Hi @ckarthikin , sorry but the issue is at ingestion level: you have to assign a correctly defined sourcetype (standard or custom) to your data, then you can search your data correctly parsed and aggregated. so the questions are the ones before: which technology? which add-on used for parsing? if none, you have to create a correct sourcetype and apply it to your data source. Ciao. Giuseppe ... View more

Hi @Karthikeya , I could be more detailed, if you can share the full event, anyway, you have to create a regex like the following:   | rex "host: (?<host>[^\s\n]+)"   Ciao. Giuseppe ... View more

Hi @splunklearner . could you share the two main searches in the two dashboards? Ciao. Giuseppe ... View more

Hi @Hemant_h , if the structure of your events is fixed, you coult try something like this: | rex field=product_name "^(?<field1>\w+)\s[^\s]+\s[^\s]+\s[^\s]+\s[^\s]+\s(?<field2>[^ ]+)"  Ciao. Giuseppe ... View more

Hi @ckarthikin , where do your logs come from? which technology? did you used a standard add-on or not? it seems to be a parsing error. youshould try adding to your sourcetype SHOULD_LINEMERGE = True, in this way you configure a multiline sourcetype. Ciao. Giuseppe   ... View more

Hi @dmoberg , for my knowledge, this is the only solution, no automatic. Ciao. Giuseppe ... View more

Hi @dmoberg , see if this my old answer solves your requirement: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-clear-reset-the-value-of-a-token/td-p/601208 Ciao. Giuseppe   ... View more

Hi @erick4x4 , Splunk, by default, doesn't index twice the same logs, so, if this file is always the same or it has the same first 256 chars, it isn't read. For more infos see at https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Inputsconf searhcing for crcSalt. Anyway, you could use a larger initCrcLenght parameter to check more than the first 256 chars, or write the file with a different name (e.g. including date and/or time) and using crcSalt = <SOURCE> parameter. Ciao. Giuseppe ... View more

Hi @takuyaikeda , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @danielbb , there are many ProofPoint modules and many ways to take logs (syslogs, scripts, etc...) see here to be guided: https://www.proofpoint.com/us/partners/splunk Ciao. Giuseppe ... View more

Hi @anlePRH , you could try something like this (to adapt to your requirement):   index=source sourcetype="source" | eval type=if(_time>now()-86400,"Today","Last30days") | chart count OVER SourceIP BY type   Ciao. Giuseppe ... View more

Hi @Amith55555 , could you share some sample (eventually anonymized) of your logs of both types? please in text format (not screenshot!) using the "Insert/Edit code sample" button. Ciao. Giuseppe ... View more

Hi @Dk123 , as @richgalloway said, what's your architetcure? you have to create the indexes.conf on the Indexers, so you can use them, but you don't see them in Search Heads. To use them in Indexers and see them on Search Heads, you have to create the indexes on both the types of machines. If instead you have a stand aolone server, did you restarted Splunk after creation? Ciao. Giuseppe ... View more

Hi @Andre_ , I don't think that's possible, also because Universal Forwarder's configurations are usually managed using a Deployment Server. But, you could have very large inputs and take all the weblogs or Apache logs, e.g. if your Apache logs are in the folder /opt/apache/<app>/data/<other_folders>/apache.log you could usi in your input: [monitor:///opt/apache/.../*.log] Ciao. Giuseppe   ... View more

Hi @DarrellR , as also @isoutamo said, you should put it in the main search. Ciao. Giuseppe ... View more

Hi @momagic , you have to use a subsearch: create a main query containing the data to display, adding as subsearch (putting it between square brackets and adding the search command at the beginning) the search containing the parameters, then you can display the fields you want. You have to put attention to two things: at the end of the subsearch yo have to use a command as table or fields to list only the fields used as filters, the fields from the subsearch must have exactly (case sensitive) the same names of the fields in the main search. For example, if the fields to use to filter events are FieldA and FieldB but ib the subsearch there are also other fields, you should write: index=index1 [ search index=index2 | fields FieldA FieldB ] | table _time host field1 field2 FieldA FieldB If you haven't much experience on Splunk searches and you didn't followed a course (there are many free courses in Splunk), you could follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/SearchTutorial/WelcometotheSearchTutorial) that explain how to use Splunk for searching, and here you can find a description of how to use subsearches https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/SearchTutorial/Useasubsearch Ciao. Giuseppe Ciao. Giuseppe ... View more

Hi @rahulkumar , let me understand, you have HEC inputs on the Indexer? in this case, you have to create props.conf and transforms.conf in the Indexer. As I said, these conf files must be located in the first full Splunk instance they are passing through, in your case, indexer. let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @nsxlogging , the issue isn't in Splunk, but in the firewall policies of your Company as descripted in the message error "The file you are trying to download or upload has been blocked in accordance with company policy". To solve this you have to contact your firewall administrator, if it worked fins six months ago, surely something changed in your company firewall rules. Instead it runs directly downloading from Splunkbase because, your Splunk Server can access it and the firewall routes are open for it. Ciao. Giuseppe ... View more

Hi @DarrellR , are you sure that all the events have the DR1 field? you could try to add DR1=* to the main search. Ciao. Giuseppe ... View more

Hi @Aedah , you could add this to splunk ideas (ideas.splunk.com) surely many people will be interesd on it. Ciao. Giuseppe ... View more

Hi @Rim-unix , if you have an Indexer Cluster, you can create a multisite Cluster and DR is automatic. If you don't have an Indexer Cluster, you have to find a different way for DR, using external tools as Veeam or other products. Ciao. Giuseppe ... View more

Hi @Rim-unix , what do you mean with DR Indexers? at first, I suppose that you have an Indexer Cluster, is it correct? Anyway, you should design a multisite Indexer Cluster where the secondary site is on AWS. To do this I hint to engage a Splunk PS or a certified Splunk Architect. Ciao. Giuseppe ... View more