Seeing the same issue, any solution? ... View more

What is the output you are getting with that search. Also that is for last day and not in last 60 minutes. If you want to check if user was infected in last 60 min, please change span to span=1m instead of span=1h and also change now() - (3600 * 24) to now() - 3600. Also share the result once you update. ... View more

@wtaylor149 Please try the search I posted, for you it would be. You can avoid sub-search by using below query.     index=av_logs sourcetype="av" "Risk_Action"="Virus found" earliest=-8d@d latest=now | bin span=1h _time|stats count by user Server_Name signature action _time| eval flag=if(_time>=now()-(3600*24), 1,0)|eventstats sum(flag) as flag by user| where flag > 0   ... View more

@wtaylor149 you can do something like, I am considering userswho had an infection in last 7 days and also in last 1 hour. This search needs to run over last 7 days, in case you want to run for users who had infection in last 7 days and today change the time calculation accordingly.   <your search> |bin span=1m _time|stats count by user _time| eval flag=if(_time>=now()-3600, 1,0)|eventstats sum(flag) as flag by user| where flag > 0   ... View more

Hi @lim2  The issue which I was seeing is when configuring Data inputs for Zoom on Splunk Heavy forwarder UI, it was creating passwords.conf file in the et/apps/search folder instead of Zoom app. After raising the ticket with Splunk, they provided with an updated python script to be used in the Zoom app instead of previous one. Post the update the issue related to file creation in search app was not there, but I am still getting 500 error from the Zoom web hook. This can be seen in marketplace.zoom.us under Webhook logs, it shows all the responses but with status code 500, so nothing gets ingested to Splunk. I have opened ticket with Zoom but haven't received any response. It does not seem to be a Splunk issue any more but may be a firewall issue or something not sure. I would suggest you to open support ticket with Splunk, and they can provide you updated python or look into your issue.     ... View more

@ohhhvictor Check your web.conf in system/local has httpport=8000 , also check your server.conf for sslConfig stanza and see if it has sslPassword or not. In past trying to remove sslPassword and restarting splunk has worked for me. ... View more

The only WARN message I see is "Socket error from while accessing /services/storage/passwords/..". There is no passwords.conf in this app folder although it gets created under search app, which I don't understand why. ... View more

Not sure about the query, if the field name is correct it should get the value in $result.sourcetype$ when you add this in the alert action title . Where are you passing this variable? ... View more

Try using in alert name $result.sourcetype$ ... View more

@rashi83 - In the distributed environment, you need to deploy this app on Search head as well along with the Heavy forwarder. May be this documentation will help https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf ... View more

@t874560 Use this search index="iptv_rdkb" [|inputlookup usersfile.csv] | fields _time Source device.make model userId | stats count by Source make model userId _time | eventstats max(_time) AS max min(_time) AS min by userId | eval max=strftime(max, "%Y/%m/%d %T.%3Q") | eval min=strftime(min, "%Y/%m/%d %T.%3Q") | stats earliest(min) as min earliest(max) as max first(make) as make first(model) as model first(userId) as user by userId ... View more

@burakatabay any update on this? I am having similar issue. ... View more

You can check Search Activity- Deployment - Indexers dashboard on monitoring console and see if there are some long running or real time searches running. Also sometimes when the disks are old the issue comes due to saturation and IOPS performance is slow. You can run some tests to check the IOPS for your indexers. >50% is high utilization . Also splunk support can help you confirm if its IOPS issue if no long running or real time searches are running. ... View more

Usually this problem occurs when there is disk IOPS performance issues. Also some long running searches can coz queues to get filled up as read operations may be blocking the input queue. Check the Monitoring Console -> Resource Usage Machine dashboard. If you see high IOPS bandwidth utilization , it indicated problem with IOPS. What is the current disk IOPS for the indexer having issues? ... View more

@habrhi - assuming A and B are your field names your query |eval newB=B| makemv delim="," newB| mvexpand newB| stats count(eval(LIKE(newB,"%s%"))) as c by A B ... View more

You can extract the name as below [sourcetype_X] EXTRACT-XYZ = username="(?<name>[^+\"]*)@" ... View more

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please. ... View more