Just like this e.g: | from datamodel:Authentication | extract vs. index=* source="XmlWineventlog:Security" tag=authentication NOT (user=*$ action=success ) The number of fields will not be the same, as extract does not add field aliases. Compared this with fieldsummary . ... View more

Note that you can add a | extract after | from datamodel :and you will get fields that are not in the datamodel! ... View more

Systemd is now officially supported in Splunk 7.2.2 https://docs.splunk.com/Documentation/Splunk/7.2.2/Admin/RunSplunkassystemdservice ... View more

Can you check if you find any technical issues by looking at the job inspector? If the number of incidents is high, enabling data model acceleration for the alerts data model might help. In the upcoming version, the searches are rewritten to not use data models, this should speed up loading the dashboard. ... View more

Here's the fix that we will put into the next release. if len(entries) > 0: for entry in entries: status = False if ( entry['disabled'] == 0 or entry['disabled'] == "0" or entry['disabled'] == False) else True if status == False: ewa = {'_key': entry['_key'], 'label': entry['label'], 'alert_action': entry['alert_action'] } externalworkflow_actions.append(ewa) return self.response(externalworkflow_actions, httplib.OK) ... View more

Clearly a bug, will take a look... ... View more

In version 2.2.2 you can edit the available alert status settings under Settings -> Alert status. ... View more

Please check the alert_manager.log and splunkd.log for any error messages. ... View more

Will be provided with the next release, see https://github.com/simcen/alert_manager/issues/191 ... View more

Check that "Save incident results to KVStore" is enabled under Settings -> Global Settings ... View more

Multi-tenancy is currently only possible by installing each Alert Manager instance on a separate Search Head (Cluster) and by using different indexes. ... View more

Support has been added to 2.2 and the next release will incorporate some additional improvements e.g. https://github.com/simcen/alert_manager/issues/213 ... View more

Will be part of the next release https://github.com/simcen/alert_manager/issues/191 ... View more

Usually the "Save incident results to KVStore" checkbox under Settings -> Global Settings is not enabled. ... View more

A few new examples... Asynchronous search: $ curl -u admin:changeit -k https://localhost:8089/services/search/jobs -d search="search index=_internal" <?xml version="1.0" encoding="UTF-8"?> <response> <sid>1520569635.358</sid> </response> Fetching results: $ curl -G -u admin:changeit -k https://localhost:8089/services/search/jobs/1520569635.358/results -d output_mode=csv Synchronous search: $ curl -u admin:changeit -k https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10" Getting authentication token: $ curl -k https://localhost:8089/services/auth/login --data-urlencode username=admin --data-urlencode password=changeit <response> <sessionKey>lTsi0Gyhadou77kplKboa8_4DBsMbRB1gpu6sCEvIXIFotnMqNLOJyXQgCLdwM^uhDSRgxpfg_dG0gSbtRIkObpkWrbF2TisTo</sessionKey> </response> Running synchronous search with authentication token: $ curl -k -H "Authorization: Splunk lTsi0Gyhadou77kplKboa8_4DBsMbRB1gpu6sCEvIXIFotnMqNLOJyXQgCLdwM^uhDSRgxpfg_dG0gSbtRIkObpkWrbF2TisTo" \ https://localhost:8089/services/search/jobs/export \ -d output_mode=csv \ -d search="search index=_internal |head 10" ... View more

A faster variant would be to add the filter directly into the tstats command: | tstats count FROM datamodel=Enc where [ | inputlookup DC-Clients.csv | fields + Enc.clientid ] groupby _time span=1d, Enc.clientid by host ... View more

Ok. The Splunk_TA_windows is buggy. This is a quick fix: On the indexer (or where the parsing queue resides) add this to $SPLUNK_HOME/etc/apps/Splunk_TA_windows/local/props.conf: [Script:InstalledApps] SHOULD_LINEMERGE = true LINE_BREAKER = Note: Empty string behind LINE_BREAKER is ok In $SPLUNK_HOME/etc/deployment-apps/Splunk_TA_windows/local/props.conf add: [script://.\bin\win_installed_apps.bat] disabled = 0 sourcetype = Script:InstalledApps ... View more

Please check that the TA is installed on your search head (if you use distributed search) and that you are not searching in "Fast Mode" ... View more