Hi Guys, Can anyone please help me with line braking for the below json log, { "totalSize" : 473, "done" : true, "records" : [ { "attributes" : { "type" : "SetupAuditTrail", "url" : "/services/data/v48.0/sobjects/SetupAuditTrail/0" }, "Action" : "deactivateduser", "CreatedByContext" : null, "CreatedById" : "0052v00000", "CreatedByIssuer" : null, "CreatedDate" : "2020-05-18T03:35:57.000+0000", "DelegateUser" : null, "Display" : "Deactivated user xyz", "Id" : "0Ym2j0000012ACtCAM", "Section" : "Manage Users", "ResponsibleNamespacePrefix" : null }, { "attributes" : { "type" : "SetupAuditTrail", "url" : "/services/data/v48.0/sobjects/SetupAuditTrail/0Ym2j00000" }, "Action" : "changedUserEmailVerifiedStatusVerified", "CreatedByContext" : null, "CreatedById" : "0052v00000", "CreatedByIssuer" : null, "CreatedDate" : "2020-05-18T05:51:45.000+0000", "DelegateUser" : null, "Display" : "For user xyz@xyz.com, the User Verified Email status changed to verified", "Id" : "0Ym2j00000", "Section" : "Manage Users", "ResponsibleNamespacePrefix" : null }, { "attributes" : { "type" : "SetupAuditTrail", "url" : "/services/data/v48.0/sobjects/SetupAuditTrail/0Ym2j00" }, "Action" : "changeApplicationContactEmail", "CreatedByContext" : null, "CreatedById" : "00000", "CreatedByIssuer" : null, "CreatedDate" : "2020-05-18T06:08:08.000+0000", "DelegateUser" : null, "Display" : "Changed Connected App Contact Email from none to xyz@xyz.com", "Id" : "0Ym2j0", "Section" : "Application", "ResponsibleNamespacePrefix" : null }, { ... View more

Hi Folks, Can anyone please help in forming the query for internal splunk components up and downtime reporting, i found a similar but this gives only uptime, | rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S") | eval timenow=now() | eval daysup = round((timenow - startup_time) / 86400,0) | eval Uptime = tostring(daysup) + " Days" | table splunk_server LastStartupTime Uptime ... View more

Hi Folks, I have to compare(in percentage) and display the Year to Date value of 2020 & Year to Date value of 2019 for instance right now the Year to Date is May 22 2020 , so whatever the count we have from January 1st 2020 to May 22 2020 vs the count of January 1st 2019 to May 22 2019 in percentage and a trend Thanks in advance ... View more

Hi folks , I wanted to change the color of each bar in a bar chart ,the field value of these bar charts are not legends . I see the coloring will work only for the legends or with some threshold value. I have count as my legend for now. Please suggest how can i achieve this. Thanks in advance ... View more

Hi Guys, How can we configure BMC remedy as an adaptive response action so that whenever a notable is created a unique incident id has to be generated. I have successfully integrated remedy with splunk and when I am running command through search it generate the incident id is remedy but the same I want when a notable is triggered and how to validate the same and what additional configuration configuration needs to be done for the same ?? Thanks in advance. ... View more

Hi Folks, The incidents triggered in Splunk enterprise security are not getting replicated , i checked splunkd.log getting below Error 04-03-2020 23:46:17.490 +0530 INFO SHCSlave - event=SHPSlave::handleReplicationError aid=scheduler_nobody_U3BsdW5rX1NBX0NJTQ_RMD59cba5de3e5a67614_at_1585928100_2995_62EADBA1-5790-4632-BD11-A0EF9E4C4FBC src=965BB163-3807-4A31-9837-DB64A209B7CA tgt=62EADBA1-5790-4632-BD11-A0EF9E4C4FBC failing=965BB163-3807-4A31-9837-DB64A209B7CA queued replication error job ALso i have tried resynching SH cluster members and did rolling-restart but no luck. Also i saw the shcluster status on members and captain are fluctuating. Sometimes pending and getting up automatically. Pleae suggest ... View more

Unable to initialize modular input "whois" defined in the app "SA-NetworkProtection": Introspecting scheme=whois: script running failed (exited with code 1) Also while opening content management windows : Getting Could not load analytical stories Kindly suggest!! ... View more

Hi Folks, Can anyone help me on parsing of AWS-RDS logs. I don't find add-on for it. ... View more

iam able to see saved search under UI but not in savedsearches.conf. ... View more

Search peer ###############.com has the following message: Failed to register with cluster master reason: failed method=POST path=/services/cluster/master/peers/?output_mode=json master=##############.com:8089 rv=0 gotConnectionError=0 gotUnexpectedStatusCode=1 actual_response_code=500 expected_response_code=2xx status_line="Internal Server Error" socket_error="No error" remote_error=Cannot add peer=10.0.0.1 mgmtport=8089 (reason: http client error=Read Timeout, while trying to reach https://10.0.0.1:8089/services/cluster/config). [ event=addPeer status=retrying AddPeerRequest: { _id= active_bundle_id=##########################3 add_type=Clear-Masks-And-ReAdd base_generation_id=15418 batch_serialno=1 batch_size=1 forwarderdata_rcv_port=9997 forwarderdata_use_ssl=1 last_complete_generation_id=0 latest_bundle_id=################# mgmt_port=8089 name=##################### register_forwarder_address= register_replication_address= register_search_address= replication_port=9100 replication_use_ssl=0 replications= server_name=#######.com site=default splunk_version=7.2.6 splunkd_build_number=c0bf0f679ce9 status=Up } ]. I tried solving the issue by changing the PassSymm4Key under idx cluster, but still facing same error. ... View more