Correct. https://docs.splunk.com/Documentation/Splunk/7.3.1/Troubleshooting/CommandlinetoolsforusewithSupport#check-rawdata-format check-rawdata-format Unpacks and verifies the 'rawdata' component one or more buckets. 'rawdata' is the record of truth from which Splunk software can rebuild the other components of a bucket. This tool can be useful if you are worried or believe there may be data integrity problems in a set of buckets or index. Also you can use it to check for journal integrity prior to issuing a rebuild, if you wish to know whether the rebuild can complete successfully before running it. If the journal.gz get corrupted, the bucket can't be recovered. It's my understanding that dbinspect does not look at or into the journal.gz. ... View more

Add the by api which will give you an average per API. If you want to aggregate those per run: | eventstats avg(time) AS avgRespTime by api | where time>avgRespTime | stats count as count, avg(time) as avgRespTime, by api The eventstats calculates the avg(time) by API and adds it to each event. The where filters on only those events were the avg was exceeded The final stats line, is to aggregate whatever statistics are needed from the sessions that exceeded the threshold. ... View more

I think you are want to use eventstats: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Eventstats ..... | eventstats avg(time) AS avgRespTime by api | where time>avgRespTime This will calculate the average response time across events, and trigger when that average is exceeded. ... View more

You can do the same in Splunk by creating a lookup table that contains all the HTTP code you are interested in. index=whatever "HTTP/1.1" | stats count by status_code | inputlookup YourLookupFile | stats sum(count) as count by status_code | fillnull value=0 count The end results, will be a list of all status_codes with their counts, code with no count will show 0 ... View more

Something like: https://docs.splunk.com/Documentation/Splunk/7.3.1/InheritedDeployment/Deploymenttopology ... View more

| search qualifiedSearch=lookupname eai:acl.app=$YOUR_APP$ ... View more

If the uniqueIDs are only unique per src/dest, and since you are only calculating your stats on the totalExecTime, which only occurs when the session end. I recommend: source=xxxxxxx "com.pqr.MyOwnClass" (taskbegin OR taskEnd) | stats sum(totalExecMin) as sumTotalExecMin, avg(totalExecMin) as avgTotalExecMin, values(src) as src, values(dst) as dst, by uniqueID | stats count avg(avgTotalExecMin) sum(sumTotalExecMin) by src dest | eval sumTotalExecMin=round(sumTotalExecTime/60000,1), avgTotalExecMin=round(avgTotalExecMin/60000,1) This will calculate the sum and avg for all sessions tied to a uniqueID. You then aggregate those based on the src and dst. ... View more

source=xxxxxxx "com.pqr.MyOwnClass" (taskbegin OR taskEnd) | eval totalExecMin=round(totalExecTime/60000,1) | stats sum(totalExecMin) as totalExecMin, values(src) as src, values(dst) as dst, min(_time) as start, max(_time) as End , by uniqueID | stats count avg(totalExecMin) sum(totalExecMin) by src dest The first stats joins the two events based on the ID, the second run stats across joined events. Or instead of the second stats line you could then charrt of timechart based on the start or end times ... View more

can users create private extractions and only admin can make them global This is exactly how it works. As long as the users do not have write access to the apps, they will only be able to create private objects. ... View more

The threat feeds configured via threat intelligence download in ES are put into kvstores, like service_intel, file_intel, ip_intel, etc.. You can view the data in them: | inputlookup ip_intel For more detail, Enterprise Security -> Security Intelligence -> Threat Intelligence -> Threat Artifacts. use the "open in search" icon to open the "threat overview" panel in search mode to see the search syntax and where that data is pulled from. ... View more

It would depends. ThreatConnect, when using the Add-on, stored its data in kvstores, iSight used an index. ... View more

Yes, you would need two things: A DNS entry for your vanity hostname Something to redirect users from 443 to 8000, you could use iptables if you're on linux ... View more

| dbinspect index=yourindex It will show the startEpoch and endEpoch for each bucket, among other things. https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Dbinspect If you want to drill into the events in a specific bucket: index=yourindex | where _bkt="summary~22~4F582768-7B38-4768-95EA-EC3D491A8A23" Where _bkt matches the bucketId from dbinspect results. https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Usedefaultfields ... View more

Buckets get rolled based on the youngest event in the bucket. Buckets can span minutes, hours, days, etc.. depending on how much data is received into the index and your index configuration. Additionally, if you turn up a new datasource and its starts reading in old logs. Those old events will now be mixed with your new events. Finally, if the clock settings on the systems are incorrect...this can lead to events getting old or future dates. Long story short, when old events get mixed in a bucket with newer events, the old events have to wait till ALL events in the bucket age out. ... View more

So, if Bob is logged into Splunk, you want all correlation searches to pass Bob as the username to the adaptive response? I don't know of any way to accomplish that. | rest /services/authentication/current-context splunk_server=local Should only return the context of the user who ran the search, so if you added this to the correlation search I'd be interested to see what it returns for the scheduler. Since the schedule is running its searches under its own user context. Even if in your script example using environment variables, the environment variable would be based on the user who is running the script, it would not have information about other users on the system. Which is really the challenge . If only one user is logged in at a time, then you could look for all users who have active logins: | rest /services/authentication/httpauth-tokens splunk_server=local | fields userName After excluding all the system userNames, assuming the correlation search has access to the rest endpoint, and that only one user is logged in....this would give you the username of a user logged into Splunk at the time the correlation search ran. ... View more

As I understand the question, you want the adaptive response to pass the name of the user who ran the search? Based on the following, you should be able to use job tokens in your adaptive response: https://docs.splunk.com/Documentation/SplunkCloud/latest/AdvancedDev/ModAlertsLog Based on the following, the property $job.delegate$ should contain the name of the user who ran the search: https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/ViewsearchjobpropertieswiththeJobInspector#Search_job_properties By default, the job.delegate value will be the scheduler. ... View more

We currently point our load-balancers at: https://{hostname}/en-US/debug/sso Though, you could also use: https://{hostname}/en-US/debug/echo Make sure to enable it in web.conf: enableWebDebug = true ... View more

There should be no issues with an empty "next steps" So, after adding the mail as an adaptive response your alert_actions field is still empty. Are you getting emails? ... View more

Did you add the notable as an adaptive response to the correlation search? Check the _internal logs for the search id (sid), and check for errors? ... View more

Do you see a SavedSplunker event for the search running? If results>1 and suppress<1 then the event should show alert_actions="notable" If it shows notable, then you need to figure out why your search head is not forwarding the notable events to your indexing tier. If it doesn't show notable, you'll need to troubleshoot that. ... View more