Here is my situation. I can use subsearch to get two column data, just like below. Data row is not aligned, so I can't simply use eval if to compare. Some of the value is identical, but some is not. I want to output the value existing in col1, but not exist in col 2 column1 column 2 AA            BB CC           AA DD           FF EE            ZZ FF            XX VV          MM ... View more

Hello,     When I build the dashboard, I can see the last hour always not accuracy because the latest hour date is incomplete, take below as example. Assume that every hour we have 1000 events, but if I run the search in 03:30, it will got 500 events only, because another 500 events will come in next half hours.    However, if you use timechart to show last 4 hours, it will show the table like below. Is there a way I can show O'clock, but remove any data after the O'clock? _time  events 01:00 1000 02:00 1000 03:00 1000 04:00 500 Table _time Events 2022-03-30 00:00 1000 2022-03-30 01:00 1000 2022-03-30 02:00 1000 2022-03-30 03:00 1000 2022-03-30 04:00 500   ... View more

Hello,   We have two deployment-App, named A and B.  They both have inputs.conf to monitor path /log/A and /log/B. If I use deployment server to push either A or B, it works fine. But If I push both A and B to the clients, only App path /log/A or /log/B is being monitored. Is this because two app's inputs.conf are located in /default folder?   Thanks, Mike ... View more

Dear, I have an timezone issue on data input by Heavy Forwarder. We have two Heavy Forwarder, xxx60520  showed date_zone is -420, the time is correct. xxx64320 is another HF showed date_zone is local, , this one has issue. Both Heavy Forwarder were inject log by Zscaler App though API Because both HF using same indexer and SH head, I have no idea  why the same configuration on both Heavy Forwarder have different time_zone. props.conf of APP [zscalerapi-zia-audit] TZ = PST8PDT TIME_PREFIX = Time\":\s+\" TIME_FORMAT = %d %b %Y %H:%M:%S, %Z MAX_TIMESTAMP_LOOKAHEAD = 25   sourcetype="zscalerapi-zia-audit" | stats count by host date_zone Search result hos                   date_zone     count xxx60520     -420                   2777 xxx64320      local                 1872 ... View more

I can't get any data from Azure . I understand that need to configure connection string and Event Hub name, but there is nothing show, even in internal index Paste the connection string from Step 1 Paste the Event Hub name from Step 2 From the server side, I can see traffics are being exchanged, assumed the connectivity is good. Is there anyway I can troubleshoot this issue to see what's going wrong? # tcpdump -i any host hsbc-multi-shrd-01-euw-evhub-mon-01.servicebus.windows.net -t tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [P.], seq 1506474280:1506474345, ack 958390525, win 340, length 65 IP gbl20060520.hc.cloud##########.35028 > 10.102.144.196.amqps: Flags [P.], seq 871485393:871485446, ack 2983679033, win 1027, length 53 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35032: Flags [P.], seq 2685114633:2685115149, ack 3374421201, win 2048, length 516 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35028: Flags [P.], seq 1:7589, ack 0, win 2048, length 7588 IP gbl20060520.hc.cloud##########.35028 > 10.102.144.196.amqps: Flags [.], ack 7589, win 1145, length 0 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35030: Flags [P.], seq 1:1962, ack 65, win 2048, length 1961 IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [.], ack 1962, win 370, length 0 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35030: Flags [P.], seq 1962:3630, ack 65, win 2048, length 1668 IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [.], ack 3630, win 397, length 0 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35030: Flags [P.], seq 3630:6891, ack 65, win 2048, length 3261 IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [.], ack 6891, win 447, length 0   Thanks, Michael ... View more

Hi I am getting the log from json-like data, Splunk can handle it very well. But the problem is I want to extract fields from child node _content_, as it contain the userful information, like command, user, PWD. Can this done by edit props.conf? RAW: {"__topic__": "", "__source__": "10.189.0.0", "__tag__:__pack_id__": "368845338C122456-6C49", "__tag__:__hostname__": "iz1hl01da6dz8v4uga8hytz", "__tag__:__receive_time__": "1614067931", "_content_": "alisvc : TTY=pts/0 ; PWD=/home/alisvc ; USER=root ; COMMAND=/bin/su - root", "_program_": "sudo", "_priority_": "85", "_facility_": "10", "_severity_": "5", "_unixtimestamp_": "1614067931000000000", "_hostname_": "iz1hl01da6dz8v4", "_ip_": "10.189.0.0"} Splunk search    __source__: 10.189.0.0    __tag__:__hostname__: iz1hl01da6dz8v4    __tag__:__pack_id__: 368845338C122456-6C49    __tag__:__receive_time__: 1614067931    __topic__:    _content_: alisvc : TTY=pts/0 ; PWD=/home/alisvc ; USER=root ; COMMAND=/bin/su - root    _facility_: 10    _hostname_: iz1hl01da6dz8v4    _ip_: 10.189.0.0    _priority_: 85    _program_: sudo    _severity_: 5    _unixtimestamp_: 1614067931000000000   Any help provided it would be really appreciated. Thanks! ... View more

I have a script that can be ran with alert, but if I run the script manually, the following error will showed. Any idea how I can run it manually? I have add the python location in first line. #!/data/splunk/bin/python [root@hostname scripts]# ./REST_1.py ERROR:root:code for hash sha1 was not found. Traceback (most recent call last): File "/data/splunk/lib/python2.7/hashlib.py", line 147, in <module> globals()[__func_name] = __get_hash(__func_name) File "/data/splunk/lib/python2.7/hashlib.py", line 97, in __get_builtin_constructor raise ValueError('unsupported hash type ' + name) ValueError: unsupported hash type sha1 Traceback (most recent call last): File "./REST_1.py", line 7, in <module> import requests File "/data/splunk/lib/python2.7/site-packages/requests/__init__.py", line 58, in <module> from . import utils File "/data/splunk/lib/python2.7/site-packages/requests/utils.py", line 25, in <module> from .compat import parse_http_list as _parse_list_header File "/data/splunk/lib/python2.7/site-packages/requests/compat.py", line 7, in <module> from .packages import chardet File "/data/splunk/lib/python2.7/site-packages/requests/packages/__init__.py", line 3, in <module> from . import urllib3 File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/__init__.py", line 16, in <module> from .connectionpool import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 36, in <module> from .connection import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/connection.py", line 43, in <module> from .util import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/util/__init__.py", line 10, in <module> from .ssl_ import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py", line 2, in <module> from hashlib import md5, sha1 ImportError: cannot import name sha1 ... View more