Hi @gcusello  did you get answer from @woodcock regarding applying on all etc/system/local/authorize.conf search head nodes (preferably from GUI if possible) ? Thanks.   ... View more

Just wanted to toss in another possible resolution.  If your system was ungracefully shutdown, resource exhaustion, virtualization host failure, etc. it's possible the splunkd.pid file wasn't cleaned up.  From what I have found, when splunkd attempts to start, it looks at this file and attempts various operations on the existing PIDs that are listed within.  They are obviously not there and the service will fail to start.  This will be made apparent when attempting to start splunk via the binary:  SPLUNK_HOME/bin/splunk start This file is located in SPLUNK_HOME/var/run/splunk/ and can be safely removed to correct.  A new file will be created upon splunkd service starting successfully.    ... View more

Hi, I have created a timeline of URLs hit over a given session. Here is my chart:     and here is the respective XML code:     However, I need to add the time and dates on the top of the timeline as such:   How can I do this? Many thanks, Patrick ... View more

Not working for me, It shows the log_level value ... View more

Hi , I used below query but not getting any output - I have lookup table dc.csv with host, IP field. Could you please look and advise    | metadata index=_internal | eval host=lower(host) | stats count BY host | append [ | inputlookup dc.csv |eval host=lower(host), count=0 | fields host IP count ] | stats sum(count) AS total value(IP) AS IP BY host | eval IP=if(isnull(IP),"Not present in lookup",IP), status=if(total=0,"Missing","Present") | table host IP status       ... View more

Hi @mdmartinez  To send Data from Oracle (PL/SQL) to Splunk, in "push" mode, and with no third parties involved, on the Splunk side use Splunk TCP Data Input. https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/Monitornetworkports  On the Oracle side (PL/SQL script or package/procedure) use Oracle package UTL_TCP. This package can be used to connect and write Oracle data to Splunk using Splunk's TCP Data Input. https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/UTL_TCP.html#GUID-348AFFE8-78B2-4217-AE73-384F46A1D292  At UTL_TCP the following subprograms are needed: utl_tcp.open_connection utl_tcp.write_line utl_tcp.write_text utl_tcp.close_connection The Oracle "push" PL/SQL code logic can be implemented as PACKAGE/PROCEDURE that is called by an Oracle scheduler job.  Must also take care for persisting the last processed value of the rising column (concept remains valid the same as for DB Connect). regards Altin ... View more

Where did you end up with this?  I have a similar need in that I have dashboards that are regionally based around the globe and would prefer that someone viewing the dashboard from outside the location see the data based on that location's timezone.  For example, if an engineer were in Idaho and was working with an engineer in Australia on an Australia issue, they would be seeing charts displaying the same timezone rather than two different timezones. ... View more

Seems like this haven't been implemented yet. There is an idea posted here about it Scheduled reports which are triggered by a different scheduled | Ideas (splunk.com). Give it a vote if you read this question and need this as well. ... View more

Has anyone been able to map Wazuh JSON alerts that are forwarded in JSON format to raw/XML for Spunk ES Windows event stanza and Windows TA app? ... View more

That is there, under the "DESCRIPTION FORMATTING" section. The earlier "FORMATTING" section states to use \" to represent a quote. This is not directly aligned with the Description Formatting and does not work in a description. The "\" is also shown as "\\", which is not documented. Based on the descriptions shown above that were written by Splunk, it appears that this behavior was not understood by Splunk authors, or the parsing behavior changed and the descriptions were not updated. The only concern I have with @lstewart_splunk's accurate answer, is that the current behavior breaks the description syntax for stock Splunk commands, as shown above for regex.  The Splunk authors for the regex syntax apparently expected that (\")?string(\")? would be shown as (")?string(")?, but instead, it is strangely highlighted. ... View more

hi, @anmolpatel  Configure a receiver using Splunk Web = ok Configure a receiver using the command line = "Failed to create. Configuration for port 9997 already exists." Configure a receiver using a configuration file= root@indexador1:......./splunk/etc/system/local# more inputs.conf [default] host = indexador1 ... View more

@niketn  Thank you. It worked for me with few changes as you suggested. ... View more

This was not 100% the solution but it indeed got me there 🙂 Thank you very much, sir. ... View more

Thanks Anmol,  I have gone through this page but the condition I am wanting is the OS Logs only like the users log in or out. The events created in syslogs etc. And I would be more interested with the flow of these logs towards deployment/Indexer. And here there is no mention about the installation on different Citrix (XenApp or Desktop)  I understood we can write script and Add-on available for xenapp and xendesktop too ? But any proper document where I can have a step by step process of getting this on my Live environment ? ... View more

@chaitali_1994  your MAX_TIMESTAMP_LOOKAHEAD value needs to be at least, 230.  The way that value works, is from the beginning of the event it will continue to validate the regex in TIME_PREFIX value.  In your example, <Apr 9 02:00:01>  <syslog- server name> <02: 00:01, 371>  ERROR [EventLogManager] Udated logs Successfully CEF:|<cefVersion>|<vendor>|<product>|<version>|<id>|<id desc>|<severity id>|start=Apr 09 2020 01:00:01 end=Apr 09 2020 01:00:01 The TIME_PREFIX = end= is 214, characters from the beginning of the string.  This is after you've anonymised the data.  So the value of 22 is not going to meet the criteria in any scenario.  The best way forward, is to copy some of the large event into a text editor or word and check how many character are there prior to the timestamp "end=<timestamp>" and set the MAX_TIMESTAMP_LOOKAHEAD value to the MAXIMUM value you get ... View more

