Hi all, I am trying to build a query to monitor my indexer rolling restart  I would like to know how much time it has taken when it has started and when it has ended , I can only see when it has started but cannot see messages on when it has been completed    INFO CMMaster [3340464 TcpChannelThread] - Starting a rolling restart of the peers.     ... View more

Hello All, I have a dashboard for vulnerability tracking but i would like to add some custom changes for example  Vuln_number dv_risk_rating dv_assignment_group short_description VIT9662368 2 - High XYZ R7-msft-cve-2024-38077 detected on  VIT9662366 2 - High XYZ R7-msft-cve-2024-38074 detected on  VIT9662367 2 - High XYZ R7-msft-cve-2024-38076 detected on ics028159223 VIT9662265 2 - High XYZ R7-msft-cve-2024-38077 detected on  VIT9662260 2 - High XYZ R7-msft-cve-2024-38074 detected on    I need a table with comments in the status column ( The comments are static either there is no action or i have to fix in next release or exception ) so only 3 Can i give that as a dropdown and then select that Vulnerability and assign status from drop down Status   Status_dropdown No Action Fix in next release Exception Raised     dv_number dv_risk_rating dv_assignment_group short_description status VIT9662368 2 - High XYZ R7-msft-cve-2024-38077 detected on  No action VIT9662366 2 - High XYZ R7-msft-cve-2024-38074 detected on  Fix in next release  VIT9662367 2 - High XYZ R7-msft-cve-2024-38076 detected on  Exception Raised VIT9662265 2 - High XYZ R7-msft-cve-2024-38077 detected on  Fix in next release  VIT9662260 2 - High XYZ R7-msft-cve-2024-38074 detected on  No action ... View more

Hello All, I have copied senemail.py to a custom app to modify it for adding html inputs to email .   Now this custom copy throws not compatible with python 3 error , where as original sendemail.py in search/bin does not throw any error    I just modified a small statement in the script to add html inputs apart from that remaining script is same as search /bin copy      ... View more

I wanted to use MLTK k-cluster algorithm to differentiate indexes which are slow usage growth as a cluster and sudden usage growth as a cluster and also predict indexe usages for next year  did someone already did and exp ... View more

Hi i have stats table with following      ... View more

I would like to predict memory ,cpu and storage usage of my splunk servers ( Indexers, search heads, )  step wise plan is to first do an analysis of current usage and then predict 6 months usage of my own splunk platform ( Like indexers , search  heads , heavy forwarders)  ... View more

we have recently upgraded from splunk 8.x to 9.x after which all python scripts are failing with ssl errors we have updated all packages according to python 3.7 but still it throws ssl error File "/apps/splunk/etc/apps/xxxx/bin/splunklib/binding.py", line 32, in <module> import ssl File "/apps/splunk/lib/python3.7/ssl.py", line 98, in <module> import _ssl # if we can't import it, let the error propagate ImportError: libssl.so.1.0.0: cannot open shared object file: No such file or directory. In path /apps/splunk/lib i have libssl.so.1.0.0   ... View more

Hello All,   I have query index=xxxx sourcetype=xxx_* NOT(ASA) which actually filters logs that are not ASA from 4 sourcetypes , i want to send these resulted logs to a new sourcetype call xxx_analmoly    Is it possible if yes , how can i achieve this  ... View more

Hi ,   I wanted to dashboard to monitor my complete splunk environment . I want to monitor _internal index every 5mins and if it is not sending _internal data then it should go to red otherwise it should be running and green    Can we achieve this        ... View more

Hi My json logs comes with two different patterns one with timestamp and host added sometimes and one with out these extra fields , when i dont have extra timestamp and host the extractions work better , but for the events with timestamp and host events are not breaking properly  Type 1 Logs     Component: xxxxx    Data:    Description: xxxx    Message: xxxxx Accessed URL: xxxx    Originator: xxxx    Target: xxxx    appName: xxxxxx    subTarget: XYZ    timeStamp: 1668522719915 Type 2 Logs : Nov 15 15:31:58 ics021013230.ics-eu-1.asml.com {"appName": "XXXXXXX","Component":"XXXXX","timeStamp":"1668522718900","eventId":"2e0525","Description":"XXXX Gateway: YYYYY ","Originator":"xxxxxx","Target":xxxxx","subTarget":"xxxxx" ... View more

Hi team, I am from admin team i wanted to how many of indexes are empty and are not having data anymore in it so that i can remove those indexes and clean up my indexes.conf    Can we have a query or a way to find this  ... View more

I am trying to get the kvstore status of one my heavy forwarder using the command     /opt/splunk/bin/splunk show kvstore-status This command [GET /services/kvstore/status] needs splunkd to be up, and splunkd is down. ... View more

