@woodcock did you ever complete a more granular tagging of FireEye events?  would you be willing to share? ... View more

I wouldn't count on it working magically after splunk upgrade. It's an internal dbconnect issue caused by something java-related so upgrading the component which receives data from the modular input most probably won't help much. It sounds like it could be related by some mismatch between splunk's ssl settings and what's available in your JRE (or alternatively between dbconnect and database). ... View more

Its fixed in 9.0.4. But form the change log, it was fixed just days after 9.0.3 was released. 2022-12-02 SPL-233492, SPL-229404 Invalid key in stanza instrumentation.usage.tlsBestPractices ... View more

less typing might be: | timechart span=1w sum(eval(DATA_MB+INDEX_MB+DB2_DATA_MB+DB2_INDEX_MB+DB2_LOB_MB+DB2_LONG_MB+DB2_XML_MB)) as totalmb by DOMAIN limit=25 if you don't need all the individual sums.  ... View more

I would like to take this moment to say that your best bet is to comment out this entry in the Nix TA until Splunk has a better way to get sourcetypes from linux - cron is a great source of data but it doesn't seem that Splunk cares about making the data actually useful, at least in this instance. If you can create your own sourcetype, you should definitely share it on Github, but other than that, I don't know that we're going to be seeing any tools for this any time soon. There may be a good use case for a supplementary TA that adds onto the linux TA which monitors standard files and assigns/defines the correct sourcetypes for them. ... View more

Did you ever get an answer on this?  ... View more

In python.log we are hitting some local size limit imposed by the email server: index=_internal source=*python.log* "Message exceeds local size limit" The 552 error was generated by the receiving SMTP email server complaining that the email hit the size limit on the server. Every mail server has custom settings for the size of mail users can send and receive through it. These limits can either be global or individual-account specific or both. In an Exchange server, there are mainly 4 settings for message size limitations: a. Global value for the mail server b. Receive and Send Connectors setting c. SMTP Virtual Server setting d. Individual user mailbox restriction If the message size in the email exceeds any of these limits that are allowed for a particular email user account, it will be rejected with this error 552 message. To resolve a valid email bouncing with error 552, these attachment limits have to be increased or adjusted appropriately. You could contact the mail system admin to better understand limits for email attachments. ... View more

I ran "splunk show license" on v8.0.3 and got: "This command has been removed." ... View more

Ok, so the "DAG Execution" errors were caused by me running long-running searches in multiple browser tabs.  The errors would occur if I switched between tabs.  Running searches in their own windows solved the search error problem. I'm still looking for a fast way to stimulate the indexers to load previously indexed data from S3 to the indexers. ... View more

It's happening to me on version 8.0.3 right now. ... View more

Links to the talk return: <Error> <Code>AccessDenied</Code> <Message>Access Denied</Message> <RequestId>7BEZWWY1K8WA511V</RequestId> <HostId>bsDp/rRmE1/64CmaduU6ebmvWdDJNvkw/bnJUnDSNYE26AE+HFQUYMcng/bVXyfeD/dL5kmgkZ8=</HostId> </Error>   How about a paragraph describing what to do? ... View more

This worked for me.  My time picker input "token" value is "field3". Change: <search ref="my report"></search> to: <search ref="my report">   <earliest>$field3.earliest$</earliest>   <latest>$field3.latest$</latest> </search>     ... View more

Using eval in stats works, but if you want to round the average, you have to eval(round(avg(count),2)). ... View more

I suppose that, if you have enough fresh version of systemd this should work on any Linux? r. Ismo ... View more

How would you write the foreach statement if the parameters didn't share a name prefix like this: ? | eval js="{\"parameters\": {\"wookie\": \"1\",\"jabba\": \"2\"}}"    ... View more

Then "old" posts should have a disclaimer on them.  People are going to cut/paste or re-type what they see and the missing underscores are going to cause more problems.  Better would be to fix the old posts so that they display correctly. --------- If you agree, an upvote would be appreciated. ... View more