Thanks. I'm specifically looking for what logs, APIs, DB tables or metrics etc...that might be available to monitor the overall health of BackBase and it's applications. ... View more

You can use the Splunk top command. It will automatically give you a percentage as well and i've turned that off in the search below. http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Top index = "SAMPLE INDEX" | top showperc=false "NEW STATE" ... View more

Similar thread here that might help. https://answers.splunk.com/answers/334288/website-monitoring-when-monitoring-a-url-that-has.html ... View more

I would suggest posting a new question with exactly what you want to do. The information above is nothing like the raw events you posted originally. If you post a few raw event examples and details on what you want now, i'm sure we can get you what you need. ... View more

You can use the SEDCMD to replace your raw event with only the highlighted part. You lose source and tag because they wouldn't be part of the _raw message. You could also run script on the data before it comes into Splunk and represent the data however you'd like so it matches the old format. ... View more

I'm not sure what you are trying to accomplish here. If you only want the highlighted yellow part to appear in the raw message that means you'd need to modify raw and delete the rest using the SEDCMD. The fields that appear on the lower left of the Search page create fields that are extracted from _raw. If you remove data from _raw, it's not available to create fields, therefore you wouldn't have fields for source and tag. Is there a security concern here? Is it about abstracting away complexity to the user? Why does your customer want it done this particular way? ... View more

The severity of the event and the priority of the host are combined to generate the urgency of an event. That is what is built into the system. Users desktop less important than server, which is less important than a critical app server etc... You get to assign your priorities based on what is important to your environment. http://docs.splunk.com/Documentation/PCI/3.2.0/User/AssetManagement ... View more

Responded below. thanks ... View more

Wasn't posting in the comments section so responding to your comment here. Sure. Why do you want it out of the raw event if it doesn't affect your searching and viewing of the data the way that you want it? In props.conf you can use the command: SEDCMD http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Anonymizedatausingconfigurationfiles#Anonymize_data_through_a_sed_script The link above shows how to anonymize data using a SED script. Pattern match and replace it etc... In your case, you replace it with nothing. If you do this, you may then have to create regex to pull out the source and tag fields manually though, not sure. Right now the _json format is taking care of that for you. Try it out. Use Regexr.com and you can play with RegEx matching if you need to change anything. Something like this in prop.conf to remove source and then similar for tag- SEDCMD - dumpsrc = \,\"source\"://g ... View more

The Splunk App for Enterprise Security is not supported at this time in a multi-tenant environment. We have many service providers using Splunk Enterprise for multiple customers to handle Security requirements within the same Splunk instance, however if you need use the App for ES, your best option is to provide a separate instance for each customer. ... View more

It is currently only compatible up to Splunk 6.3. You can always check that on the right side of the App page. I'll send a note to the app Owner and see when it will be updated for the current version. https://splunkbase.splunk.com/app/2893/ ... View more

IBM Datapower can be configured to send data using HTTP POST or HTTP GET on a periodic basis. I also believe you can configure it to send syslog, however that will limit the length of events that get sent. These links below show help you get a better understanding. http://blogs.splunk.com/2010/02/10/indexing-data-into-splunk-remotely/ http://informationrishi-it.blogspot.ca/2016/05/configuring-splunk-for-datapower_17.html ... View more

Licensing is based on each account within your environment. Think of your AD accounts such as user accounts, service accounts etc...any that are authenticating in your environment. ... View more

You'll find details on whether you need to restart here...it depends for props and tranforms. Anything search time processing related does not need a restart. http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Configurationfilechangesthatrequirerestart. I do not see your log file entries above. ... View more