Hi @gcusello  did you get answer from @woodcock regarding applying on all etc/system/local/authorize.conf search head nodes (preferably from GUI if possible) ? Thanks.   ... View more

This part is very important "any that did not match in the last lookup would null out previous matches." ... View more

Thank you!! @AnilPujar I made it! ... View more

Hi I think that the easiest way to get this is an activate MC's Alert: "DMC Alert - Abnormal State of Indexer Processor". Then it informs you e.g. with email that there is issue with indexer. r. Ismo ... View more

Hello,   What was the process you followed to fetch logs from Dell Switches? ... View more

Thanks @to4kawa  this props.conf is working fine for my logs.... 😄 ... View more

Same here. We too have a requirement where we need to color the table cell value based on some criteria. This needs to be sent as an email. Can you help regarding this. ... View more

yes, this is for one particular user. just need this user to edit his own app .. what are the capabilities to choose so he can edit the app. ... View more

Hi, I noticed later on that mvexpand command shows "dublicate" events on search results on the table when searching using wildcards (*). Is is possible to prevent that or can we make query without mvexpand? ... View more

This could be from your index max size ? Not sure though, very new to splunk but that would make sense. ... View more

Hi @woodcock , i'm sorry, there was some issue with the data. Thanks a lot for the response!! ... View more

Directories have to be executable in order to do anything inside them It's the nature of *nix permissioning ... View more

That would have saved me 90% of my effort. ... View more

I would recommend using "Windows Event Logs Analysis" app, this gives a good view of windows infrastructure https://splunkbase.splunk.com/app/3067/ ... View more

Hello @splunkwar , its internet lookup script. No changes required 🙂 ... View more

02/26/2020 09:02 AM . 02/26/2020 09:02 AM .. 02/17/2020 02:43 PM Archive 02/17/2020 06:47 PM 71 queuelog.bat 1 File(s) 71 bytes 3 Dir(s) 413,241,344 bytes free Here is the log... you can see that "1 File(s)"... so i have to parse the log content and look for the file count.. if files count is grater than 1 then i wanted to generate the alerts. ... View more

Trellis is the only native way to do this: 1 panel but multiple related visualizations in that 1 panel. ... View more

Like this: (search query 1) OR (search query 2) | eval joiner=coalesce(source1.field1, source2.field2) | stats count BY joiner | eval {joiner} = count | table joiner count *_active_user | eventstats first(*_active_user) AS *_active_user | foreach *_active_user [ eval active_user_count = if(joiner=="<<MATCHSTR>>", '<<FIELD>>', active_user_count) | fields - <<FIELD>> ] | where isnotnull(active_user_count) ... View more

earliest=-17h latest=-8h is not good because if I am doing this i have just the vents for one day instead 7 days like i need.... ... View more

You only need one of either dc(Account_Name) or by Account_Name to get that stats right, but you'll want the by Account_Name because it'll do what you need better. They you'll just have a where (or in this case, search would be fine*) after it. index=wineventlog source="WinEventLog:Security" EventCode=4624 (src_ip=10.13.111.60 OR src_ip=10.14.111.60) | stats dc(src_ip) AS distinct_sources BY Account_Name | where distinct_sources > 1 That should do it. Or change it to a search - index=wineventlog source="WinEventLog:Security" EventCode=4624 (src_ip=10.13.111.60 OR src_ip=10.14.111.60) | stats dc(src_ip) AS distinct_sources BY Account_Name | search distinct_sources > 1 The main difference between search and where is that where lets you compare two fields, like where distinct_sources > myOtherfield , and search only searches one field against a string/constant/whatever. In this case, you are just searching for greater than some number, so... Which brings up the time you'd need where - if you were to set a threshold (which isn't really that useful in this simple case, but can be useful in more complex ones), you could do something like index=wineventlog source="WinEventLog:Security" EventCode=4624 (src_ip=10.13.111.60 OR src_ip=10.14.111.60) | stats dc(src_ip) AS distinct_sources BY Account_Name | eval threshold_of_badness = 2 | where distinct_sources >= threshold_of_badness ... View more

I would like to know if iplocation.py file has been deprecated with the newer version since I was looking at this link https://answers.splunk.com/answers/37249/specifying-field-w-iplocation.html and thought it would be helpful to look at the code and make some changes as per requirement. However, I am not able to find the file. ... View more

Yes, it's possible with changes in indexes.conf Default system file location is $SPLUNK_HOME/etc/system/local/ Customised/add-on file location is $SPLUNK_HOME/etc/apps/< app_folder_name > Increase "frozenTimePeriodInSecs" attribute for the indexes.conf For example for _internal logs, you can increase retention from 30 days to 90 days by changing frozenTimePeriodInSecs from 259200 to 77,76,000 [_internal] frozenTimePeriodInSecs = ‭77,76,000‬ ... View more

If you are referring to "Splunk App for Unix and Linux" "https://splunkbase.splunk.com/app/273/" Would suggest going to your Splunk instance app directory /opt/splunk/etc/app and remove the directory "splunk_app_for_nix" rm -rf splunk_app_for_nix and restart Splunk services ... View more

Check your system resource usage while configuring inputs, app/add-on required suggested resources to work properly. ... View more

Got it. Thank you @gcusello ! ... View more