Hello All,   I have query index=xxxx sourcetype=xxx_* NOT(ASA) which actually filters logs that are not ASA from 4 sourcetypes , i want to send these resulted logs to a new sourcetype call xxx_analmoly    Is it possible if yes , how can i achieve this  ... View more

Hi ,   I wanted to dashboard to monitor my complete splunk environment . I want to monitor _internal index every 5mins and if it is not sending _internal data then it should go to red otherwise it should be running and green    Can we achieve this        ... View more

Hi My json logs comes with two different patterns one with timestamp and host added sometimes and one with out these extra fields , when i dont have extra timestamp and host the extractions work better , but for the events with timestamp and host events are not breaking properly  Type 1 Logs     Component: xxxxx    Data:    Description: xxxx    Message: xxxxx Accessed URL: xxxx    Originator: xxxx    Target: xxxx    appName: xxxxxx    subTarget: XYZ    timeStamp: 1668522719915 Type 2 Logs : Nov 15 15:31:58 ics021013230.ics-eu-1.asml.com {"appName": "XXXXXXX","Component":"XXXXX","timeStamp":"1668522718900","eventId":"2e0525","Description":"XXXX Gateway: YYYYY ","Originator":"xxxxxx","Target":xxxxx","subTarget":"xxxxx" ... View more

Hi team, I am from admin team i wanted to how many of indexes are empty and are not having data anymore in it so that i can remove those indexes and clean up my indexes.conf    Can we have a query or a way to find this  ... View more

I am trying to get the kvstore status of one my heavy forwarder using the command     /opt/splunk/bin/splunk show kvstore-status This command [GET /services/kvstore/status] needs splunkd to be up, and splunkd is down. ... View more

Hi , I have logs with below format  X.X.X.X. - - [02/Aug/2022:10:31:18 +0200] "GET /api/mc/v0.1/agendas/view/background-tasks?is-details-required=false HTTP/1.1" 200 20 "-" " "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" X.X.X.X.X - - [02/Aug/2022:10:31:18 +0200] "GET /api/mc/v0.1/agendas/view/background-tasks?is-details-required=false HTTP/1.1" 200 20 "-" " "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" X.X.X.X.- - [02/Aug/2022:10:31:33 +0200] "GET /api/mt/v0.1/tasks/view-count HTTP/1.1" 200 371 "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" X.X.X.X. - - [02/Aug/2022:10:31:33 +0200] "GET /api/mt/v0.1/work-items?start-position=0&number-of-items=11 HTTP/1.1" 200 3084  "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" out of these logs i want to get only  events which has /api/mt in it and drop the remaining events  My configurations:   [monitor:///aaa/yyy/xxxx/access_log] disabled = false sourcetype = mytask:access_log index = temp props.conf [mytask:access_log] TRANSFORMS-set = setnull TRANSFORMS-set = setparsing    Transforms.conf  [setnull] REGEX = ^(.*)mc(.*) DEST_KEY = queue FORMAT = nullQueue  [setparsing] REGEX = ^(.*)mt(.*) DEST_KEY = queue FORMAT = indexQueue Do we need set anything else in the configs  ... View more

index=wineventlog EventCode=4625 | search user!="sa*" AND user!="VD*" AND user_email!="" | bucket _time span=10m | eval minute=strftime(_time, "%M") | eval hour=strftime(_time, "%H") | eval day=strftime(_time, "%D") | eval wday=strftime(_time, "%A") | stats count(EventCode) as aantal by hour, wday, day | rename aantal as #_failed_logins | eval search_value = wday+"_"+hour | table hour, day, wday, search_value, #_failed_logins, upperBound, upperBound_2stdev, upperBound_2.5stdev, upperBound_3stdev, upperBound_3.5stdev, upperBound_4stdev, twoSigmaLimit, hour_avg, hour_avg_2sig, hour_stdev, hour_stdev_2sig     Every day this query gives a different count  ... View more

I have a log with events as below Mar 18 10:48:31 XXXXXXXXXXXXXXX 1,2019/03/18 10:48:31,012501002228,\,url-filtering,0,2019/03/18 10:48:31,,url-cloud-connection-failure,,0,0,general,medium,"Cloud is not ready, Where XXXXXXXXX is ectract as device hostname i.e., dvc_host I want to make this field as a index time field extraction I have field extracted in props and transforms and then defined dvc_host in fields.conf but still could not find the field while using tstats ... View more

Hello Team, I am having a python script that runs without exiting the while loop so this configured as scripted input in splunk [script://......] As this as non exit script i dont want to use interval=X seconds and trigger it for every certain interval but wanted to trigger it whenever this script is not running any idea please ... View more

Hello i have got Data base log with me extracted as txt file can i onboard this to splunk and query it to form dashboards withou any splunk apps like DB connect and once i am good with this can we have forwarder installed on DB machine and pull these logs to splunk ... View more

Need to create a summary index from the existing raw data to include the 13 fields in the attachment. The index needs to be created every 5 mins, 60 mins, and on a daily basis while being retained for a period of 13 months. I would like to how to retain this for 13 months and is using stats is a correct method to include fields that i need? Right now i have created the following savedsearches.conf [30159_cso_stratus_summaryindex] action.summary_index = 1 action.summary_index._name = cso_stratus_summary action.summary_index.report = cso_stratus_summaryindex alert.digest_mode = True alert.expires = 4h alert.suppress = 0 alert.track = 0 auto_summarize.dispatch.earliest_time = -1d@h cron_schedule = */5 * * * * description = summary index for cso stratus dispatch.earliest_time = -5m dispatch.latest_time = now enableSched = 1 realtime_schedule = 0 search = search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs" |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc [30159_cso_stratus_summaryindex] action.summary_index = 1 action.summary_index._name = cso_stratus_summary alert.digest_mode = True alert.expires = 4h alert.suppress = 0 alert.track = 0 auto_summarize.dispatch.earliest_time = -1d@h cron_schedule = */10 * * * * description = summary index for cso stratus dispatch.earliest_time = -10m dispatch.latest_time = now enableSched = 1 realtime_schedule = 0 search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs" |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc ... View more

Hi team, I have catalina logs ocming to splunk from Central timezone But my splunk server is installed and configured in Eastern time Zone Time Event 1/24/17 4:12:55.911 AM 2017-01-24T 03:12:55.911-0600: 3331438.505: Total time for which application threads were stopped: 0.0008767 seconds, Stopping threads took: 0.000219 This is how splunk is generating the events with one hour ahead the time specified in logs my sample props.conf file [cfs_galaxy_dpsdao_catalina_st] TIME_FORMAT = %H:%M:%S,%3N MAX_TIMESTAMP_LOOKAHEAD = 12 NO_BINARY_CHECK = 1 pulldown_type = 1 SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE =^\d+:\d{2}:\d{2}\,\d{3} TZ = CST6CDT ... View more

Hi , I have one graph which shows the response times for every second source="C:\Ping\" index="ping" sourcetype="pingstats" | rex field=source "(?.?)$" |lookup pinglookup.csv country OUTPUT router DestinationIP |search router=waterloo|chart values(RTT) as RTT by _time,router|fillnull value=0 I have another graph which shows the trend of the average of the response times for one hour source="C:\Ping\" index="ping" sourcetype="pingstats" | rex field=source "(?.?)$" |lookup pinglookup.csv country OUTPUT router DestinationIP |search router=waterloo | bucket _time span=1h | stats avg(RTT) AS avg_value by _time | trendline sma5(avg_value) as trend How can i combine both and get a graph i have used appendcols but the graph looks odd attaching the screen shot ... View more