@brandonmurphy I know this is an old post, but for those looking to index External Public Egree IPs (IPv4 and IPv6) from Splunk UFs or Splunk Enterprise, we built this Get Public IP Add-on: https://splunkbase.splunk.com/app/8107 ... View more

(To be fair, the unique delimiter isn't necessary if you know your data well enough to pick a static one that won't conflict; it would be more performant than calculating a random integer every event) ... View more

I don't. I think it's a good architectural design to be able to determine which context must implement indexed fields and which context must resort to the default search-time field extractions. For example, TAs that make logs CIM compliant like TAs for network devices (e.g. Aruba or Checkpoint), they extract fields at search time and are best to remain that way because of the sheer size of network devices logs. Also, they are most likely going to be accelerated anyway in a sort of "Network Traffic" `datamodel`. Another example is for specific contexts that could help your unique-to-your-organisation use cases. I used to work in a project where we had to implement index-time field extractions so we can pull them quickly in `tstats` so we can display the data quickly on a dashboard that's viewed by a high-profile boss every Monday. He gets frustrated if the dashboard loads very slowly and we don't want to upset the boss. We could've used accel-datamodel but we decided to do it at indexing phase instead. ... View more

for reference,     I put the props in UF and it is working fine now. Thanks    Does this mean the directory of $SPLUNK_HOME/SplunkUniversalForwarder/default  or something else?    ... View more

Hi, you are absolutely right but I find it difficult to supply samples. The situation is that there is a chain of events, every event starts with the logger "start" when the event cannot be distrtibuted it ends in an exception. Every event contains a messageid en sometimes a businessid. The messageid is unique for every string of events, this can be 2 events of 100. In case of an error there will be retries with the same messageid. I need the count of the unique id's that have been started en the count of the id's that had an exception. Both dedupped. Message.ID LOGGER LOGGER 1 “start” 2 “start” 3 “start” 3 "Exception" 3 "Exception" 4 "Start" 5 "Start" 5 "Exception" 6 "Start" 7 "Start" ... View more

That's exactly what I needed to know. Thank you. ... View more

You could send your log to the Splunk Http Event Collector (HEC). curl to HEC; you can send raw or JSON. ... View more

you're right! put the @ in the wrong spot 🙂 ... View more

No, correct timestamp data is not enough to see the details of future dates in the splunk. We need to introduce the below configuration in the Props.conf in the path 'local' folder (Do not update in the default folder) MAX_DAYS_HENCE = 730 (365 * 2, to read 2 years of data from the current date) Restart the Splunk services and then load the data into Splunk to reflect the future dates in the reports. Thanks for your hints to resolve this issue. ... View more

Thanks guys now my query is resolved:-)) Could you also help me a little more: (https://answers.splunk.com/answers/814817/splunk-search-basic-queries.html) ... View more

No, latest does not exist in the subsearch Remove it thusly: | join client_ip [...] From the join docs.splunk page: Field names must match, not just in name but also in case. You cannot join product_id with product_ID. You must first change the case of the field in the subsearch to match the field in the main search. ... View more

You have to have good hygiene for old logs. Hundreds of co-resident logs is fine, thousands is risky, above that you will experience a total breakdown in the UF's ability to search through them and send updates in a timely manner. Even if the *.tgz does not match your monitor pattern, they will still cause this problem unless you MOVE THEM SOMEWHERE ELSE. ... View more

This has been solved many times including: Meta Woot!: https://splunkbase.splunk.com/app/2949/ TrackMe: https://splunkbase.splunk.com/app/4621/, Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/ Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/ Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/ Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarder_warnings ... View more

It's legal - but seems to be pointless You're doing a | join , ostensibly to get more fields, and then immediately throw them all away with a | stats count by ... View more

Welcome! Yes, you can filter on multiple multi-value fields. <base search> | mvexpand extracted_host{} | mvexpand url | search [<search> | fields extracted_host{}, url] ... View more

this query works for me | loadjob savedsearch="myquery" | where (strftime(_time, "%Y-%m-%d") >= "2020-02-26") AND (strftime(_time, "%Y-%m-%d") <= "2020-03-03") and STEP=="Click" | bucket _time span=1d | stats earliest(_time) as _time by ID_MESSAGE | eval _time=strftime(_time, "%Y-%m-%d") And this is the result : _time ID_MESSAGE 27/02 YHDD 27/02 MFJIO 27/02 LKCFD 28/02 LMDFF Now i wanna count ID_MESSAGE by _time to have this : _time count(ID_MESSAGE) 27/02 3 28/02 1 ... View more

Per https://splunkbase.splunk.com/app/2935/#/overview, it doesn't officially support anything newer than 7.1 Will it work? Probably But it's not a guarantee ... View more

Filter early, filer often Any time it's possible, use the form index=ndx sourcetype=srctp ... Using merely index=ndx ... , and NOT including sourcetype=srctp will still allow Splunk to try to look in EVERY sourcetype (even the 291 that aren't in that index) ... View more

No need for a script. Use the command line switches. msiexec.exe /i splunk-<...>-x64-release.msi AGREETOLICENSE=Yes DEPLOYMENT_SERVER="<host:port>" LAUNCHSPLUNK=1 /quiet Click here for more switches. ... View more

Directories have to be executable in order to do anything inside them It's the nature of *nix permissioning ... View more

Hi, @jamesofthedead84, at first check the name of the lookup because the inputlookup command is case sensitive and check that there's the extension(.csv) in the lookup filename and lookup definition. then, if you already created the Lookup Definition, check the permissions of the lookup. Ciao. Giuseppe ... View more

First, you don't need two calls to your lookup - you can do this: | lookup Friendly_Name.csv Friendly OUTPUT FullHost FullHostHSB Secondly, what prevents you from doing this: eventtype=eop_WinEventLog:Application `FriendlyEval` | <rest of your search> ... View more

Thank you! Along with the regex, the rtrim idea does what is needed! ... View more

Use the <done> tag inside your searches: <search> <done> <set token="thispanelstoken">done</set> </done> </search> Relying on $job.resultCount$>0 is not a good practice: what happens when the search returns no values? Your condition would fail, but it would be "done". What are you trying to do with these "completed" tokens? ... View more