Hello I'm trying to run a rex command to extract "is set to expire" Relying party trust 'ButterCup Games - Test' xxxxx: Signing certificate with thumbprint '1111111111111111111111' is set to expire on 2/13/2020 6:59:59 PM. ... View more

I noticed the Splunk Add-on for Microsoft Hyper-V inputs.conf has no index configuration. I have it installed on my universal forwarders but it's putting the entries in the main index. Nothing in the install or configuration docs mentioned anything about an index name ... View more

Does any one have an install and or configuration step for getting GuardDuty Add-on setup in Splunk ... View more

Is there a process to clean up $splunk_home/var/run/searchpeers directory on my indexers? I see *.delta files there from 2 years ago. ... View more

Trying to find the time duration between 2 fields Field name : START_TS 2017-08-16 04:07:00.0 Field name : END_TS 2017-08-16 04:12:00.0 I tried something like.... my search query | eval Starttime=strftime(START_TS,"%y-%m-%d %H:%M:%S:%N") | eval Endtime=strftime(END_TS,"%y-%m-%d %H:%M:%S:%N") |eval duration = Endtime - Starttime But it didn't work. ... View more

I'm having an issue using the rising inputs . I have something like this.... select A.DOCUMENT_ID, A.USER_NAME, P.INF_GROUP_ID, D.DOCUMENT_DESC, DV.DOCUMENT_TYPE, A.TIMESTAMP AS timestamp, A.MESSAGE AS message, where rising_column > ? and a.document_id = d.document_id and d.document_id = dv.document_id order by rising_column ASC But the issue now is I can't select anything in the Rising column. When I select the rising column drop down it shows no matches. ... View more

The following searches work : | tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_free) AS swap_free FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" | tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap) AS swap FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" This doesn’t work | tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" But via the pivot on the datamodel, I do see metrics from "All_Performance.Memory.swap_used". Any reason why my search returns nothing for | tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" ... View more

So let’s say I have 2 or 3 indexers and I configure the coldToFrozenDir in the indexes.conf… [default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive" Do you do this on each of the indexers or should I do something like this Indexer1 [default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_1" Indexer2 [default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_2" Indexer3 [default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_3" I wasn’t sure if the indexer data files would step on each other if I send all the data using coldToFrozenDir option to the same path. i.e "myAmason_server_mount/myfrozenarchive" ... View more

I'm on Splunk 6.3.3 in my drop down for results per page, my available options are 10 per page, 20 per page and 50 per page. Is there some setting somewhere I can bump this up to 200 per page or 100 per page. Thanks ... View more

I’m trying to setup our Splunk DMC . I’m going through the setup instructions on the Splunk web site. I noticed 2 confusing instructions. http://docs.splunk.com/Documentation/Splunk/6.3.3/DMC/Setclusterlabels On this url, the instruction is to run splunk edit shcluster-config -shcluster_label on any of search head cluster member . http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/SHCconfigurationoverview On this url , the instruction is to run splunk edit shcluster-config -shcluster_label on each member of the search head cluster. So should this command be executed on any of the search head cluster members or on each of the SHC members. Thanks ... View more

I'm trying to mask SSN using the SEDCMD command, but it isn't working. My search: sourcetype = my_source_type *SSN returns 'Call_SSN' '123456789' 'Ssn_bla' '987654321' 'bla_SSN' '123456789' I updated the system/local/props.conf [my_source_type] SEDCMD-ssncall = s/=\d{5}(\d{4})/*SSN xxxxx\1/g But it's not masking it. ... View more