Seeing the same issue, any solution? ... View more

What is the output you are getting with that search. Also that is for last day and not in last 60 minutes. If you want to check if user was infected in last 60 min, please change span to span=1m instead of span=1h and also change now() - (3600 * 24) to now() - 3600. Also share the result once you update. ... View more

@wtaylor149 Please try the search I posted, for you it would be. You can avoid sub-search by using below query.     index=av_logs sourcetype="av" "Risk_Action"="Virus found" earliest=-8d@d latest=now | bin span=1h _time|stats count by user Server_Name signature action _time| eval flag=if(_time>=now()-(3600*24), 1,0)|eventstats sum(flag) as flag by user| where flag > 0   ... View more

@wtaylor149 you can do something like, I am considering userswho had an infection in last 7 days and also in last 1 hour. This search needs to run over last 7 days, in case you want to run for users who had infection in last 7 days and today change the time calculation accordingly.   <your search> |bin span=1m _time|stats count by user _time| eval flag=if(_time>=now()-3600, 1,0)|eventstats sum(flag) as flag by user| where flag > 0   ... View more

Hi @lim2  The issue which I was seeing is when configuring Data inputs for Zoom on Splunk Heavy forwarder UI, it was creating passwords.conf file in the et/apps/search folder instead of Zoom app. After raising the ticket with Splunk, they provided with an updated python script to be used in the Zoom app instead of previous one. Post the update the issue related to file creation in search app was not there, but I am still getting 500 error from the Zoom web hook. This can be seen in marketplace.zoom.us under Webhook logs, it shows all the responses but with status code 500, so nothing gets ingested to Splunk. I have opened ticket with Zoom but haven't received any response. It does not seem to be a Splunk issue any more but may be a firewall issue or something not sure. I would suggest you to open support ticket with Splunk, and they can provide you updated python or look into your issue.     ... View more

@ohhhvictor Check your web.conf in system/local has httpport=8000 , also check your server.conf for sslConfig stanza and see if it has sslPassword or not. In past trying to remove sslPassword and restarting splunk has worked for me. ... View more

The only WARN message I see is "Socket error from while accessing /services/storage/passwords/..". There is no passwords.conf in this app folder although it gets created under search app, which I don't understand why. ... View more

Not sure about the query, if the field name is correct it should get the value in $result.sourcetype$ when you add this in the alert action title . Where are you passing this variable? ... View more

Try using in alert name $result.sourcetype$ ... View more

@rashi83 - In the distributed environment, you need to deploy this app on Search head as well along with the Heavy forwarder. May be this documentation will help https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf ... View more

@t874560 Use this search index="iptv_rdkb" [|inputlookup usersfile.csv] | fields _time Source device.make model userId | stats count by Source make model userId _time | eventstats max(_time) AS max min(_time) AS min by userId | eval max=strftime(max, "%Y/%m/%d %T.%3Q") | eval min=strftime(min, "%Y/%m/%d %T.%3Q") | stats earliest(min) as min earliest(max) as max first(make) as make first(model) as model first(userId) as user by userId ... View more

@burakatabay any update on this? I am having similar issue. ... View more

You can check Search Activity- Deployment - Indexers dashboard on monitoring console and see if there are some long running or real time searches running. Also sometimes when the disks are old the issue comes due to saturation and IOPS performance is slow. You can run some tests to check the IOPS for your indexers. >50% is high utilization . Also splunk support can help you confirm if its IOPS issue if no long running or real time searches are running. ... View more

Usually this problem occurs when there is disk IOPS performance issues. Also some long running searches can coz queues to get filled up as read operations may be blocking the input queue. Check the Monitoring Console -> Resource Usage Machine dashboard. If you see high IOPS bandwidth utilization , it indicated problem with IOPS. What is the current disk IOPS for the indexer having issues? ... View more

@habrhi - assuming A and B are your field names your query |eval newB=B| makemv delim="," newB| mvexpand newB| stats count(eval(LIKE(newB,"%s%"))) as c by A B ... View more

You can extract the name as below [sourcetype_X] EXTRACT-XYZ = username="(?<name>[^+\"]*)@" ... View more

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please. ... View more

Hi @suchi01 In the same documentation link you can change version to 6.6.3, it gives you alert.expire option to set the expiration. See below - Configure triggered alert expiration By default, each alert trigger record on the Triggered Alerts page expires after seven days. Here are steps for updating triggered alert expiration. These steps apply only to alerts with the "Add to Triggered Alerts" action enabled. From the top-level navigation bar, select Settings > Searches, reports, and alerts. Locate the alert that you want to modify under Search Name. Select Advanced Edit. Scroll down to alert.expires. Enter an integer and specify one of the following units: seconds (s), minutes (m), hours (h), days (d). For example, to set the alert to expire in 3 days, specify 3d. Click Save. ... View more

If the data is present on indexers , then there is no need of keeping the data on Heavy Forwarder. Please check if you are indexers are having same files after that you can delete these files on heavy forwarder. Also make sure your indexAndForward is not set to true any where on HF. May be start with deleting with few files that are least important to empty the space. ... View more

do you see indexed data in var/lib/splunk on HF? ... View more

@suchi01- This may be helpful from Splunk documentation https://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/Updatealerts Update triggered alert record lifespans By default, each triggered alert record on the Triggered Alerts page expires after 24 hours. You can update the lifespans for triggered alert records on a per-alert basis. Here are steps for updating the lifespans of the triggered alert records for a specific alert. These steps apply only to alerts that have the "Add to Triggered Alerts" action enabled. From the top-level navigation bar, select Settings > Searches, reports, and alerts. (Optional) Select Type > Alerts to filter the list so it displays only alerts. Locate the alert that you want to modify under Name. Select Edit > Edit Alert. Define the lifespan of the triggered alert record by setting the Expires field. Enter an integer and select a time unit from the dropdown. For example, to have all triggered alert records for this alert have a three-day lifespan, enter 3 and select day(s). Click Save. ... View more

If you got on the monitoring console -> Indexing-> Input-> Data Quality you can see the list of source type Sourcetype Total Issues Host Count Source Count Line Breaking Issues Timestamp Parsing Issues Aggregation Issues. You can click a row with highest count in Line Breaking Issues and you will get the detailed information in logs, similarly you can click on timestamp parsing issues count. ... View more