If I create a role test_role which inherits from the can_delete role, it will show in configtracker - I created a test_role inheriting from can_delete. But if I now create a test2_role which inherits from test_role, the configtracker entry will only show that it inherits from test_role but it won't show the underlying inheritance from can_delete. ... View more

This works perfectly fine. ... View more

Is this better than calling the /health endpoint? Or was this answer written before that existed? IE: https://localhost:8088/services/collector/health ... View more

For AWS credentials if you have "+" in your secret key this api call won't work. The solution which I did is to create a new secret key that doesn't have a '+' special character in it. ... View more

i did this and it worked on my syslog files after importing them. but it doesnt work on live data (real-time). do you have a fix for that? ... View more

Does anyone know what needs added/changed in the show_source.xml file to raise this limit? My file doesn't have anything specifying any values at all. ... View more

Over 4 years later and this post still helped me solve my problem! Thank you! ... View more

Just to quickly leave a note here for anyone googling this: using INGEST_EVAL in transforms.conf and targeting _time with := to overwrite it, this makes it even better than EVAL-searchtime_things because the event will be saved with a correct timestamp, meaning you'll find your events where you expect. ... View more

With a search head cluster, you're going to have better scalability and high availability, with the added complexities of managing the cluster as it scales up or down as you've pointed out. I don't think you're missing anything there. A single instance would be easier to manage, and you could achieve some resiliency by running an ASG with a min/max of 1 instance. That way if the instance dies, the ASG will automatically replace it. Script the remount of your EBS splunk volume to make sure you still have your configs when the replacement instance comes online. In terms of scaling, increasing the instance size will work, it depends on how many active users and how many concurrent searches you plan on running. Its a totally reasonable solution, especially since you can pretty easily swap out instance types in AWS. ... View more

Have you looked at just using indexed_extractions? It's been available on the forwarder for several releases now and supports the IIS format (w3c). It is much simpler to implement than indexed extractions for a single field. https://docs.splunk.com/Documentation/Splunk/7.2.0/Data/Extractfieldsfromfileswithstructureddata ... View more

You can look for resource usage for every splunk servers under DMC in Resource Usage tab like CPU usage Memory Usage Disk Usage I/O operations I/O bandwidth utilization You can also look for resource_usage.log for _introspection index for a particular splunk server ... View more

@lguinn told us at Searching _fishbucket -- Splunk no longer lets you look at the fishbucket index. You cannot manage the specific records. The format is not published and the files are kept in binary. And it's from 2013 ; -) apparently it's not possible. ... View more

try saving as a report, enabling report acceleration, and then apply the report to your dashboard. ... View more

Please checkout new latest version of citrix netscaler add-on 6.3.0 It supports https connection https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/Configureinputs ... View more

we can't get the jobid to send a cancel request. but the auto cancel seems to be working. Thanks. ... View more

You can use JSON to configure multiple Sources in either of the following ways: Create a single JSON file with the configuration information for all the Sources (sources.json). Create individual JSON files, one for each Source, and then combine them in a single folder. You then configure the Source folder instead of the individual Sources. photo editor ... View more

You r putting only one index. You could put index=web logic OR index=another index ... View more

If your data in CloudWatch Log won't be too big, then it's fine to use the AWS Add-on CloudWatchLog mod input to collect it. Otherwise, we recommend you use Kinesis stream and the Kinesis mod input: http://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs You can use the AWS TA web UI to configure the CloudWatchLog input http://.../en-US/app/Splunk_TA_aws/inputs, the logGroup fields can be a list of log groups, such as /aws/lambda/s3table-chalice,/aws/lambda/ListBucketInfo,/aws/lambda/NoOp,/aws/lambda/GetBucketInfo,/aws/lambda/UpdateBucketInfo If you are using the distributed environment of Splunk Cloud with heavyweight forwarder to collect AWS data, then yes, pls raise a ticket. Otherwise, for single instance Splunk Cloud instance, you can use the web UI to configure the CloudWatchLog input by yourself. Hope it helps. ... View more

Jeremiah = Da Man! Your question about the URL path triggered the fix. I had the path on the target box set exactly the same as the URL in the Webhook trigger action I set in the scheduled search on the search head. So it was like this in both locations: http://mytargetbox.domain.com:4711/webhook-test When it should have been that in the trigger action on the search head's scheduled search and just /webhook-test on the target box. Once I made those changes everything flowed as it should have and I can search on the data. Much obliged for the help! ... View more

The first place to look is in in your _internal index at the ta_snow sourcetype. index=_internal sourcetype=ta_snow That will have the logs from the scripts that are collecting data from Service Now. You should be able to see if Splunk is able to connect or not, collect data, and also any errors that might be occurring. At this point you can follow up on the errors in the log. If you don't see those logs at all in Splunk, then take a look where you have deployed the Service Now TA to make sure that you are correctly forwarding data from that system and that the TA is enabled. ... View more

Hi Jeremiah We don't have anything built in to rate limit access. Using something like nginx would be a good option. ... View more

Thanks for your help The lookup file OUTPUT isn't a field in the csv (HOSTNAME and SERVER exist) but as we aren't using those values not sure why we are using it ? If dc(ACTIVE_USER) is used then no need to dedup right ? so i will remove that. So my search looks like so .. index="X" sourcetype="Y" DOMAIN=ACTIVE_USER | lookup host_lookup HOSTNAME OUTPUT SYSTEM | where ACTIVE_USER!="NO_USER" | timechart span=5m dc(ACTIVE_USER) as "Active User Count" | trendline sma5("Active User Count") AS Trend ... View more

Is the IP address what you see in the host field when you search your esxi log data? Thats the value you have to put into the hostname in [host::hostname]. You might want to consider just using a sourcetype instead, that way any esxi logs can be treated the same way. Try this: [host::hostname] LINE_BREAKER=(\v+)(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3} SHOULD_LINEMERGE=False TIME_FORMAT=%FT%H:%M:%S.%3N TIME_PREFIX=^ ... View more

Turns out it wasn't splunk that was bombing it. We created a new account just for the splunk ingest and lowered the intake down to once every 15 mins. I also did verify that they're all set to disabled as well. Thank you for your answer and we can close this out. ... View more