@amerineni  this should provide the guidance on what you need | makeresults | eval _raw="HttpStatus, isValidError 200, false 200, false 201, false 305, true 202, false 400, true 500, true" | multikv forceheader=1 | rename COMMENT AS "CHECK THE CODE FROM HERE ON" | eval result = if(HttpStatus < 299, 1, 0) | eventstats count as TotalSuccessFailure by result | eventstats count as TotalEvents | eval percent = round((TotalSuccessFailure / TotalEvents) * 100,1) | rename COMMENT AS "CHECK THE CODE ABOVE HERE" | fields HttpStatus result TotalSuccessFailure TotalEvents percent   you can than take it further and just get the score by using stats | stats values(percent) by result   ... View more

@phanichintha here is an example of how it can be achieved using the transaction command. | makeresults | eval _raw = "time, userID, eventName 20/07/2020 09:00:00, 1, AM-LOGIN-COMPLETED 20/07/2020 09:01:00, 2, AM-LOGIN-COMPLETED 20/07/2020 09:10:00, 2, AM-LOGOUT 20/07/2020 09:06:00, 1, AM-LOGOUT 20/07/2020 09:00:00, 3, AM-LOGIN-COMPLETED 20/07/2020 10:06:00, 3, AM-LOGOUT" | multikv forceheader=1 | eval _time = strptime(time,"%d/%m/%Y %H:%M:%S") | transaction userID maxspan=1d | stats avg(duration) as AverageTimeSpentOnThePlatform   Here is the link to the command  https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction You can make it more robust by using the startswith and endwith arguments Hope this helps ... View more

Splunk can only help if you have the data available to filter. As someone else mentioned, winhostmon data will get OS data into Splunk. I use the Splunk Windows TA to get this data into Splunk. Then when I want to search on a specific class, I use a subsearch   index=main EventCode=4624 Logon_Type=2 [index=windows OS="Microsoft Windows 10*" | fields host]   That subsearch looks for all systems with a Windows 10 variant (enterprise, pro, etc) and effectively adds the hostnames as an 'OR' to your base search - basically it becomes   index=main EventCode=4624 Logon_Type=2 host1 OR host2 OR host3 OR host4     If you don't have OS data in Splunk, but need the data now, you may be able to get creative and use the host name if you have a good naming convention in place - that is, if you know all workstations are running Win 10 Pro, and all workstation names start with WKS, you could simply use something like this:   index=main host=wks* EventCode=4624 Logon_Type=2    That last example would just be a bandaid solution though - I wouldn't use that as a long term solution as naming conventions tend to change or systems are named improperly and then you have bad data.  ... View more

@delewis13 could you please paste your corresponding dashboard code? ... View more

thank you @anmolpatel and @to4kawa , I think you've helped me to understand this topic. The answer is fully and clearly documented with few words in the spec file: MV_ADD = [true|false] * NOTE: This setting is only valid for search-time field extractions. * Optional. Controls what the extractor does when it finds a field which already exists. * If set to true, the extractor makes the field a multivalued field and appends the newly found value, otherwise the newly found value is discarded. * Default: false I'll emphasize it for myself: If set to true, the extractor makes the field a multivalued field and appends the newly found value, otherwise the newly found value is discarded. It is a trap for somebody like me, coming from the programming background, where a value always can be overwritten. The splunk logic differs from the programming logic. In splunk universum, using transform, there are only two options for handling a situation 'what the extractor does when it finds a field which already exists': discard it create MV field if MV_ADD=true there is no option #3 ! And here is the point where REPORT is different from the EXTRACT - using extract you can overwrite fields: |makeresults | eval _raw="firstabc1 secondxyz1" | rex "first(?<a>\w+)" | rex "second(?<a>\w+)" I thank you guys, I'll accept both answers! ... View more

index=remedy source=srmwo ASGRP="Packaging" (Status=5 OR Status=4) | eval date=coalesce(Completed_Date,Actual_Start_Date) | table date Work_Order_ID | bin span=1d date | reverse | streamstats values(date) as range by Work_Order_ID | reverse | eval start=mvindex(range,0), end=mvindex(range,1) | streamstats current=f values(start) as start_p1 by Work_Order_ID | eval end=if(start=start_p1,null(),end) | eval timerange=if(isnull(end),start,mvrange(start,end,86400)) | fields Work_Order_ID timerange | mvexpand timerange | rename timerange as _time | table _time Work_Order_ID This query makes daily log by each Work_Order_ID. After this, let's aggregate what you want. ... View more

@itsmevic have you come across the Splunk Cloud Gateway. You can use this app and and setup Apple TV on your wall monitor. Refer to the below. Hope it helps https://docs.splunk.com/Documentation/Gateway/1.9.1/Installation/Installation https://docs.splunk.com/Documentation/TV/1.5.3/DisplayDashboards/DisplayDashboards ... View more

@rayar as per the doc for output command, it adds the _time field to the front. https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Outputcsv#Internal_fields_and_the_outputcsv_command if you want to have the strict order, here is a workaround: | rename cn1 as "Duration (sec)", FIRST_NAME as "First Name", LAST_NAME as "Last Name" | search "First Name"="" AND "Last Name"="" | eval time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields USER_ID duser "First Name" "Last Name" Duration "Duration (sec)" time | outputcsv vpn_data.csv ... View more

Thank you! ... View more