Hi @lmarcel  Do any of the searches populate at all in the Wireless dashboard? Can you try running a search for `eventtype=cisco_ios product=WLC` to see if you get any results? From what I can see the product=WLC is populated by 'isnotnull(filename) AND isnotnull(filename_line)'  Can you also confirm - are you running (Cisco Catalyst Add-on for Splunk)   https://splunkbase.splunk.com/app/7538  ? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @danielbb  Is the timestamp that is used coming from the report itself? Are you able to confirm that the report is available to Splunk at the timestamp shown - I've seen very similar behaviour with report type APIs where the report is 'generated' at say 00:00 but only processed and available for retrieval at a later time. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @justinrichter  The easiest way to achieve this is to set an index-time field on each host that applies to all sourcetypes, such as: # props.conf [default] TRANSFORMS-setSourceMeta = setSourceMeta or RULESET-setSourceMeta = setSourceMeta # transforms [setSourceMeta] #Update field/value name accordingly. INGEST_EVAL = travelledVia=ThisHostName   With Edge Processor you can apply a similar approach by using eval to set an index-time field which will be stored for each event. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Dav  Just to confirm, you are entering your Splunk.com credentials when prompted? (The one you used to login to the community pages). This should be the username, not email. If so, are you able to check if there are any outbound connectivity limitations from your deployment?  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @akkermansie  Have you set a 'Log File Prefix' in your Generic S3 input?  I suspect its unrelated to your issue but version 8.1.0 is now available for the AWS Add-on so you may also want to consider upgrading. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @bpenny  The issue here is that you have put " quotes around the regular expression in your EXTRACT statement, the quotes are not required. Ive tested ingesting a local json file with the EXTRACT setting without the quotes and it extracts successfully. Please could you try updating to remove the quotes?   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @dpollardcouk  I know we have discussed this offline but for the benefit of others... Splunk used to, but no longer, supply an SELinux policy (https://download.splunk.com/products/security/splunk-selinux-0-0.9.0.el8.noarch.tgz) but the latest I can find this for is 9.2.2 for RHEL8 and even this and historical versions have been removed (https://web.archive.org/web/20250710043555/https://docs.splunk.com/Documentation/Splunk/9.2.2/CommonCriteria/InstallSELinux)  Ultimately it is against best practice and I believe non-supported to run Splunk with SELinux in enforcement and is expected that exceptions can be made for Splunk... Regarding CIS Benchmark Level 2 Hardening - I would expect that if an exception can be made for Splunk that additional controls could be put in place to mitigate the risks introduced by SELinux not being enforced and that this could be used for mitigation and approval with the organisation mandating the CIS Benchmark requirements. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @danielbb  What is it you're wanting to see? Whilst some Add-Ons which collect/parse data have specific 'App' equivalents which have dashboards to view the data, this isnt necessarily the same for all.  Depending on what you're wanting to see visualised there may be existing apps containing the relevant dashboards but if not the Add-Ons you mentioned should provide the required parsing to enable you/your users to create dashboards according to your requirements. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @dfarr  What architecture is your Splunk deployment? If it is a single instance then you might be able to use the 'split-buckets' command in the Splunk CLI to split out the legacy data into a new index, and then set the retention to a low value so that they roll/archive out. This would rely on there being a source/sourcetype or host only present in the legacy data. For more info on this check out https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.0/manage-indexes/remove-indexes-and-indexed-data#concept-274851c5-16ce-4def-884d-c007131b46bf--en 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @wodrog  Would something like this work for you? This uses a hidden search/table to generate the earliest/latest for the previous day based on the input and then uses that in the earliest/latest for the search.   { "title": "Answers-SearchPreviousDay", "description": "", "inputs": { "input_zIorjrMc": { "options": { "defaultValue": "-24h@h,now", "token": "tr_global" }, "title": "Main Time Selector", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.o11y": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } }, "ds.search": { "options": { "queryParameters": { "earliest": "-24h@h", "latest": "now" } } } } }, "visualizations": { "viz_5ZrDUHwo": { "containerOptions": {}, "dataSources": { "primary": "ds_zdaUZXdL" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "row.info_min_time.value", "token": "eventid" } ] }, "type": "drilldown.setToken" } ], "options": { "stackMode": "stacked" }, "showLastUpdated": false, "showProgressBar": false, "title": "This shows for time selected in picker", "type": "splunk.column" }, "viz_BcDlqy4I": { "options": { "markdown": "Earliest = $globalTimeSpl:result.earliest$ \nLatest = $globalTimeSpl:result.latest$" }, "type": "splunk.markdown" }, "viz_NgmH6lHI": { "containerOptions": {}, "dataSources": { "primary": "ds_BlYVOfBA" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "row.info_min_time.value", "token": "eventid" } ] }, "type": "drilldown.setToken" } ], "options": { "stackMode": "stacked" }, "showLastUpdated": false, "showProgressBar": false, "title": "This shows for time selected - 24 hours", "type": "splunk.column" }, "viz_zUx2Zt29": { "dataSources": { "primary": "ds_ZKBDXZy2_ds_BlYVOfBA" }, "type": "splunk.table" } }, "dataSources": { "ds_BlYVOfBA": { "name": "global", "options": { "query": "| tstats count where index=main earliest=$globalTimeSpl:result.earliest$ latest=$globalTimeSpl:result.latest$ by _time, host span=15m\n| timechart span=15m sum(count) as count by host", "queryParameters": { "earliest": "$tr_global.earliest$", "latest": "$tr_global.latest$" } }, "type": "ds.search" }, "ds_ZKBDXZy2_ds_BlYVOfBA": { "name": "globalTimeSpl", "options": { "enableSmartSources": true, "query": "| makeresults \n| addinfo\n| eval earliest=info_min_time-86400\n| eval latest=info_max_time-86400", "queryParameters": { "earliest": "$tr_global.earliest$", "latest": "$tr_global.latest$" } }, "type": "ds.search" }, "ds_aOEeGNWG": { "name": "Search_1", "options": { "query": "| tstats count WHERE index=_internal by host" }, "type": "ds.search" }, "ds_ccCiW2S8": { "name": "tstat", "options": { "query": "| tstats count where index=_internal by _time span=1h", "queryParameters": { "earliest": "$tr_global.earliest$", "latest": "$tr_global.latest$" } }, "type": "ds.search" }, "ds_gRgnjURi": { "name": "Search_3", "options": { "query": "| tstats count where index=_internal by source, host" }, "type": "ds.search" }, "ds_rt307Czb": { "name": "timeSPL", "options": { "enableSmartSources": true, "query": "| makeresults \n| addinfo", "queryParameters": { "earliest": "-60m@m", "latest": "now" } }, "type": "ds.search" }, "ds_thns3Lsu": { "name": "Search_2", "options": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$", "o11yDSType": "serviceMap", "services": [ "paymentservice" ] }, "type": "ds.o11y" }, "ds_zdaUZXdL": { "name": "CurrentPickerTime", "options": { "query": "| tstats count where index=main by _time, host span=15m\n| timechart span=15m sum(count) as count by host", "queryParameters": { "earliest": "$tr_global.earliest$", "latest": "$tr_global.latest$" } }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_zIorjrMc" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_NgmH6lHI", "position": { "h": 270, "w": 1390, "x": 10, "y": 350 }, "type": "block" }, { "item": "viz_BcDlqy4I", "position": { "h": 50, "w": 300, "x": 20, "y": 10 }, "type": "block" }, { "item": "viz_zUx2Zt29", "position": { "h": 100, "w": 680, "x": 1470, "y": 10 }, "type": "block" }, { "item": "viz_5ZrDUHwo", "position": { "h": 270, "w": 1390, "x": 10, "y": 60 }, "type": "block" } ], "type": "absolute" } }, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } }, "applicationProperties": { "collapseNavigation": true, "hideEdit": false, "hideExport": false, "hideOpenInSearch": false } } 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Eran  If you havent already its worth checking out https://www.splunk.com/en_us/blog/artificial-intelligence/unlock-the-power-of-splunk-cloud-platform-with-the-mcp-server.html and https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/about-the-mcp-server-for-splunk-platform Regarding your questions, you should install the MCP Server on all members in your SHC.  Once installed you can configure your client with help from https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/connect-and-use-an-mcp-client - It is your client which will connect to the LLM and then utilise the tools from the MCP Server. The MCP server itself does not connect to the LLM. