I am working on time series data and would like to detect these type of trough's in the graphs.   The y axis is network bandwidth and minimum value is 0. I'm applying the base query time series to a DensityProbability model then with the following SPL for the Outlier chart:     | eval leftRange=mvindex(BoundaryRanges,0) | eval rightRange=mvindex(BoundaryRanges,1) | rex field=leftRange "Infinity:(?<lowerBound>[^:]*):" | rex field=rightRange "(?<upperBound>[^:]*):Infinity" | fields _time, 1/1/g1, lowerBound, upperBound, "IsOutlier(1/1/g1)", *     What approach can I take to detect the significant dip in the graph? ... View more

We would like to keep a copy of the log files before they get indexed for long term retention which gets downloaded via the API. inputs.conf [scwss-poll] interval = 3600 sourcetype = symantec:websecurityservice:scwss-poll [batch://$SPLUNK_HOME/var/spool/splunk/...stash_ta_scwss_logs.zip] sourcetype = symantec:websecurityservice:scwss-poll move_policy = sinkhole [batch://$SPLUNK_HOME\var\spool\splunk\...stash_ta_scwss_logs.zip] sourcetype = symantec:websecurityservice:scwss-poll move_policy = sinkhole Maybe something like this? [scwss-poll] interval = 3600 sourcetype = symantec:websecurityservice:scwss-poll [monitor://$SPLUNK_HOME/var/spool/splunk/...stash_ta_scwss_logs.zip] sourcetype = symantec:websecurityservice:scwss-poll [monitor://$SPLUNK_HOME\var\spool\splunk\...stash_ta_scwss_logs.zip] sourcetype = symantec:websecurityservice:scwss-poll ... View more

I have some data in the following format which does not split correctly. The events get indexed as one event. sample data {"date": "5/8/2020", "time": "7:57:47 AM", "client": "187.45.18.205", "flags": "A", "query": "v1.addthisedge.com"}{"date": "5/8/2020", "time": "7:57:47 AM", "client": "188.35.138.205", "flags": "A", "query": "m.addthis.com"}{"date": "5/8/2020", "time": "7:57:47 AM", "client": "186.95.16.121", "flags": "A", "query": "cloud.acrobat.com"} props.conf [monitor:///data/dns/*/*/*/*.json.log] INDEXED_EXTRACTIONS = json KV_MODE = none ... View more

I have been following this example (https://answers.splunk.com/answers/683820/why-is-the-custom-alert-script-failing-with-sendal.html) and encountered an error in the showconfiguration.py script. import pprint, json, sys if __name__ == "__main__": if len(sys.argv) > 1 and sys.argv[1] = "--execute": f.open("/tmp/splunktest.txt", "w") f.write("Here's the info we get from splunk:") f.write(pprint.pprint(json.loads(sys.stdin.read()))) f.close() Errors in log: 04-02-2020 07:30:11.193 +0000 WARN sendmodalert - action=showconfiguration - Alert action script returned error code=1 04-02-2020 07:30:11.193 +0000 INFO sendmodalert - action=showconfiguration - Alert action script completed in duration=11 ms with exit code=1 04-02-2020 07:30:11.191 +0000 ERROR sendmodalert - action=showconfiguration STDERR - SyntaxError: invalid syntax 04-02-2020 07:30:11.191 +0000 ERROR sendmodalert - action=showconfiguration STDERR - ^ 04-02-2020 07:30:11.191 +0000 ERROR sendmodalert - action=showconfiguration STDERR - if len(sys.argv) > 1 and sys.argv[1] = "--execute": 04-02-2020 07:30:11.191 +0000 ERROR sendmodalert - action=showconfiguration STDERR - File "/opt/splunk/etc/apps/showconfiguration/bin/showconfiguration.py", line 4 host = 6c83f2e55cd4source = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd ... View more

We are currently the implication command to external IP addresses and it works great. Is it possible to create a custom iplocation type lookup for sets of internal/corp IP ranges that we define too lookup cities and countries? ... View more

We have installed the TA for Symantec Endpoint Protection (syslog) (https://splunkbase.splunk.com/app/3121/) and noticed upon restarting splunkd, we get the following error: Bad regex value: '(?:[[sep_file_preifx]])\s*(?<Server_Name>[[sep_file_field]])\s*(?<Domain>[[sep_file_field]]),\s*(?<Server_Name>[[sep_file_field]]),\s*(?<Event_Description>[[sep_file_field]])', of param: transforms.conf / [field_extraction_for_scm_system] / REGEX; why: two named subpatterns have the same name One or more regexes in your configuration are not valid. For details, please see btool.log or directly above. Done This is on 6.3.5. ... View more

Hello, After we upgraded Splunk to 6.3.5, our TA-juniper started producing a bad regex error: btool.log Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: in valid range in character class transforms.conf [dvc_for_junos_fw] REGEX = \s+([.-\w]+)\s+RT_FLOW FORMAT = dvc::$1 Could someone please shed some light on this? Thanks. ... View more