@hsynli wrote: Has there been an update and/or resolution to this issue? Or do we know the root of the issue? I have a similar, most probably the same issue. It seems to me Splunk forwarder stops sending logs when the defender platform or engine is updated (event codes 2002 and 2014, but not limited to). Logs start being sent to Splunk as soon as the splunkforwarder is restarted. That matches the issue. Fixed in 8.2.7 and above, and also in 9.0.0 and abovehttps://docs.splunk.com/Documentation/Splunk/8.2.7/ReleaseNotes/Fixedissues#Universal_forwarder_issues   ... View more

I only just seen this post, but this issue has been reported and is being investigated (ticket with Splunk Engineering SPL-212687) As far as I understand this is specific to Defender (and potentially some specific versions) and at least known to be  triggered by a cleanup task that defender has in the Task Scheduler: Task Scheduler -> Task Scheduler Library -> Microsoft -> Windows -> Windows Defender -> Windows Defender Cache Maintenance ... View more

Just check, it was your case actually ... View more

For anyone finding this, as this came up on Slack: [default] doesn't apply to modular inputs, most notably wineventlog. You'll need to add it to the top level stanza for that input type: [WinEventLog] _meta = hf_proxy::meta_test https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Specify_global_settings_for_Windows_Event_Log_inputs ... View more

Can't repro this with my data and 8.0.1 standalone, but can I suggest stats instead of dedup, with something like this: index=_internal earliest=-24h latest=now | stats count BY component source | eval log=component." ".source | sort 0 log | table log ... View more

Don't think this is accurate, have a look at my answer below ... View more

That's not a bug I think, it's just "b=c" is not a term in the lexicon fake results: | makeresults | eval _raw="foo a_b=c b=d bar" | collect can find it: index=summary NOT TERM(b=c) can't find it: index=summary NOT TERM(*b=c) validate: | walklex index=summary | table * | search term="*b=c*" tested on 8.0.1 ("_" is a minor segmenter) https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Segmentersconf https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/UseCASEandTERMtomatchphrases TERM: Match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor segmenters, such as periods or underscores. ... The TERM directive is useful when you are searching for a term: That contains minor breakers Is bound by major breakers, such as spaces or commas Does not contain major breakers and your term isn't bound by major breakers, but a major (the space) and a minor one (the "_") ... View more

The subsearch one was reported as SPL-176990 is fixed in 7.3.3 for where tstats where, reported as SPL-179746, fix planned for 7.3.4 at the moment ... View more

"index=myindex src_ip!=10.0.0.0/8" is also the search command, any search string without a command at the beginning is actually "| search ... " 🙂 ... View more

Just to be clear, it's the combination of: Splunk 8.0.0 search negation (!=, NOT) in combination with CIDR based filtering (10.0.0.0/8) where command with cidrmatch isn't affected negation of non-CIDR values isn't affected ... View more

Response filter just filters out responses that don't match the regex, and you regex is fine for that. Deduping at indextime against data already indexed isn't really possible, unless you can use some sort of checkpointing mechanism (a-la DBX rising column for example). You might be able to use the token function of this addon for some sort of checkpointing. ... View more

Probably add LOOKAHEAD = <something bigger than 4096> https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf LOOKAHEAD = <integer> * NOTE: This option is valid for all index time transforms, such as index-time field creation, or DEST_KEY modifications. * Optional. Specifies how many characters to search into an event. * Default: 4096 * You may want to increase this value if you have event line lengths that exceed 4096 characters (before linebreaking). ... View more

Build a subsearch to build the EVALs for you? | makeresults | eval _raw="aaa :4:" | eval [| inputlookup test_regex.csv | fields pattern output_value | eval search="test=if(match(_raw,\"".pattern."\"),\"".output_value."\", test), " | fields search | mvcombine search | eval search=trim(trim(mvjoin(search," "),"| eval"),", ")] ... View more

