":"Source IP","comparatorType":"display","arguments":{},"triggeringValue":"65.205.175.4"},{"cfid":68897,"id":"d2","filterType":"Message","comparatorType":"display","arguments":{},"triggeringValue":"event=MoveToDeletedItems,user=michael.cook@polarisalpha.com"},{"cfid":68898,"id":"d3","filterType":"Unusual SaaS usage","comparatorType":"display","arguments":{},"triggeringValue":"41"},{"cfid":68899,"id":"d4","filterType":"Event details","comparatorType":"display","arguments":{},"triggeringValue":""}]}]} ... View more

Hello Team, I am in New Splunk, I am have Search head where I am applying Some filter like index=xyz sourcetype=xyz User=*NYZ* So this User=NYZ filter , i want splunk do it for myself while getting indexed,so basically i want filter index data rather then complete data of users i am filter data to be shown for index XYZ in backend expected output without Filter should be seeen all NYZ Users ... View more