Good morning, Working on my first single sign practice, and when following the instructions / KB on splunk, it mentions this 7. Add the path to the ClientCert parameter in authentication configuration: clientCert = $SPLUNK_HOME/etc/auth/samlRequestSigningCerts/samlCert.pem)   However im not sure which pem cert that relates to as it only says that we create the following,   $SPLUNK_HOME/etc/auth/samlRequestSigningCerts/samlRequestSigningCert.pem   Has anyone got any advice or could let me know where I should get the samlcert.pem from, ( Or am I missing something).   Thanks in advance,   Link to KB article   https://docs.splunk.com/Documentation/Splunk/9.0.5/Security/SAMLSHC       ... View more

Is there a way to configure Splunk to open a specific glass table when a user logs in ? Thanks ... View more

Good evening, I was using DB connect and it was forwarding events to my indexers, searches were working and everything was great, However the DBA then cleaned the source DB the events were coming from and now my index is empty, no events and no sourcetype, , Therefore a few questions, Should I create my sourcetype on the SH as well as when its created on the HF (where DB Connect is installed). When the source DB is cleaned and all events removed is it expected behaviour that it would remove events from the Splunk Indexes as well ? Thanks R ... View more

Morning all, Im sure this may have been answered in the past, but is there away to have a table in splunk that you can adjust your columns width directly from the dashboard. Similar to how excel would work. Thanks Ross ... View more

Afternoon all, Is it possible to hightlight cells that match with the same field in 2 different tables in the same dashboard? So for example Table 1 Field value : Football Table 2 Field Value: Football Which would turn both green. ... View more

Okay so here's the problem, 2 sources and I have to rex out a file name and match it to a field within another file if it matches show success it if fails show failed, all sounds achievable in Splunk, but I keep hitting a problem that it will show a success match but won't show a failed match, Heres the code ( I've changed the fields etc but see below): Any help on this would be great Im new to splunk index="sample_log" sourcetype="STAR:OUT:ALL" | rename Trans_Name as REF |lookup REF APPL-FILENAME as Stream_Name |join REF [search index="sample_log" sourcetype="STAR:OUT:ACK" | rex field=source "ACK _(?<REF>\w+)_" ] |rex field=source "_(?<STP_Process_Time>\d{14})." | eval results = if(match('REF', "\w{10}\d{6}\w+"), "Success", "Failed") |table results ... View more

Evening all, Ive been at this for a couple of days, and although I have built the rest of the search I still cant get my compare and return a success or failure to work. I have tried Stats, Join, Coalesce, Case ( which works when I manually enter the second field) so heres the challenge, CSVs lets call them incomingone and ackone123456 and both are from different sourcetypes, The only way to confirm that the incoming has been successful is to extract the 123456 from the ackone file and then compare it to a field for arguements sake called itshere inside the incomingone one file. Now if I do stats values and use a MVexpand command I can get a success or failure however I cant display the rest of the fields and need to have way more information on each line. Now I created my own dummy data and tried it, index="compare_index" sourcetype="outcomeack" OR sourcetype=outbound | rex field=source "outbound(?\d+)." | eval error = if(outcome == 'REF', "OK", "Problem") The rex extracts the REF and creates the field however each time I get 3 "problems) note my dummy data is just 3 csvs as the actual environment data I cant post on here and also I wanted to check it wasnt the data. Also tried a join with a match but still no avail Anyone have any ideas. If I use CASE and EVAL with for example 123456 in the eval CASE("itshere=="123456", "success", failure) then that works, ... View more

Good evening one and all, I have CSV files that have monetary values in them, however when they are ingested into splunk I get the following \xA123,345 Is there away to resolve this pre indexing , Thanks Ross ... View more