Hi All, One of our team mate, disabled and enabled some apps on SH, post which we are seeing Next Scheduled Time for all alerts is showing none for all the alerts in SH, in alert setting we can see that cron job is scheduled, due to which none of the alerts are triggering from our SH, can anyone suggest which setting or parameter to be checked , below screenshot FYR   ... View more

Hi Team, I Need to create an alert whenever a Linux Server shutdown and whenever a Linux server reboot, can you please help me with query condition, which parameter i need to search to get this alert implemented PS: We have RHEL,SUSE,Oracle Linux servers in our environment.     ... View more

Hi All,  We are getting DMC Alert - Near Critical Disk Usage on all our four indexers, we are running Splunk on distributed environment on AWS windows servers, and now due AWS disk space 16 TB limit, we are unable to extend the drive, can you please suggest suitable solution for this issue.     ... View more

Hi Team, I am using rtrim command to trim some values, but its not working for all the values,as per below screenshot i need to trim everything from _-D in all values, its working for first one for remaining values its not working, can anyone please provide some solution to it. Or in case of any regex please suggest   ... View more

Hi All, I need to create a Splunk License usage report on a daily basis for all the reporting hosts. Can someone please help me with creating search? Host Source Sourcetype Index count of events License Used in MB abc pqr xyz main 16405 27 bcd rrs yza wineventlog 123 20 cde rsp urv cisco 2345 105 ... View more

Hi All, Could we use Splunk to monitor the CPU health of Palo Alto Firewalls?, there is below add-on which is Present in Splunk Base https://splunkbase.splunk.com/app/3732/ but which is unofficial and not supported by Splunk, whether someone used this and got the desired result or can anyone suggest any other method from which we can monitor CPU health of Palo Alto Firewalls ... View more

Hi , We are building a new Splunk infrastructure in which daily 300 GB data will be ingested, we are running with 2 indexers in cluster, just want to know what would be the best index storage configuration in indexes.conf. Like hot,warm,cold storage configurations, i have gone through multiple Splunk documentation but its confusing. We want to save total of 1 year of logs on disk, in which we need 3 months logs online searchable, and remaining 9 months logs will be on disk(whether it can be compressed if yes then we want 3rd to 6th month logs will be in uncompressed form and from 9th Month to 12th Month logs to be compressed if possible), Can someone will help with suitable configuration, and what would be the disk space required to storage this logs ... View more

Hi Team, We have 300+ azure storage account and on daily basis new accounts will be created and deleted, its difficult to integrate each and every account one-one time, do we have any method through which we can integrate all this account in one shot, please suggest ... View more

Hi All, Can we translate our plain English queries to Search Processing Language i.e. SPL, does Splunk provide any free app or model apart from Security Insights Cyber Security investigator which is paid App. ... View more

Hi All, We are planning to move our Splunk environment 7.2.4 which is on Windows OS to CentOS, we are having distributed environment containing Indexers(2), search heads(2), master node, deployment server and license master, Could anyone can help us with migration steps and best practices to be followed, it will be helpful ... View more

I have DHCP logs and a csv which contains hostnames of devices.. I need to check the DHCP logs for the hostnames that are not present in the csv lookup list. Can you please suggest a query to perform this check without using subsearch? CSV has some 55K rows ... View more

We were using below script to connect and download csv and store it in folder. But now website has changed and it asks for the username and password. Can somebody suggests any required changes where we can connect to URL, Authenticate with username and password, and download the file? import os import urllib2 response = urllib2.urlopen('URL') data = response.read() filename = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', 'SPLAPP', 'lookups', "Splunk_Monitored_Hosts.csv") file_ = open(filename, 'w') file_.write(data) #file_.close() ... View more