Was the root cause of this issue identified? ... View more

This question has been asked and answered many times For example: Re: How to color the columns based on previous co... - Splunk Community which you could adapt for your usecase You could have found this with a simple search Search - Splunk Community ... View more

Any specfic example query please to use this  ... View more

Check if the KV store is running (splunk show kvstore status), if not start it.  ... View more

Hi @deepthi5, no, I'm sorry: when an event is indexed isn't possible to change the sourcetype. You have to define the new sourcetype rules (regexes) and override the original value before indexing, following the steps described at https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Advancedsourcetypeoverrides#:~:text=You%20can%20override%20source%20types,directly%20on%20the%20instance%20itself. Ciao. Giuseppe ... View more

Hi @deepthi5, if you configured Splunk Monitoring Console App for Distributed Mode, you already have all the dashboards and alerts you need. Ciao. Giuseppe ... View more

What are the props.conf settings for those two sourcetypes?  They're very different so they should be separate sourcetypes.  Also, the "Type 1" logs are not JSON. ... View more

Here's a way to see the current size and event count of your indexes: | rest /services/data/indexes | table title currentDBSizeMB totalEventCount | rename title AS index_name | stats sum(currentDBSizeMB) AS index_size_mb sum(totalEventCount) AS event_ct BY index_name   ... View more

Hi @deepthi5, your configurations are correct, remember only that inputs.conf must be located on the Universal Forwarders and props.conf and transforms.conf must be located on Indexers or (if present) on Heavy Forwarders. Ciao. Giuseppe ... View more

Different count of #_Failed_logins   ... View more

Transforms.conf ( Where dvc_host is defined as field here ) [panfw_extract_traffic] DELIMS = "," FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","future_use2","generated_time","src_ip","dest_ip","src_translated_ip","dest_translated_ip","rule","src_user","dest_user","app","virtual_system","src_zone","dest_zone","src_interface","dest_interface","log_forwarding_profile","future_use3","session_id","repeat_count","src_port","dest_port","src_translated_port","dest_translated_port","flags","protocol","action","bytes","bytes_out","bytes_in","packets","start_time","duration","category","future_use4","sequence_number","action_flags","src_location","dest_location","future_use5","packets_out","packets_in","session_end_reason","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_host","action_source" Props.conf [pan:traffic] REPORT-panfw_extract_traffic = panfw_extract_traffic ... View more

Below idea might help you. But consider about performance 1) Create another script to monitor existing python script.Map a new script to saved search and scheduled it for every minute. In search string give as "|noop". Check the perfomance 2) Create a bash script to execute exsting python script and assign to cron tab. ... View more

Yes, absolutely. The DBConnect app is for collecting data from inside a relational database, not for collecting the database logs. For any log file (or other text file), you can use the Splunk input settings to read the file; you don't need an app for that. If you want to test a particular log file, you can copy it to your Splunk server and index it as a local file. Once you are good with that, you can use a forwarder with the same inputs.conf to collect the live logs and send them to your Splunk server. Again, no apps are required. However, sometimes you will find that there is an app on Splunkbase (www.splunkbase.com) that will do exactly what you want: collect the log files, parse them and provide some interesting reports. So it's always worth checking but it is never required. ... View more

Yes, use | stat s to summarize to the level you want, and |table to eliminate all unnecessary fields. ... View more

Hi deepthi5, see https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Propsconf TZ = <timezone identifier> * The algorithm for determining the time zone for a particular event is as follows: * If the event has a timezone in its raw text (for example, UTC, -08:00), use that. * If TZ is set to a valid timezone string, use that. * If the event was forwarded, and the forwarder-indexer connection is using the 6.0+ forwarding protocol, use the timezone provided by the forwarder. * Otherwise, use the timezone of the system that is running splunkd. * Defaults to empty. or at https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Applytimezoneoffsetstotimestamps The Zoneinfo database is at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones Bye. Giuseppe ... View more

Thanks for your answer. I did it a try and still not working. Actually i'm using 2 sourcetypes: CSV and Catalina ... View more

Try this source="C:\\Ping\*" index="ping" sourcetype="pingstats" | rex field=source "(?.*?)$" | lookup pinglookup.csv country OUTPUT router DestinationIP | search router=waterloo | chart values(RTT) as RTT by _time,router | fillnull value=0 | addtotals | trendline sma5(Total) as Trend | fields - Total ... View more

To search with an exact date as boundary, such as from November 5 at 8 PM to November 12 at 8 PM, use the timeformat: %m/%d/%Y:%H:%M:%S earliest="11/5/2015:20:00:00" latest="11/12/2015:20:00:00" august month 5th date from 12 to 14 hrs earliest="08/05/2016:12:00:00" latest="08/05/2016:14:00:00" ... View more

index=XXX source=XXX |XMLKV |search Category="CDMSP" RI="0" | [search index=XXX source="XXXX" sourcetype=XXXX |table _time,SNMP_Message] | table _time,Category,F,RI,SNMP_Message or, please check this one - index=XXX source=XXX OR (source="XXXX" sourcetype=XXXX) |XMLKV |search Category="CDMSP" RI="0" |table _time,SNMP_Message,Category,F,RI,SNMP_Message ... View more

And if the props.conf was setup on Indexer/Heavy Forwarder and was restarted after making the change? Also, it'll only work for any new data that'll come after you made the change. ... View more

Hello Deepthi, Splunk license meter looks at the amount of data you inject per day and to run an enterprise splunk installation (other than forwarder), you need a license master. So either you can install your test environment with a new free license or can connect to the existing license master which is being used by production. If it's existing license master, just make sure that you are not forwarding data from your test environment which is more than your license can handle. "Cloning" also depends on your existing infrastructure. For eg: if you have a search head cluster , then you might need to have a replica of search head cluster to test the full functionalities. References: http://docs.splunk.com/Documentation/Splunk/6.4.1/Installation/Aboutupgradingto6.4READTHISFIRST https://docs.splunk.com/Documentation/Splunk/6.4.1/Installation/Upgradeto6.4onUNIX ... View more

Well, it will depend on if the log format has changed after ATG framework upgrade. If this space delimited field extraction was working/correct earlier and if the log format has not changed, then the value should be correct only. ... View more

Try this: index=* sourcetype=AMS_samplelog | eval server = "Server-" . server | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100 | chart count BY range server | addtotals row=t col=f ... View more