Hello dhuynh, there are a few possible reasons this could be happening. First, please check for payload character set issues (such as non UTF-8 characters, which can cause JSON to break. Also, check the splunk logs for errors. You can find HEC parsing errors in the _introspection index.  ... View more

Could some of those IPs internal IPs (like a 192.168.x.x network), or otherwise not resolvable? For the IPs that dont resolve, spot check some from a command prompt using nslookup <ip> ... View more

Hello, looks like this is not the first time. going way back... https://community.splunk.com/t5/Installation/Why-am-I-getting-an-installation-failure-for-Splunk-6-2-2-6-2-3/m-p/220838   ... View more

So long as you're not doing performance testing you may consider running splunk using docker.  Ive been able to spin up 3-node index clusters with an ITSI Search head, on an 8-core i9, 32GB (w/1TB SSD) macbook laptop, even running ITSI and another container running oracle. if you have a few machines, you'd be pretty set. again, so long as you're not doing real load testing, you can spin up an environment in a few seconds, and test your apps and inputs. https://docs.splunk.com/Documentation/Splunk/9.0.3/Installation/DeployandrunSplunkEnterpriseinsideDockercontainers Just be aware, the free version of splunk does not support clustering or premium splunk apps. ... View more

this may be a bit 'hacky', but if you want the actual value (the count) instead of the percentage, as part of the label on each slice, you could do something like this: index="test" sourcetype=csv | chart count by status |eval status=status." ".count ... View more

Hello, so are you looking to output a table of host and index to show what hosts are in each index? If so, try this: |tstats count where index=* by host index|fields - count ... View more

Are you looking for log_start_date? See here in the example (which has it under setting up from the UI, though can should be able to do it directly when editing the .conf files too) https://docs.splunk.com/Documentation/AddOns/released/AWS/S3#Configure_a_Generic_S3_input_using_configuration_files ... View more

can you elaborate on the "what i have to do is use a span that is equal to the time range picker."? The picker will provide a earliest and latest for the entire search to look over, where the span is duration to take each avg over. So if you search all of yesterday, then a reasonable span might be 15min for example (meaning show the avg every 15min for all of yesterday). so having a span that is equal to the time range is simple taking a single avg over the entire time, which you'd do with stats instead of timechart. ... View more

You can also add | fields - count to Richard's tstats, to be left with just the host field. ... View more

Oracle published a document back in 2015 for collecting data from their ZFS storage appliance using Splunk:  https://www.oracle.com/technetwork/server-storage/sun-unified-storage/documentation/splunk-logging-zfssa-2516546.pdf   This should still be relavent, and they may have an updated one too. ... View more

try this: index=_internal source=*python.log sendemail ... View more

since its an older version of dbx, you can try to add something like this to the connection string in the dbx jvm parameter settings:  -Duser.timezone=GMT   just be aware this would apply to all connections. ... View more

Hi Altink,   are you able to modify the SQL query to change the TIMESTAMP field? Here is a solution (using Oracle, but same premise): https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-time-in-Splunk-DB-Connect-and-the-Add-on-for/m-p/399225 Also, if thats the only connection you are using, you can also change the timezone at the jvm level, as it uses its own separate from the OS (unless they've been synced, but I usually see them using their own) ... View more

Actually, from the docs, this is now the method, when creating the database connection: https://docs.splunk.com/Documentation/DBX/3.10.0/DeployDBX/Createandmanagedatabaseconnections#Create_a_database_connection see the part re Timezone: ... View more

you can add a TZ setting to the props.conf in db connect for that sourcetype. ... View more

If you have outbound mail setup you can use |sendmail after the outputlookup. This this works for me, and Im able to receive csv files attached that were produced by the outputlookup: mysearch | outputlookup mylookup.csv | sendmail to="abc@xyz.com" sendcsv=true See these docs: https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Sendemail https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail   ... View more

Hello, Just an idea, but maybe if you are using data models and the CIM, consider scheduling tstats searches against the data models, to count for example, the number of Authentication failures by host over the last 5 minutes.  Then you wont care the source or sourcetype, or host. So long as its in the datamodel (likely via the CIM). Something like this, where it looks for the number of failed authentications per host, over the last 5 minutes...     | tstats count from datamodel=Authentication where Authentication.action=failure earliest=-5m@m by _time Authentication.src |stats sum(count) by Authentication.src     Schedule this every 5min, as it looks back 5 minutes within the datamodel (adjust the duration depending on you acceleration times/etc). Then you'll get a decent number you can alert off of, and it will give you the  src (host) having the increase of Authentication failures for you to go investigate.  It wont matter what the Authentication source is (dns, remote login, ssh, ftp, etc, etc) so long as it's in the datamodel, you'll get an alert. Just an idea.   ... View more

Hello, please have a look at the timewrap command. https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Timewrap?ref=hk This may be what youre looking for. ... View more

This MS doc shows their API limits https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-quotas   ... View more

I didnt see the error posted, but long file paths over 255 characters may cause snapshot creation failures, as the OS may not be able to write them. ... View more

this may be what youre looking for: https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_whitelist_and_blacklist   ... View more

Have a look at this addon: https://splunkbase.splunk.com/app/4107 basically, send ubiquiti data via syslog to a syslog server, where you can have a Splunk UF monitor it and send to the cloud.   ... View more

Have a look at this: https://splunkbase.splunk.com/app/1317 and this older post: https://community.splunk.com/t5/All-Apps-and-Add-ons/AMQP-Messaging-Modular-Input-How-do-we-configure-a-RabbitMQ/td-p/219123   ... View more