Hey, I am facing following issues when sending data using HEC token. Connection has been established with no issue but getting following error message with HEC. Any recommendations to resolve this issue will be highly appreciated. Thank you!     [http] disabled = 0 enableSSL = 0 is also there.   ... View more

Hello, Is it possible to create HEC Token from the CLI  of Linux host? Any recommendations how to create HEC token from CLI would be greatly appreciated. Thank you!  ... View more

Hello, I have events with epoch time. How can I extract epoch time in human readable format using props.conf. My props.conf file is provided below: [myprops] SHUOLD_LINEMERGE=false LINE_BREAK=([\r\n]+) TIME_PREFIX="timestamp": TIME_FORMAT=%s%3N Sample Events: {"id":"A303", "timestamp":1723933920339","message":"average time to transfer file"} {"id":"A307", "timestamp":1723933915610","message":"average time to hold process"} {"id":"A309", "timestamp":1723933735652","message":"average time to transfer file"} Extracted time should be: YYYY-mm-ddTHH:MM:SS.3N        ... View more

Hello. I have some issues with field parsing for the CSV files using props configuration. I should be getting 11 fields for each of the events/rows, but parsing is giving me 17 fields. Here are the 3 sample events (First row is header row) from that CSV file and the props.conf file is also provided below: Col1,Col2,Col3,Col4,Col5,Col6,Col7,Col8,Col9,Col10,Col11 APIDEV,4xs54,000916,DEV,Update,Integrate,String\,Set\,Number\,ID,Standard,2024-07-10T23:10:45.001Z,Process_TIME\,URI\,Session_Key\,Services,Hourly APITEST,4ys34,000916,TEST,Update,Integrate,String\,Set\,Number\,String,Typicall\,Response,2024-07-10T23:10:45.021Z,CPU_TIME\,URI\,Session_Key\,Type\,Request,Monthly APITEST,4ys34,000916,DEV,Insert,Integrate,Char\,Set\,System\,ID,On_Demand,2024-07-10T23:10:45.051Z,CPU_TIME\,URI\,Session_Key\,Services,Hourly   *Bold texts in each of the events should count one field    props.conf [mypropscon] SHOULD_LINEMERGE=False LINE_BREAKER=([\r\n]+) INDEXED_EXTRACTIONS=CSV KV_MODE=none disabled=false TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%QZ HEARDER_FIELD_LINE_NUMBER=1   Any recommendation to resolve that issue will be highly appreciated. Thank you so much for your support as always.        ... View more

Hello,  I have a use case to get the index name from the field of one of the index/sourcetype and use that index name value to search the content of that index, but not getting any result. Here is what I did: index =meta_info sourcetype=meta:info| search group_name=admingr AND spIndex_name=admin_audit | eval getIndex=spIndex_name | search index=getIndex Any help will be highly appreciated, thank you!   ... View more

Hello, How do I compare 2 source types within the same index and find the Gap. For Example: index=compare sourcetype=accountA and sourcetype=accountB; we have some account info in accountA but not in accountB and objective is to find that gap.   sourcetypeA accid   nameA  addressA cellA 002         test1   tadd1    1234 003         test2    tadd2    1256 003      test2         tadd2    5674 004         test3     tadd3   2345 005         test4      tadd4  4567 006        test5      tadd5   7800 006    test5           tadd5   9900   sourcetypeB accid   nameB  addressB cellB 002       test1        tadd1    1234 003      test2         tadd2    5674 004     test3          tadd3   2345 005     test4           tadd3  4567 006    test5           tadd5   9900   Output will be: 003         test2    tadd2    1256 006        test5      tadd5   7800   Any Recommendation will be highly appreciated.   ... View more

Hello, I have some issues with parsing events and a few sample events are given below: {"eventVer":"2.56", "userId":"A021", "accountId":"Adm01", "accessKey":"21asaa", "time":"2023-12-03T09:10:15", "statusCode":"active"} {"eventVer":"2.56", "userId":"A021", "accountId":"Adm01", "accessKey":"21asaa", "time":"2023-12-03T09:09:11", "statusCode":"active"} {"eventVer":"2.56", "userId":"A021", "accountId":"Adm02", "accessKey":"26dsaa", "time":"2023-12-03T09:09:08", "statusCode":"active"} {\"eventVer\":\"2.56", "userId":"B001", "accountId":"Test04", "accessKey":"21fsda", "time":"2023-12-03T09:09:04", "statusCode":"active"} {\"eventVer\":\"2.56", "userId":"B009", "accountId":"Adm01", "accessKey":"21assaa", "time":"2023-12-03T09:09:01", "statusCode":"active"} {"eventVer":"2.56", "userId":"B023", "accountId":"Adm01", "accessKey":"30tsaa", "time":"2023-12-03T09:08:55", "statusCode":"active"} {"eventVer":"2.56", "userId":"A025", "accountId":"Adm01", "accessKey":"21asaa", "time":"2023-12-03T09:08:51", "statusCode":"active"} {"eventVer":"2.56", "userId":"C015", "accountId":"Dev01", "accessKey":"41scab", "time":"2023-12-03T09:08:48", "statusCode":"active"} The event breaking point is marked as Bold and I used  LINE_BREAKER=([\r\n]*)\{"eventVer":" in my prop.conf file, but not parsing all events as expected. Any recommendations will be highly appreciated. Thank you. ... View more

Hello, I have a lookup table called account_audit.csv and have a timestamp field UPDATE_DATE=01/05/24 04:49:26. How can I find all events within that lookup with UPDATE_DATE  >= 01/25/24. Any recommendations will be highly appreciated. Thank you!    ... View more

Hello, I have a windows machine with UF installed on that machine. How can I configure my Universal forwarder to ingest windows performance monitoring logs into SPLUNK. Our Windows Source server is located in different location SPLUNK should be getting performance data from. Any help would be greatly appreciated. Thank you!   ... View more