Hi @Kwip  yes, it would have the user name, the workstation name and the internal ip. For example, there is a workstation that is connected in vpn with a user, but the authenticated user in windows is different. This could characterize a vpn access share, that is, a user may be connecting on behalf of another user. Tks. ... View more

Ok, after compiling the indexes for the new partition, it is necessary to change the notes, the paths of the indexes in indexes.conf. I will try this. Thanks. ... View more

Perfect @soutamo  That is the suggestion I made as well. But to migrate to the new partition, I have doubts about the steps.Perfect. That is the suggestion I made as well. But to migrate to the new partition, I have doubts about the steps.   Thanks ... View more

```THIS IS A COMMENT``` ... View more

Perfect @isoutamo  That is the suggestion I made as well. But to migrate to the new partition, I have doubts about the steps.Perfect. That is the suggestion I made as well. But to migrate to the new partition, I have doubts about the steps.   Thanks ... View more

Hi @isoutamo  The issue is that the provisioned disk was made with Raid10, that is, it has 4 partitions of 1TB, but only available 2TB for / opt. [root @ Hostname] # lsblk NAME MAJ: MIN RM SIZE RO TYPE MOUNTPOINT nvme0n1 259: 5 0 50G 0 disk ├─nvxy0n1p1 259: 6 0 1M 0 part └─nvxy0n1p2 259: 7 0 50G 0 part / nvxy1n1 259: 0 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy2n1 259: 1 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy3n1 259: 2 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy4n1 259: 3 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy5n1 259: 4 0 40G 0 disk [root @ Hostname] # df -kh Filesystem Size Used Avail Use% Mounted on devtmpfs 7.6G 0 7.6G 0% / dev tmpfs 7.6G 0 7.6G 0% / dev / shm tmpfs 7.6G 377M 7.2G 5% / run tmpfs 7.6G 0 7.6G 0% / sys / fs / cgroup / dev / nvxy0n1p2 50G 3.0G 48G 6% / / dev / md0 2.0T 1.7T 162G 92% / opt tmpfs 1.6G 0 1.6G 0% / run / user / 1000   Thanks ... View more

Hi @isoutamo  The issue is that the provisioned disk was made with Raid10, that is, it has 4 partitions of 1TB, but only available 2TB for / opt. [root @ Hostname] # lsblk NAME MAJ: MIN RM SIZE RO TYPE MOUNTPOINT nvme0n1 259: 5 0 50G 0 disk ├─nvxy0n1p1 259: 6 0 1M 0 part └─nvxy0n1p2 259: 7 0 50G 0 part / nvxy1n1 259: 0 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy2n1 259: 1 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy3n1 259: 2 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy4n1 259: 3 0 1000G 0 disk └─md0 9: 0 0 2T 0 raid10 / opt nvxy5n1 259: 4 0 40G 0 disk [root @ Hostname] # df -kh Filesystem Size Used Avail Use% Mounted on devtmpfs 7.6G 0 7.6G 0% / dev tmpfs 7.6G 0 7.6G 0% / dev / shm tmpfs 7.6G 377M 7.2G 5% / run tmpfs 7.6G 0 7.6G 0% / sys / fs / cgroup / dev / nvxy0n1p2 50G 3.0G 48G 6% / / dev / md0 2.0T 1.7T 162G 92% / opt tmpfs 1.6G 0 1.6G 0% / run / user / 1000 ... View more

If you are running splunk in Release 8.1 Try this. `comment (" THIS IS A COMMENT ")` ... View more

I have a scenario, in which I have an indexer instance with 2TB in / opt, but it is 92% full. What is the most efficient and safe way to migrate the indexes to a new instance or a new partition? Thanks in advance. ... View more

Hello @to4kawa, I decided to do it just by calculating the total in seconds. index=vpn eventtype=cisco_vpn_end Username=* Group="*" | fillnull value=0 duration_day | multikv noheader=t | eval total_duration=duration_day * (86400) + duration_hour * 60 * 60 + duration_minute * 60 + duration_second | stats sum(total_duration) as Total_duration by Username Group | eventstats sum(total_duration) as Total_duration by Username duration_day duration_hour duration_minute duration_second | sort - Total_duration So I did another research with more details of the navigation, making a statistic by the time and user. index=vpn (eventtype=cisco_vpn_start OR eventtype=cisco_vpn_end) user=* | transaction user endswith="duration:" keepevicted=true | fillnull value=0 duration_day | eval full_duration = duration_day."d-" .duration_hour.":" .duration_minute.":".duration_second | eval bytesMB=round(((bytes/1024)/1024),2), bytes_inMB=round(((bytes_in/1024)/1024),2), bytes_outMB=round(((bytes_out/1024)/1024),2) | eval Start_time=strftime(_time,"%Y/%m/%d %H:%M:%S"), End_time=(strftime(_time + duration,"%Y/%m/%d %H:%M:%S")), Total_time=if(isnull(full_duration), Start_time." --> current session",Start_time." --> ".End_time) | mvexpand src | iplocation src | eval LocationIP=City.", ".Country | stats values(Total_time) as "Session Time" values(src) as "PublicIP" values(LocationIP) as LocationIP values(IP) as "Assigned IP" values(reason) as "Termination Reason" values(bytesMB) as bytesMB values(bytes_inMB) as bytes_inMB values(bytes_outMB) as bytes_outMB values(full_duration) as Duration by _time, user | sort -_time | search PublicIP=*   Thank you so much for your help, it was awesome. James \o/ ... View more

Hello @RickCurry  I have the same problem. Were you able to resolve the integration of Audit Vault logs with Splunk?   Thx. ... View more

