Hello Karthick, I don't personally use the ta-thehive-ce only the create_thehive_alert from my github link, still in prod. Main page is providing all the details to do the setup. It should allow you to make it work Regards ... View more

Hi, What is the Splunk version you are using? The current NSX-T Splunk App 2.4.1 only supports Splunk versions up to 7.2. For Splunk 7.3 and above, there is a known issue of dashboard not displayed. The problem will be fixed in the next NSX-T Splunk App release, and here is a temporary workaround: Go to Settings --> User Interface --> Navigation menus, select "NSX-T App for Splunk" from the App filter, and click on Nav name "default". Once you see the text box, update the XML from: <nav search_view="search" color="#65A637"> <view name="search" default='true' /> <view name="dashboards" /> </nav> to: <nav search_view="search" color="#65A637"> <view name="search" default='true' /> <a href="nsxt_logging_splunk_app_dashboard">NSX-T Dashboard</a> </nav> Then click "Save", and you should be able to see a "NSX-T Dashboard" tab next to "Search" in the NSX-T app. Hope this helps. ... View more

@mcbradfordwcb Please share _raw event in the code block. ... View more

here is a decent debate and some tips around _indextime https://answers.splunk.com/answers/678655/how-to-trigger-alerts-when-indextime-time-1.html ... View more

If you want all the data in the file to be a single event, you can probably do that better with LINE_BREAKER Try this in props.conf [yoursourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=((thismustneverappearinyourfile)) TRUNCATE=0 I don't think that you need to set MAX_EVENTS at all when using this method. But feel free to add in MAX_EVENTS as well... This technique works by using LINE_BREAKER to define the split between events - and then assigning an "impossible" character string as the line-breaking condition. ... View more

Try ... | rex field=manager "CN=(?<CN>[^,]+)" | ... ... View more

I don't think you need the proccessor time filter in your base search. Let your stats worry about the calculation. for similar requests, we've typically used min(). If the minimum over a period is greater than your threshold, then it was above your threshold the whole time. The avg() could be above the threshold even if it's dipping/spiking over that period. ... View more