Try something like    LINE_BREAKER = {"id" ... View more

I am glad shared details, helped with the completion of your task. ... View more

To add and edit roles/capabilities I assume authorize.conf would be the correct file. Please refer this Splunk doc https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Addandeditroleswithauthorizeconf As per document After you make changes to authentication.conf, you must refresh the authentication scheme to have the changes take effect. You can do this with either Splunk Web or the CLI. Refreshing the authentication scheme does not log users off of the system. Refresh the authentication scheme using Splunk Web From the system bar, click Settings > Authentication Methods. Use the CLI command ./splunk reload auth: ./splunk reload auth ... View more

As per details from Tanium website, you can do the integration with Syslog and send data to 514 port of Splunk. I assume you already started and invested time with Tanium-Splunk integration, would suggest checking below-mentioned URL (which may be helpful with your integration) https://docs.tanium.com/connect/connect/siem.html ... View more

Yes, it's possible to use 2 tokens from 2 different searches into 1 search. Try using the below-mentioned sample dashboard and change variable as per requirement <form theme="dark"> <label>Host Login Details</label> <fieldset submitButton="false"> <input type="time" token="timeFrame"> <label>Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="field1" searchWhenChanged="true"> <label>field1</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>field1</fieldForLabel> <fieldForValue>field1</fieldForValue> <search> <query><your search1>| dedup field1 | table field1</query> </search> </input> <input type="dropdown" token="field2" searchWhenChanged="true"> <label>field2</label> <choice value="*">all</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>field2</fieldForLabel> <fieldForValue>field2</fieldForValue> <search> <query><your search2>| dedup field2 | table field2</query> </search> </input> </fieldset> <row> <panel> <table> <search> <query><your search> field1=$field1$ field2=$field2$ | table _time field1 field2</query> <earliest>$timeFrame.earliest$</earliest> <latest>$timeFrame.latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more

Edit permission to the app, dashboard, search, etc is based on user roles and a role can have more than 1 user. Would be difficult to enable such condition where user can only edit its own dashboard. ... View more

check your indexes.conf & server.conf for data roll Check this formula LocalDiskSpace = minFreeSpace + (maxHotBuckets * maxDataSize) + (maxWarmDBCount * maxDataSize) Refer below-mentioned link for more details https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Configureindexstorage https://www.splunk.com/en_us/blog/tips-and-tricks/managing-index-sizes-in-splunk.html ... View more

Not sure if I understood correctly if you want to join both files to 1, please try this | lookup msg100_debug_codes.csv | rename Code100 as DebugCode | append [| lookup msg200_debug_codes.csv | rename Code200 as DebugCode] ... View more

Hello @splunkwar , its internet lookup script. No changes required 🙂 ... View more

Please try this for shared sample log | makeresults | eval json = "{ \"JOB_NUM\" : \"1\", \"JOB_TIME\" : \"1/1/2020\", \"JOB_STATUS\" : \"FAIL\", \"JOB_DURATION\" : \"304\" }" | rex "(?<json>\{.+)" | spath input=json | fields - json For production, try <your base search> | rex "(?<json>\{.+)" | spath input=json | fields - json ... View more

If you are referring to "Splunk App for Unix and Linux" "https://splunkbase.splunk.com/app/273/" Would suggest going to your Splunk instance app directory /opt/splunk/etc/app and remove the directory "splunk_app_for_nix" rm -rf splunk_app_for_nix and restart Splunk services ... View more

I assume the directories that were changes may be owned by root permissions. I would suggest you make the following changes As root user run the following command: chown -R splunk:splunk /opt/splunk/ ... View more

If you can add a sample log, would be easy for all to provide SPL. ... View more

Try using this <your base search> | rex "(?<json>\{.+)" | spath input=json | fields - json | rename child_info{}.id AS child_id child_info{}.status AS child_status | mvexpand child_status | stats count(eval(child_status=="PASS")) as Child_Passed_count count(eval(child_status=="FAIL")) as Child_Failed_count by parent_id ... View more

Try this (?<TLD>\.\w+?)(?:$|\/) ... View more

I would recommend using "Windows Event Logs Analysis" app, this gives a good view of windows infrastructure https://splunkbase.splunk.com/app/3067/ ... View more

try something like your search | rex field=_raw "(?<Remotehost>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex field=Remotehost mode=sed "s/\W+//g" ... View more

If looking for Splunk disk space issue, you can use your monitoring console for space details Splunk >> Setting >> Monitoring Console >> Indexing >> Volume Detail Instance or try below mentioned SPL | rest /services/server/status/partitions-space | eval usage = capacity - free | eval pct_usage = round(usage / capacity * 100, 2) | stats first(fs_type) as fs_type first(usage) as usage first(capacity) as capacity first(pct_usage) as pct_usage by splunk_server, mount_point If you want to monitor Space issue in non-Splunk instances, try onboarding perfmon logs, onboarding details are on below mentioned Splunk answer https://answers.splunk.com/answers/454999/how-to-develop-a-search-to-find-free-disk-space-us.html index=perfmon sourcetype="Perfmon:Free Disk Space" counter="Free Megabytes" (instance!="HarddiskVolume*") (instance!=_Total) |dedup host | eval FreeSpace=(Value/1024) | eval GB=tostring(FreeSpace,"commas") | table host instance GB | sort + host instance | rename instance as "Drive Letter" GB as "GigaBytes Free" ... View more

maybe you can try | tstats count where index=<your_index_name> by source | where the count > 1 ... View more

try this index=_internal sourcetype=splunkd_ui_access method=post uri="*/saved/searches/*" | rex field=uri "\/saved\/searches\/(?P<title>.*?)(?:\/|$|\?)"| eval title=urldecode(title) |convert ctime(_time) as timestamp|stats count by title,user,timestamp,bytes|sort -timestamp | join title[| rest splunk_server=local /servicesNS/-/-/configs/conf-savedsearches|stats count by title,search,updated,cron_schedule,"eai:acl.perms.write",disabled] Schedule this search and save it to a different index and compare it for changes with the latest result. ... View more

Check if you have required app installed on Splunk Cloud search-head, looks you are referring to VirusTotal Malware Lookup for Splunk: https://splunkbase.splunk.com/app/4283 If not, raise a request for Splunk support for app installation. ... View more