Hi, @to4kawa, thanks for your response. But how to calculate the total time per user of the duration field, since this is a string type? For example, if in two events of the same user, the duration field has the values (0h: 47m: 42s and 0h: 18m: 46s) that total time would be (01h: 06m: 28s). It would be possible? Thx.       ... View more

I also had the same error after upgrading to version 8.0.2.1. However, the previous version was 6.3.0 and there was no upgrade to version 7.0.0 and then to 8.0.2.1. We had to downgrade to 7.0.0, then move up to 8.0.2.1, but the errors continued. web_service.log: 2020-03-24 17: 06: 04,514 ERROR [5e7a682c3a7fa117129950] root: 769 - Unable to start splunkweb 2020-03-24 17: 06: 04,514 ERROR [5e7a682c3a7fa117129950] root: 770 - invalid syntax (CustomRESTForSavedSearch.py, line 24) Traceback (most recent call last):   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py", line 132, in     from splunk.appserver.mrsparkle.controllers.top import TopController   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 27, in     from splunk.appserver.mrsparkle.controllers.admin import AdminController   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 25, in     from splunk.appserver.mrsparkle.controllers.appinstall import AppInstallController   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/appinstall.py", line 22, in     from splunk.appserver.mrsparkle.lib import module   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 465, in     moduleMapper = ModuleMapper ()   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 83, in init     self.installedModules = self.getInstalledModules ()   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 28, in helper     return f (* a, ** kw)   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 448, in getInstalledModules     mods = self.getModuleList (root)   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 37, in helper     return f (* a, ** kw)   File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 223, in getModuleList     mod = _import _ (modname)   File "/opt/splunk/etc/apps/sideview_utils/appserver/modules/CustomRESTForSavedSearch/CustomRESTForSavedSearch.py", line 24     except Exception, and:                     ^ SyntaxError: invalid syntax - splunkd.log: 03-24-2020 17: 35: 05.961 -0300 ERROR TailReader - File will not be read, is too small to match seekptr checksum (file = / opt / splunk / var / log / splunk / migration.log.2020-03- 24.17-05-51). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info. 03-24-2020 17: 35: 06.329 -0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk_deployment_monitor/bin/scripted_inputs/ftr_upgrade.py" Traceback (most recent call last): 03-24-2020 17: 35: 06.329 -0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk_deployment_monitor/bin/scripted_inputs/ftr_upgrade.py" File "/ opt / splunk / etc / apps / splunk_deployment_monitor /bin/scripted_inputs/ftr_upgrade.py ", line 27, in 03-24-2020 17: 35: 06.330 -0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk_deployment_monitor/bin/scripted_inputs/ftr_upgrade.py" build = int (server ['build']) 03-24-2020 17: 35: 06.330 -0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk_deployment_monitor/bin/scripted_inputs/ftr_upgrade.py" ValueError: invalid literal for int () with base 10: 'c8a78efdd40f' 03-24-2020 17: 35: 13.378 -0300 ERROR regexExtractionProcessor - REGEX field must be specified tranform_name = introspection_resource_usage_metric_name 03-24-2020 17: 47: 50.081 -0300 ERROR TcpInputProc - Error encountered for connection from src = 10.100.4.44: 54677. Local side shutting down 03-24-2020 17: 52: 02.502 -0300 ERROR LMStack - License should have extension of '.lic' or '.license', ignoring file 383994_82166_Autral_Reset_Splunk_030220.License 03-24-2020 17: 52: 02.954 -0300 ERROR MongodRunner - mongod exited abnormally (exit code 14, status: exited with code 14) - look at mongod.log to investigate. 03-24-2020 17: 52: 02.955 -0300 ERROR KVStoreBulletinBoardManager - KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log for details. 03-24-2020 17: 52: 02.955 -0300 ERROR KVStoreBulletinBoardManager - KV Store changed status to failed. KVStore process terminated. 03-24-2020 17: 52: 03.062 -0300 ERROR TcpInputProc - Could not bind to port IPv4 port 514 03-24-2020 17: 52: 03.062 -0300 ERROR TcpInputProc - Could not bind to port IPv4 port 520 03-24-2020 17: 52: 03.155 -0300 ERROR UDPInputProcessor - Error binding to socket in UDPInputProcessor: Permission denied 03-24-2020 17: 52: 03.156 -0300 ERROR FrameworkUtils What can be done now? Thank in advanced! ... View more

The indexer displays this message: INFO LicenseUsage - type = Message - License usage logging not available for slave licensing instances, please see license_usage.log on license master = https: //xxx.xxx.xxx.xxx: 8089 for usage breakdown ... View more

splunk is unable to index the internal license_usage.log logs. Does anyone have any ideas? Thanks in advanced! James ... View more

Oh my gosh! 50 HF? It is very very difficult! 😉 ... View more

Does the Heavy Forwarder have a Universal Forwarder client connection limit? How many UFs can communicate with the HF? Thanks, ... View more