Hi there, That sounds more like a VM problem if the VMs cannot even be rebooted. I would stop all of them and start one instance, check/verify its activities and if it's healthy start the next and repeat that process. If not, troubleshoot that instance on why it's not healthy and hold back until you have fix the issues and it's healthy again. Dispatch filling up means you run a lot of searches, so check what they are and why they run so often. Beside that disable the UI on the IDX and like @PickleRick said use any other tools available for troubleshooting. Hope this helps ... cheers, MuS ... View more

Hi there, Not sure I understand your questions correctly... If you are looking for the location where the updates are stored this page can help https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.15/use-splunk-security-content/escu-components If you are looking for what kind of logs you need to feed a correlation search check the search itself, see which  data model, tags , and or eventtypes it uses and normalise the data/logs using the CIM https://help.splunk.com/en/data-management/common-information-model/6.1/using-the-common-information-model/use-the-cim-to-normalize-data-at-search-time   Hope this helps ... cheers, MuS ... View more

replace %Z with %HKT ... View more

According to https://en.wikipedia.org/wiki/List_of_time_zone_abbreviations Hong Kong has HKT so you could use %HKT in strftime ... View more

Hi there, According to https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.0/evaluation-functions/date-and-time-functions#ariaid-title4 strftime only uses a time field and the format like  strftime(<time>,<format>) I sugest to remove the ,"Asia/Hong Kong" bit from the SPL. cheers, MuS ... View more

If possible share sanitised sample events otherwise we will not be able to actually help 😉 Cheers, MuS ... View more

Hi there, Short answer is no, but you could create a scripted input using this command https://community.splunk.com/t5/Security/Check-HTTPS-certifciates/m-p/145539/highlight/true#M4466 and get this indexed into _internal   Hope this helps ... Cheers, MuS ... View more

Hi there, if all your saved searches are in the same app ACS is your friend https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/9.3.2411/admin-config-service-acs-api-endpoint-reference/admin-config-service-acs-api-endpoint-reference#b7653fbe_6c5c_448a_baf7_038bb28aca03__Manage_private_apps_and_Splunkbase_apps_.28Victoria_Experience.29 Hope this helps ... Cheers, MuS ... View more

Hi there, This is not really a Splunk question; I would start here https://argo-cd.readthedocs.io/en/stable/ cheers, MuS ... View more

Just adding the translated text here: The Splunk Enterprise upgrade procedure states that the automatic startup setting should be disabled, but why is it necessary to disable the automatic startup setting? ... View more

Hi Aedah, you are trying to upload an xlsx file which is not text. Export the file in excel as csv and upload the csv instead. cheers, MuS ... View more

Hi there, If you are downloading add-ons in your local Splunk Enterprise UI the login that is required is the login from splunk.com and if that still fails try to download it here https://splunkbase.splunk.com/    Hope this helps ... cheers, MuS ... View more

Hi there, make sure the user role has the required capabilities: edit_tokens_settings, which turns token authentication on or off edit_tokens_all, which lets you create, view, and manage tokens for any user on the instance edit_tokens_own, which lets you create, view, and manage tokens for yourself https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Security/Setupauthenticationwithtokens#Prerequisites_for_creating_and_configuring_tokens   Hope this helps ... cheers, MuS     ... View more

Hi there, Have a read here https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Knowledge/Usesummaryindexing#Get_started_with_summary_indexing    cheers, MuS ... View more

Hi there, If I recall correct the Checkpoint only supports syslog over TCP and can therefore use TLS. Splunk syslog input only supports UDP and no SSL. That said you could use a TCP input, configure TLS/SSL https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Inputsconf and see what you can get. Hope this helps ... cheers, MuS ... View more

Hi there, Please contact your Splunk sales account team for this, they are able to help you. cheers, MuS ... View more

Hi there, Can you please post an example _raww event in a code block, thanks  cheers, MuS ... View more

Hi there, Easiest way is to download, extract it and see what it includes. cheers, MuS ... View more

Hi there, Missing events from WEF/WEC can be cause by the file size, if too small they rotate away before the UF even has a change to read it .. don't ask how I know 😉  Increasing the size for the forwardedevents channel will help resolving this. Hope this helps ... cheers, MuS ... View more

HaHA, I was answering based on the provided information not trying to work around every single possible outlier 😄  ... View more

Hi there, like in most cases a simple 'stats' will do the trick. Try something like this  index=printserver OR index=printlogs | bin _time span=3s | stats values(*) AS * by _time username | table _time prnt_name username location directory file   Hope this helps ... cheers, MuS ... View more

Hi there, without sample events this can be tricky but since you provided the SPL and you join on UserAccountId I assume this field is available in both sourcetypes. If this is case, it would be as simple as   index=salesforce UserAccountId=* sourcetype="sfdc:user" OR ( sourcetype="sfdc:setupaudittrail" Action=suOrgAdminLogin ) | fields list of fields you want | stats values(*) AS * by _time UserAccountId   Hope this helps ... cheers, MuS   ... View more