About erikwie

erikwie · ‎01-19-2026

Hi @ibrahim1 I have set up a few Splunk installations that fits your design UF (Site B) → HF (also act as DS) (Site B) → HF (Site A) → Indexers I have them set up with the original license file on the site B HF, as far is it knows there isn't any License Master in the system and it would not have any issue with the license already been used somewhere else. I have also done this for Splunk Cloud customers using the 0-byte license, typically sending logs from another zone like DMZ inwards to a onsite Intermediate forwarder before sending it to the cloud. So both ways will work. In my experience there is no cost to the 0-byte license, but you need to have an active license in order to send a ticket to Splunk support.

erikwie · ‎01-21-2025

Maybe this will give you what you are looking for, use the stats to include all the fields, and if you dont want the count in the table add a fields command after like | fields - periodCount | stats count as periodCount by zbpIdentifier zbpIdentifier_bp periodCount importZeit_uF | sort -periodCount

erikwie · ‎01-21-2025

Are you sending the logs directly to Splunk Cloud or thru a Intermediate Forwarder? An app with props.conf and transforms.conf uploaded to Splunk Cloud is run on the Search Head. In my cases I had to install the app on the Intermediate Forwarder that sends on-prem logs to Splunk Cloud, when it worked as it had done before migrating to the cloud.

erikwie · ‎01-07-2022

The splunk instance with the indexer role is storing data. In a standalone architecture the single server is perfoming all the roles.

erikwie · ‎11-01-2021

@token2 wrote: A big part of getting my watch was the thought I could Splunk it... I'm not able to get the Garmin Add-On for Splunk to work either, same problem as the rest of you. But there is sort of a workaround. The Strava for Splunk app (https://splunkbase.splunk.com/app/4755) does work with Splunk, by connecting the Garmin account with the Strava Account to sync activities fra Garmin to Strava you can get it into Splunk. but ut will only give you the activites, if it's the daily summaries you want this won't do it.

erikwie · ‎02-10-2021

I got an issue with a few field alias on extracted fields from a json log This is done on a search head and done in the web gui props.conf reads [surcetype_name] FIELDALIAS-<class> = field_name1 ASNEW alias1 field_name2 ASNEW alias2 field_name3 ASNEW alias3 field_name4 ASNEW alias4 EXTRACT-<class> = regex string to get field_name1 EXTRACT-<class> = regex string to get field_name2 EXTRACT-<class> = regex string to get field_name3 EXTRACT-<class> = regex string to get field_name4 According to https://docs.splunk.com/Documentation/Splunk/7.3.3/Knowledge/Searchtimeoperationssequence As this is done in a searchhead the EXCTRACT-<class> is performed before FIELDALIAS-<class> But there is only one of the aliases that returns data, when I do a table with the field_name and alias side by side I see that the exctraction is done right and there is data, but the alias is blank. Anyone got a tip to what it can be that I got wrong here?

erikwie · ‎02-08-2021

Thank you, max_match did it.

erikwie · ‎02-08-2021

I got to extract some fields of a JSON log. Log buildup eksample: {"name":"cookie","Value":"Foo"} {"name":"cookie","Value":"Bar"} {"name":"cookie","Value":"Foobar"} The problem is that I got several loglines that all is called "cookie" but have different values, and I need to extract a mulitvalue field "cookie" with all the different values as a multivalue field. But not every logentry is like this, some is just one "cookie" entry. This is the regex string I'v used, but then the value of the "cookie" field only contains the first cookie record from the log. | rex field=_raw "\Sname\S{3}cookie\S{3}\w{5}\S{3}(?<h2_cookie>[\w\=\-\+\.\&\;\s]*)"

erikwie · ‎09-16-2020

egex isn't not my strong side, but this might help you | rex field=Message "Mutation of (?<value>\d+) bytes"

erikwie · ‎09-16-2020

Changing the %b (Abbreviated month name. (Jan, Feb, etc.)) to %m (Month as a decimal number. (01 to 12).) would give you 07-20, 08-20 and 09-20 instead. That way the sort would be in monthly order index=moogsoft_e2e | bin span=1mon _time | eval month_Year = strftime(_time,"%m-%y") | chart count over Class_Type by month_Year

erikwie · ‎12-13-2019

What sort of user activity are you trying to make a report on?