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Solitus31  Do you have category.SHCSlave=DEBUG anywhere in a .cfg (e.g. log.cfg) in $SPLUNK_HOME/etc ? Do you have any components/categories set to DEBUG in $SPLUNK_HOME/etc/log*.cfg files which are between the SHC members? If possible can you please post the entire log event. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @mhebert  Firstly, yes its normaly that a secret/password/token added in the Configuration page of the Splunk app would disappear when you go back to it - however if you re-submit the configuration without re-entering it then it may overwrite it to a blank value... Its no ideal but is what it is! Regarding your oauth2 token, did you allow the required scopes from the docs at https://github.com/splunk/TA-slack-add-on-for-splunk/blob/master/README.md ? In the app's settings, select OAuth & Permissions from the left navigation. Scroll down to the section titled Scopes. Click Add an OAuth Scope under User Token Scopes. Add the auditlogs:read scope. Click Add an OAuth Scope under Bot Token Scopes. Add the chat:write scope. Scroll up to the OAuth Tokens section, click Install to Organization. Click Allow in the pop-up window. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @ibrahim1  There are a couple of ways you could combat this, both of which I have seen at other customers. 1) Request a 0-byte license from Splunk Support - Explain your situation that you cannot connect from Site B to Site A and that you have Splunk components in Site B which require a license. Because Site B isn't actually indexing anything, it's only forwarding the data. You don't actually need a licence with a particular volume limit, therefore a 0-byte licence will be sufficient.  2) you could install the same licence on site A and B, however you may want to double-check with your Splunk account team. I have seen this done before, and Splunk did not have an issue with this, so long as no data was being ingested in Site B. I think the only time that you would get a warning within Splunk is if you had multiple index clusters pointing to different licence servers with the same licence key. But for HF, you should not have this problem.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @michaeln  You could try emailing appinspect@splunk.com with the details of your app (App ID and Splunkbase ID) and they can hopefully look into this for you.  Its worth noting that a lot of Splunk/Cisco staff will have been on leave over the last few weeks due to the holidays so that might add a delay to the app being approved. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

It has been many years since I've looked at rsyslog so I stand by my first point  I feel like this isnt stricly a Splunk answer but thank you for your update! Hopefully @spl_aficionado you are able to work out the chanes required to your configuration.  Thanks @PickleRick 👍 ... View more

Ha @isoutamo I was tempted to post to my fork of Ryan's repo but @gcusello had already posted the original repo 😉  If it helps @horacio you can use https://livehybrid.github.io/downloadSplunk/ for other version, which is a web-based version of the repo.    ... View more

Hi @spl_aficionado  I feel like this isnt stricly a Splunk answer, however this might help. https://unix.stackexchange.com/questions/183326/prevent-rsyslog-from-logging-remote-hosts-messages-to-local-var-log-syslog#:~:text=You%20have%20to%20make%20sure,order%2C%20which%20is%20really%20important. Ultimately, because rsyslog processes all matching rules and your custom rule doesn’t automatically stop further processing, the same events are still hitting the default rule that writes to /var/log/messages. If you have a rule like this:   if $fromhost-ip == '1.2.3.4' then /var/log/remote/1.2.3.4.log you need to prevent it continuing to process that message/event by adding & stop if $fromhost-ip == '1.2.3.4' then /var/log/remote/1.2.3.4.log & stop 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @soarguy  With previous Splunk Enterprise release where there was a new version of Python it was done in a phased approach whereby the new version was introduced but was still possible to use the previous version in that release, hopefully this would be the case for future SOAR releases too. Currently its a bit of a chicken/egg situation but hopefully somebody will adopt/fork this archived connector and provide 9.13 compatibility. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @HK_Cloud  This app is supported by Cisco, you might find it best to email the team directly with your query at Support email: cisco-cybervision-splunk@cisco.com 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more