See if this link helps . ... View more

This looks really nice! How would I populate "ip_list" with output from my own "base search"? Or do some direct pipe to eval? ... View more

This one has bitten me previously as well, and I'm guessing you are using the CLI. In order to check for restart, you have to explicitly tell Splunk to do so, which is frustrating. splunk validate cluster-bundle --check-restart ... View more

This might help answer the spirit of what you are trying to do. http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/ The gist of it is. Add a field to incident review settings. Have that field be returned by a lookup based on a field in your notable. Shim the lookup into incident review. Have your adaptive response code go get data and either index it and maintain the lookup off that or update the lookup directly rather than indexing if its a kvstore lookup. ... View more

Changing the span didn't work unfortunately. However DalJeanis seems to have figured it out. Now to process how that worked... Thanks for the help, though! ... View more

@j4adam. That is correct, there are often two Account_Name fields, due to the structure of windows events. https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 You might find you need to adjust that standard deviation test. 30 seconds stdev is nothing if I try and fail to log on real fast three times in a row... but most installations, 3 is the most that can happen that way, so it wouldn't be quite the kind of thing you are looking for anyway. ... View more

Splunk recommend not installing greedy apps, I mean apps with a lot of saved searches, data models acceleration, and eventtypes. check the skkiped searches and average load time, if your environment is stable engought, I don't see a reason why not. ... View more

If you don't want to rely on the Alexa file being available, Cisco Umbrella made a version in the same file format in response. You can find it at http://s3-us-west-1.amazonaws.com/umbrella-static/index.html Just disable the existing Alexa download entry in ES. Then do the following steps. Clone it Make the name like cisco_top_one_million_sites Leave the type as alexa Edit the description appropriately Paste the url as this link which is on the site linked above: http://s3-us-west-1.amazonaws.com/umbrella-static/top-1m.csv.zip Then save it and you have replaced it. ... View more

Well there are 2 things - 1 - If you enabled ALL data forwarding from HF to Indexers, you don't have to worry about having the indexes.conf on HF. On the other hand if the forwarding is not enabled, you would end up indexing data in HF (which you probably don't want) 2 - If the App has a UI for defining the inputs, and if you are planning to use it, you may need the indexes.conf. Hope that helps. ... View more

Ah, there were settings hidden by my resolution. Thanks! ... View more

I've had issues where a developer accidentally wrote an infinite loop in a debugging log and wrote 10GB in 3 hours of log data, this then happened multiple times in 1 day resulting in various issues. Since the index size was limited it only caused damage to the non-prod index related to this group of users. If this was not set the volume limit (which was also in use) would have kicked in but recent data would have been lost as the oldest data would get deleted first ! Therefore I would recommend using the maximum size of an index to prevent the flood of data scenario I am describing... ... View more

@j4adam please mark this question as accepted to close it out. ... View more

Try this run anywhere sample. You should be able to copy this, paste it in to your search window and see the results index=_internal | table [| makeresults | eval search="_time sourcetype"." source" | table search] ... View more

And there it is. It's for filtering. Sigh. Thanks! ... View more

I think the big issue is you can call sourcetypes anything you want. Even if you abstract that a level up though I don't think there is a list of which technologies map, or can map, to specific CIM data model simply because the number of technologies is essentially infinite not to mention fluid. The way I tried to address that in my deployment is look at the fields for each of the DMs and then see how closely each of my sourcetypes (I have ~600+ in my environment) map to any particular one DM. This allowed me to make some changes for CIM compliant fields based on knowledge of the sourcetype and volume of that particular data source. I've also kicked the tires on creating a data taxonomy for my sourcetypes. This is similar to and has overlap with the CIM but is useful in its own right and to some different ends. I didn't capture using the taxonomy in my Splunk answers writeup or blog post but it helped in the overall effort. At any rate my experience with the field mapping is captured in this Splunk answers post which you might have already run across. ... View more

Hi, this was just posted last week: https://splunkbase.splunk.com/app/3259 ... View more

@maniishpawar if this answered your question, please mark it as an answer. ... View more

I just disabled and afterwards enabled the static captain again. Now the field mgmt_uri is no longer "?" but resolvinf to the IP and Port. Applying the shcluster-bundle has worked now. ... View more

You can't do it with the search and replication factors. The best solution is "don't forward any data to site2 indexers." Make sure your forwarders are only sending data to site1 indexers. If you aren't forwarding any data to site2, it will not be the origin for any data - and so it won't have anything to replicate, regardless of the settings. ... View more

As I understand it, Splunk invokes the "move" or "copy/delete" capability of the underlying OS. There is no command to move warm to cold, but there are mulitple ways to control when buckets move: - by setting the number of buckets in warm (maxWarmDBCount) - by controlling the size of the db (hot/warm) directory (homePath.maxDataSizeMB) You can find out more by looking at indexes.conf.spec on your local Splunk machine, or by looking at the same file on docs.splunk.com Here is another documentation topic that can be helpful: Configure index storage ... View more

Hi, Access Credentials are valid and not been revoked. we are running this on indexer and I also check the log files SPLUNKHOME/var/log/splunk for AWS But we couldn't find anything substantial. Last week I am facing the same issue But suddenly data is coming and from yesterday again Data is not Coming. We couldn't identify the problem Why the data is not Coming If everything is configured correctly. Can you please let me know How we can proceed and or what are the steps we need to follow. Thanks, Sahil ... View more

Yeah, I immediately looked into that as soon as you mentioned it. That post exactly, actually. Thanks! ... View more