Hi , I have logs with below format  X.X.X.X. - - [02/Aug/2022:10:31:18 +0200] "GET /api/mc/v0.1/agendas/view/background-tasks?is-details-required=false HTTP/1.1" 200 20 "-" " "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" X.X.X.X.X - - [02/Aug/2022:10:31:18 +0200] "GET /api/mc/v0.1/agendas/view/background-tasks?is-details-required=false HTTP/1.1" 200 20 "-" " "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" X.X.X.X.- - [02/Aug/2022:10:31:33 +0200] "GET /api/mt/v0.1/tasks/view-count HTTP/1.1" 200 371 "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" X.X.X.X. - - [02/Aug/2022:10:31:33 +0200] "GET /api/mt/v0.1/work-items?start-position=0&number-of-items=11 HTTP/1.1" 200 3084  "https://XXX.AAA.COM" "Mozilla/5.0 (Windows NT X.O; Win64; x64; rv:98.0)  Firefox/98.0" out of these logs i want to get only  events which has /api/mt in it and drop the remaining events  My configurations:   [monitor:///aaa/yyy/xxxx/access_log] disabled = false sourcetype = mytask:access_log index = temp props.conf [mytask:access_log] TRANSFORMS-set = setnull TRANSFORMS-set = setparsing    Transforms.conf  [setnull] REGEX = ^(.*)mc(.*) DEST_KEY = queue FORMAT = nullQueue  [setparsing] REGEX = ^(.*)mt(.*) DEST_KEY = queue FORMAT = indexQueue Do we need set anything else in the configs  ... View more

index=wineventlog EventCode=4625 | search user!="sa*" AND user!="VD*" AND user_email!="" | bucket _time span=10m | eval minute=strftime(_time, "%M") | eval hour=strftime(_time, "%H") | eval day=strftime(_time, "%D") | eval wday=strftime(_time, "%A") | stats count(EventCode) as aantal by hour, wday, day | rename aantal as #_failed_logins | eval search_value = wday+"_"+hour | table hour, day, wday, search_value, #_failed_logins, upperBound, upperBound_2stdev, upperBound_2.5stdev, upperBound_3stdev, upperBound_3.5stdev, upperBound_4stdev, twoSigmaLimit, hour_avg, hour_avg_2sig, hour_stdev, hour_stdev_2sig     Every day this query gives a different count  ... View more

I have a log with events as below Mar 18 10:48:31 XXXXXXXXXXXXXXX 1,2019/03/18 10:48:31,012501002228,\,url-filtering,0,2019/03/18 10:48:31,,url-cloud-connection-failure,,0,0,general,medium,"Cloud is not ready, Where XXXXXXXXX is ectract as device hostname i.e., dvc_host I want to make this field as a index time field extraction I have field extracted in props and transforms and then defined dvc_host in fields.conf but still could not find the field while using tstats ... View more

Hello Team, I am having a python script that runs without exiting the while loop so this configured as scripted input in splunk [script://......] As this as non exit script i dont want to use interval=X seconds and trigger it for every certain interval but wanted to trigger it whenever this script is not running any idea please ... View more

Hello i have got Data base log with me extracted as txt file can i onboard this to splunk and query it to form dashboards withou any splunk apps like DB connect and once i am good with this can we have forwarder installed on DB machine and pull these logs to splunk ... View more

Need to create a summary index from the existing raw data to include the 13 fields in the attachment. The index needs to be created every 5 mins, 60 mins, and on a daily basis while being retained for a period of 13 months. I would like to how to retain this for 13 months and is using stats is a correct method to include fields that i need? Right now i have created the following savedsearches.conf [30159_cso_stratus_summaryindex] action.summary_index = 1 action.summary_index._name = cso_stratus_summary action.summary_index.report = cso_stratus_summaryindex alert.digest_mode = True alert.expires = 4h alert.suppress = 0 alert.track = 0 auto_summarize.dispatch.earliest_time = -1d@h cron_schedule = */5 * * * * description = summary index for cso stratus dispatch.earliest_time = -5m dispatch.latest_time = now enableSched = 1 realtime_schedule = 0 search = search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs" |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc [30159_cso_stratus_summaryindex] action.summary_index = 1 action.summary_index._name = cso_stratus_summary alert.digest_mode = True alert.expires = 4h alert.suppress = 0 alert.track = 0 auto_summarize.dispatch.earliest_time = -1d@h cron_schedule = */10 * * * * description = summary index for cso stratus dispatch.earliest_time = -10m dispatch.latest_time = now enableSched = 1 realtime_schedule = 0 search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs" |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc ... View more

Hi team, I have catalina logs ocming to splunk from Central timezone But my splunk server is installed and configured in Eastern time Zone Time Event 1/24/17 4:12:55.911 AM 2017-01-24T 03:12:55.911-0600: 3331438.505: Total time for which application threads were stopped: 0.0008767 seconds, Stopping threads took: 0.000219 This is how splunk is generating the events with one hour ahead the time specified in logs my sample props.conf file [cfs_galaxy_dpsdao_catalina_st] TIME_FORMAT = %H:%M:%S,%3N MAX_TIMESTAMP_LOOKAHEAD = 12 NO_BINARY_CHECK = 1 pulldown_type = 1 SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE =^\d+:\d{2}:\d{2}\,\d{3} TZ = CST6CDT ... View more