erikwie · ‎12-13-2019

This is the code that solved my needs for a list over users that have got the Password Last Change timestamp updated without changing the password. Found a way to get the information in a super easy way. On my single instance Splunk the search runs for 42 sec on a 60 day search index=winevents Account_Domain="YourDomain" ((EventCode=4738 Password_Last_Set!="<never>") OR EventCode=4723) | convert timeformat="%Y.%m.%d" ctime(_time) AS timestamp | eval Message=split(Message,".") | eval Short_Message=mvindex(Message,0) | eval Admin=mvindex(Account_Name,0) | eval User=mvindex(Account_Name,1) | transaction User maxspan=7d | search EventCode=4738 EventCode!=4723 Admin=_* Password_Last_Set!="-" | table timestamp EventCode Short_Message Admin User Keywords Password_Last_Set

erikwie · ‎12-12-2019

I can't tell if this solves it or not, I'm unable to run the search as it seems to time-out before completing. The last attemt has now been running for 4 hours. The splunk servicer is idling and the counter og events matched has not moved for atleast the last hour, still no errors from the search yet

erikwie · ‎12-10-2019

I need to get a list of all users that haven't changed password (Windows) in a set timespan. Timespan exceeds length of splunk logdata. I have made a search to give me usernames of all successfull logins, and another search giving me usernames of users that has changes passwords. But I can't figure out a way to compare the two results in a way that gives me a listing of all the usernames that is in the user login list, but not is in the user changes password list. Any suggestions to get this compare to work is much appreciated, If I'm way of on my search please enlighten me. This is the search I have so far. index=winevents (EventCode=4723 OR EventCode=4724) Keywords="Audit Success" | eval User=mvindex(Account_Name,1) | dedup User | search User!=$ | sort User | rename User AS User_PW | table User_PW | append [ search index=winevents EventCode=4648 Keywords="Audit Success" | eval User=mvindex(Account_Name,1) | dedup User | search User!=$ | sort User | rename User AS User_Login | table User_Login]

erikwie · ‎11-26-2019

We got several IIS servers and want to index IIS logs into Splunk. However, we need to seperate some of the servers to a seperate indexer due to different needs for Access controll and retention. Is there a way to get IIS logs from some servers to one index and logs from anorther server to another index? Using universal forwarders. running Splunk 7.2.6 , Windows 2012RS, single instance.

erikwie · ‎09-11-2019

I need to set up an splunk test environment to test out apps before adding them to production environment, also to test out adding new data into new indexes before adding it to production. We run an splunk enterprise 7.3.1, all in one single instance on a physical server. My plan for the test environment is to set up a standalone splunk installation with the free 500MB/day license and test the new stuff. Does any of you have any experience with something similar? Can I get the universal forwarder on a few servers to send data to two splunk servers, In the docs on the universal forwarder I understand that there is a support for loadbalancing between several indexers, but it seems like it will send to either and not both.

erikwie · ‎11-14-2017

Went to the Settings -> Access controlls -> Roles -> Admin (in this case) -> Indexes searched by default The only indexer there was main (only contains Active Directory data) so I addedd all non-internal indexes and all internal indexes Now it seems everything is working again as before. Thank you alot for the help.

erikwie · ‎11-13-2017

Thanks for the reply, My user account is in admin gruop. Adding index=* to the searches I'm testing with did give me results i was expecting. Not sure what you mean by "there was a change to some things on the indexes that would make migration take a lot longer than expected." I did upgrade on wendesday and the databases is somewhere around 500GB on disk, you think it's still migrating data? release note... Probably didn't read them that closly for the 7.0 upgrade. I'll go deeper into that to see if there is something I have missed, that can be related to this issue. Upgrade procedure was klick the installer and follow the instructions on screen. After backup affcourse. Splunk is running on a win 2012 R2 server. One standalone server for splunk. Not sure if that covers the architecture question.

erikwie · ‎11-13-2017

Upgraded from 6.1 to 7.0 and now none of my old searches gives any results i.e dashboard searces. As a Splunk rookie I have noe clue as where to start looking. When searching for * I get a few results, but only from active directory. A search for EventCode gives no results. Running splunk on a one-server setup, only collectiong windows event data. Anyone have a clue where to start?

Posts	19
Solutions	2
Karma Given	8
Karma Received	3
Member Since	‎11-13-2017

Online Status	Offline
Date Last Visited	‎02-01-2026 07:33 AM

Field alias on extracted fields not working on all...

Regex field extracting more than one field with sa...

compare result of two search results of usernames

Different IIS hosts logging to different indexes

Splunk test environment

Almost no search results after upgrading to 7.0.0

Re: HF licensing when License Manager is not reach...

Re: How to stats count and still have all fields a...

Re: Logs are showing raw, how do I get them to sho...

Re: can we store data on search head ???

Re: Garmin Add-On for Splunk Issue

Field alias on extracted fields not working on all...

Re: Regex field extracting more than one field wit...

Regex field extracting more than one field with sa...

Re: extracting a field from message

Re: monthly Chronology order.

Re: How can i make a report of users activity acti...

Re: compare result of two search results of userna...