Also, consider making this an accelerated/scheduled report if running takes relatively long, it gets looked at often, and can be (slightly) behind ... View more

doesn't look like the join is just for the ordering of the work_locations, but for that you can just make a lookup with the order and sort in the end by the order field: order, work_location 1, New York 2, LA 3, SF search: | lookup work_locations.csv work_location OUTPUT order | sort - order | fields - order Not sure how the data looks, so this is mostly generic search index=_internal | search type="Incident" | search status="Cancelled" can be just search index=_internal type="Incident" status="Cancelled" probably (provided that that ticket_no is there on every field) | dedup ticket_no | stats count as "open_b2" by work_location can be | stats dc(ticket_no) AS "open_b2" BY work_location or at least limit fields that you're pulling through dedup, to just the ones you need | fields ticket_no work_location | dedup ticket_no search after where can be optimized too | join type=left work_location [ search index=_internal | where _time <= $token_carryover_latest$ AND date_restored_e >= $token_carryover_latest$ | search type="Incident" becomes | join type=left work_location [ search index=_internal type="Incident" | where _time <= $token_carryover_latest$ AND date_restored_e >= $token_carryover_latest$ "where _time" can be latest or earliest | join type=left work_location [ search index=_internal | where _time <= $token_carryover_latest$ -> | join type=left work_location [ search index=_internal latest=$token_carryover_latest$ ... View more

Because you have your values in different events you need to combine them into one event somehow | makeresults count=12 | eval SerialNumber="thesameserial1234" | streamstats count | eval _time=_time+(floor(count/2))*60 | eval Front=if(count%2=0, null(), count) | eval Rear=if(count%2=0, count, null()) | bin _time span=1m | stats values(Front) AS Front values(Rear) AS Rear BY _time SerialNumber | eval gap=abs(Front-Rear) | makeresults count=12 | eval SerialNumber="thesameserial1234" | streamstats count | eval _time=_time+(floor(count/2))*60 | eval Front=if(count%2=0, null(), count) | eval Rear=if(count%2=0, count, null()) | transaction maxspan=1m _time SerialNumber ... View more

Enhanced from above idea: | makeresults count=10 | eval _raw="{ \"contextValues\": [ \"10.1.1.1\", \"10\", \"testhost\" ], \"contextTypes\": [ \"IP\", \"threshold\", \"hostname\" ], \"message\": \"Latency on {hostname} with IP {IP} is higher than {threshold} ms.\" } " | kv | rename _raw AS orig_raw | rename *{} as * | eval temp=split("my,my,my,my,my,my,my,my,my,my", ",") | eval _raw=mvzip(temp,mvzip(contextTypes,contextValues,"="),"_") | kv | fields - _raw | foreach my_* [ eval message= replace(message,"{"."<<MATCHSTR>>"."}",<<FIELD>>)] | fields _time message ... View more

| from datamodel:"Network.All_Traffic" | join type=left src_ip [ search source=third_party_api_data | rename ipAddress AS src_ip | stats latest(score) AS src_score BY ipAddress ] something like that should limit the amount of data returned by your subsearch (for the crashing bit, just guessing at the cause though). If you make this third_party_api_data a lookup, then you can actually just do automatic lookups in your datamodel, much easier, and no need for two searches There is already apps on splunkbase that can pull in data from REST endpoint, just do a scheduled search with a | outputlookup at the end to put the output in a lookup: https://splunkbase.splunk.com/app/4253/#/details https://splunkbase.splunk.com/app/4172/#/details ... View more

if KUBERNETES_NAMESPACE::XXXX works then add fields.conf [KUBERNETES_NAMESPACE] INDEXED=true to your search head ... View more

Took this as an exercise in my spare time, but to be honest, I'm sceptical how well this scales. ... your search for events... | fields _time _raw | spath path="value{}" | mvexpand value{} | streamstats count AS level1 | eval _raw='value{}' | spath | fields - _raw | mvexpand data{}.timeStamp | streamstats count AS level2 BY level1 | eval value=mvindex('data{}.count',level2-1) | eval _time=strptime(('data{}.timeStamp'),"%Y-%m-%dT%H:%M:%S%Z") | fields _time value name.* type unit | table * ... View more

This reads like SPL-154973 actually, fixed in 7.1.3+ http://docs.splunk.com/Documentation/Splunk/7.1.3/ReleaseNotes/Fixedissues Upgrade SH and IDX to 7.1.4+ (can't recommend to upgrade to 7.1.3 for other issues). ... View more

This reads like SPL-154973 actually, fixed in 7.1.3+ http://docs.splunk.com/Documentation/Splunk/7.1.3/ReleaseNotes/Fixedissues Upgrade SH and IDX to 7.1.4+ (can't recommend to upgrade to 7.1.3 for other issues). ... View more

Missed that part (EXT|GEN)_CODE\d{1,3}= should work for that btw, I use regex101 for a lot of these things: https://regex101.com/r/RfKqEt/2 really great tool ... View more