Hi all, I am trying to create a shell script periodically with crontab to run a Splunk search query, and if there are any results/events found in the search query, it will send an email alert with the crontab. I need some guidance on achieving that as right now, i am new to writing a bash script to run on Splunk. I am using Splunk Free with no alert functions. Any help will be appreciated! Thank you so much 🙂 ... View more

Hi, I am trying to migrate my current Splunk server to a new server and upgrade it as well. I have already done the following: 1. backup the $SPLUNK_HOME directory 2. installed a fresh new version of Splunk 7.0.1 in a new server (running 6.3.3 currently in current server) 3. transferred over current Splunk indexed data and configs $SPLUNK_HOME/var/lib/splunk/defaultdb and $SPLUNK_HOME/etc to the new server I am able to see the apps, however the search doesn't load at all and so does the other apps. I have a new hostname for the new server, could that be the case as to why all the apps doesn't load? Could anyone help me understand what are the files that needs to be edited in order to get all my indexed data and apps back? Thank you in advance! 🙂 ... View more

Hi, Was wondering that would i be able to use Splunk Enterprise to set-up monitoring of a honeypot activities, or would Splunk Enterprise Security be necessary for this deployment? I have also stumbled upon the Tango Honeypot Intelligence app, would greatly appreciate if anyone can provide any guidance to get started as I am still a newbie to Splunk. Thank you! ... View more

Hi, I have this file path source specified in the main index that i want to re-index everything collected into a new index that I have created. Problem: Switched over the indexing of new data from the main index to new index. But noticed that old data doesnt get indexed as Splunk dont do duplicate indexing. Tried doing bt probe to force reindexing which doesnt work which i proceeded to use the | delete command to remove all data from file path source in the new index. Great, it's all cleaned up. (should have made sure the bt probe had worked 😞 ) NO it was not. i foolishly went to use the one shot command in an attempt to re-index all data from old index to new index. Now when i do a search in the new index, i am seeing different results and event count as the old index. When the same query gets run on both indexes now, the results that came out is different. I attempted to run the | delete command again in the new index, however it returns with zero events being deleted. Now the new index has all the data but event count and search query are still different from the old index. I have some other event log source in the new index, so I am unable to just delete the whole index. Could i get some help on how i can just force delete all data from only the file path source in the new index? and from there can i reindex the exact same indexed data as the old index? I do not mind losing the indexing of new data in the time being. Thank you in advance! ... View more

Hi, I wanted to display in a form of a table the current logged in VPN users. my search command is this host="" user=* | stats count by user However, i do not want it to show the count and i want to see the time logged in as well, how can i improve my search to show that? I am new to Splunk and from what i understand, if I am using openvpn logs i should have the PF-sense app downloaded for the CIM compliant field extractions? I have downloaded the add-on to my Splunk but have problems understanding how i should be configuring the PF-sense app to support the field extractions for openvpn logs? Any help would be appreciated! Thank you! this is something that i would like: user | ip address | Connected Time user01 | 192.168.0.80 | 02:50:51 ... View more

Hi, I have installed the SplunkUniversalForwarder and ave sucessfully got data into Splunk. However, i want to view the scan logs from Windows Defender, how should i search it on the search head? Thanks in advance! ... View more