Thank You very much @VatsalJagani  I had to click on the version number (link), and there did open what I needed best regards Altin ... View more

It's a race condition between two threads trying to  create snapshot. The error is harmless as all it's indicating is that snapshot already exists( as other thread already created). ... View more

The overall difficulty of this whole exercise will depend on your logstash configuration and the use case - if you have just one sourcetype to ingest - maybe you can do it relatively reasonably. But if you want to send multiple sourcetypes over a single connection, that can be tricky to separate on the receiving side. You could send multiple sourcetypes using multiple tokens so they are received into separate indexes/with separate sourcetypes but it's getting complicated and - as I said before - needs proper configuration on the logstash side. Anyway - it's still up to logstash to filter events before sending. ... View more

thanks ... View more

Hi @VatsalJagani , I am not looking in any logs specifically because I need to create multiple Custom View and configure them with different Xpath queries.  So I am looking on an approach to monitor with WinEventLog these CustomViews. In the photo an example of CustomView is "Test" folder. But in the path C:\Windows\System32\winevt\Logs I could not find any reference to this "Test" CustomView. To recap: "Test" CustomView works fine in the EventViewer and it is updated live with the execution of my query. It contains all the events I am interested (not important which one). However I could not find any path connected to it, where the logs are stored and ready to be collected by a Splunk WinEventLog monitor. Thanks,   ... View more

That's correct because label has to be unique, in this case it will not generate unique label. I would suggest set the label as well with host field, because host name already tells you whether its QA or Prod or Dev.   I hope this helps!!! ... View more

Thanks @PickleRick  your last reply showed me what i was looking for. Data now rolls of after it get's to cold. Not able to search when it gets to cold. ... View more

Confirming this still works as of Splunk Cloud v9.0.2 ... View more

@karthi2809 - Dashboard filters values shows in the URL, so once you get right URL, that should work.   I hope this helps!!!! ... View more

Have you already seen this https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/gettingstartedpython ... View more

@marnall  - No external library. Splunk ships this Splunk Python module built in. ... View more

@kidderjc - I'm no Java expert based on my past experience with log4j to Splunk HEC. If Splunk fails for some reason your solution will encounter a memory issue and may crash. My Recommendation: Store logs to log files on the server and use Splunk UF to forward the logs to Splunk indexers.   I hope this helps!!! ... View more

@jasonpeh - Wait and try again. Try different browser. Are usually the solution to these temporary problems.   If not contact education@splunk.com and report the issue. Americas: education_amer@splunk.com  Europe: education_emea@splunk.com  Asia/Japan/Australia: education_apac@splunk.com    I hope this helps!!! ... View more

@newguy2024 - Try username, instead of email. Check your username on Splunk.com.   ... View more

Hi, @martynoconnor  solution worked for me.  Best Regards ... View more

Workaround? - Use Linux if possible.   ... View more

I finally tried this using a different index and it worked just fine. I'm thinking it's an issue with the Forwarded Events channel forwarding issue introduced in v9.1. Once we upgrade to v9.2, it should work just fine for EventID 4688. Again, thanks for the input! ... View more

Hi @spkriyaz , Could you please share the detailed step by step procedure to apply this solution?  ... View more

I know this is an old dead question ... but, the issue still exists! The problem is that in the "alert_actions_base.py" wrapper file that is put in TA/bin/ta_name/alert_actions_base.py has get_user_credential defined to wrap get_credential_by_username and does not provide a wrapper for by_account_id.  Adding the definition below for get_user_credential_by_account_id from the ./aob_py3/splunktaucclib/alert_actions_base.py into the TA/bin/ta_name/alert_actions_base.py solves the issue an allows an alert action to request credentials by account id. def get_user_credential_by_account_id(self, account_id): """ if the account_id exists, return { "username": username, "password": credential } """ return self.setup_util.get_credential_by_id(account_id) Would love to see this change integrated into the next release of the add on builder! ... View more

We're getting hammered by these. 20k in 24 hours. 🙂   ... View more

@victor_menezes can you expand a little more on this: AFAIK maxWarmDBCount doesn't affect the rollover of data (but it can be storage hungry so be careful with that), it is something the frozenTimePeriodInSecs do instead Yes, I am using maxTotalDataSizeMB in each of the indexes. They all have their specific size. ... View more

Hi @bhall_2 .. there are two forwarders - Splunk Universal forwarder(UF) and Splunk heavy forwarder(HF). (the old legacy forwarder is called as Splunk Light forwarder). maybe if you could update us more details about the requirement( more details about "you can control through biometics the flow of data" ), we can suggest you better. thanks   Best Regards Sekar ... View more

Unfortunately, at the moment Splunk cannot automatically extract the structured data if it's not the whole event (as in your case - the json part is preceeded by non-json header). There is an open idea for that https://ideas.splunk.com/ideas/EID-I-208 So far you can either parse the json part in search with help of the spath command as @VatsalJagani already showed or cut away the header part using SEDCMD or INGEST_EVAL (possibly extracting indexed fields if needed prior to removing the non-structured part). As a side note - you should _not_ use the _json sourcetype. Define your own ... View more

@avikc100  - You can add custom CSS to your simple XML dashboard to achieve this.   Dashboard XML Source Code   <form> <label>Fixed Column Sticky</label> <row depends="$tkn_never_show$"> <panel> <html> <style> #myTable table td:nth-child(1) { position: fixed !important; } #myTable table th:nth-child(1) { position: fixed !important; } </style> </html> </panel> </row> <row> <panel> <table id="myTable"> <search> ....     If position: fixed doesn't work, you can try with position: sticky;   I hope this helps!! If it does kindly upvote!!! ... View more