Hi @nhana_mulyana, are you sure that you are a registered Splunk Partner? you should see something like this:   Ask to your Splunk Channel manager. Ciao. Giuseppe ... View more

HI @BRFZ , see the Alert Manager Enterprise app (https://splunkbase.splunk.com/app/6730). ciao. Giuseppe ... View more

Hi @nhana_mulyana , you go in the Partner Portal and access with your account, if you're correctly associated to your company, you can click on the Partner Company manage button. at the bottom of the new dashboard you can find the "Download letter of Authorization" button. Ciao. Giuseppe ... View more

Hi @marka3721 , are you directly receiving f5 logs or is there an intermediate log collector? if there's an intermediate log collector, that probably modifies the log format, search in app's props.conf and transforms.conf the regexed that apply the sourcetype override and check if your logs match these regexes. if not, open a case to Splunk Support because this app is Splunk supported. Ciao. Giuseppe ... View more

Hi @houys , your question is too vague, could you better describe your data? which data sources (technologies)? Ciao. Giuseppe ... View more

Hi @scout29 , read this https://docs.splunk.com/Documentation/Splunk/9.2.2/Search/Addsparklinestosearchresults otherwise you could use timechart instead stats. ciao. Giuseppe ... View more

Hi @vanvan , I had a similar issue, my hint is to use rsyslog (or syslog-ng) server to take and write logs in files, then use the HF to read these files and elaborate and send them to Indexers. In this way you have two advantages: better performaces and less issues related to Splunk overload, syslogs are received also when Splunk is down. Then, if you have fast disks and you haven't a slow network, you can use parallel_pipeline to better use your CPUs. How many CPUs there are in your HFs? I had 16 CPUs and I passed to 24 to have more performant queues. then you could optimize your configuration enlarging queues that you can check on your search heads running this search: index=_internal source=*metrics.log sourcetype=splunkd group=queue | eval name=case(name=="aggqueue","2 - Aggregation Queue", name=="indexqueue", "4 - Indexing Queue", name=="parsingqueue", "1 - Parsing Queue", name=="typingqueue", "3 - Typing Queue", name=="splunktcpin", "0 - TCP In Queue", name=="tcpin_cooked_pqueue", "0 - TCP In Queue") | eval max=if(isnotnull(max_size_kb),max_size_kb,max_size) | eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size) | eval fill_perc=round((curr/max)*100,2) | bin _time span=1m | stats Median(fill_perc) AS "fill_percentage" perc90(fill_perc) AS "90_perc" max(max) AS max max(curr) AS curr by host, _time, name | where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue") | sort -_time Last hint: check the regexes on your custom add-ons to avoid unuseful overload. Ciao. Giuseppe ... View more

Hi @bhaskar5428 , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @Deepthi1, you need at first to install the Splunk_TA_nix add-on on the forwarder on the Linux servers and enable (in inputs.conf) the df.sh input stanza that takes information about file systems. Then you can use the output of this script on your dashboards. Ciao. Giuseppe ... View more

Hi @NanSplk01 , Splunk is a search engine, not a file explorer! you can have the list of files in a folder creating a script on the remote server that lists the files (e.g. every 15 minutes) so you can list them, but displaying the files in a dashboard in the original format with its own application isn't a job for Splunk. Ciao. Giuseppe ... View more

Hi @sswigart , as you can read at https://docs.splunk.com/Documentation/Splunk/9.2.2/Admin/Inputsconf#Event_Log_filtering, if the logs you indicated aren't relevant for your searches, you can follow the instructons in the above link, adding a blacklist to your inputs.conf in the WinEventLog:Security stanza. Only one attention point: in the blacklist you must use a regex, not a string to search. Ciao. Giuseppe ... View more

Hi @jacksonchandler , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @bhaskar5428 , you need a correlation key that cannot be a simple string, in this case you need to extract this field: in your case, the correlation key should be orderId, so you could run something like this: index = app_events_sdda_core_de_prod source="/home/sdda/apps/logs/sep-app/app-json.log" level=TRACE | rex field=message "\"orderId\":\"(?<orderId>[^\"]+)\"},\"error\":\{\"errorCode\":\"(?<errorCode>[^\"]+)\"" | fields orderId errorCode | dedup orderId | table orderId, errorCode | append [ index = app_events_sdda_core_de_prod "Process transaction locally" b95d0d10-9709-4299-9d3e-8c65dd5a539d source="/home/sdda/apps/logs/sep-app/app-json.log" | rex field=message "deliveringApplication=(?<AppID>\w+)" | rex "(?<orderId>\w{8}-\w{4}-\w{4}-\w{4}-\w{12})" | dedup AppID | table AppID orderId ] | stats values(errorCode) AS errorCode values(AppID) AS AppID BY orderId This solution has only one limit: you must be sure that the second search will have less than 50,000 results, otherwise, you need a different solution Ciao. Giuseppe ... View more

Hi @Hod152, why you did this? if you have tstats BY _time, you already have the timechart:   | tstats count WHERE case=test responseCode=200 requestStatus!=legal BY clientIp _time span=1h   Anyway, it's always better to indicate the indexes to use in the search, to have more performant searces  and avoid default search path issues. Ciao. Giuseppe ... View more

Hi @Cloud001, what are the Replication Factor and the Search Factor? anyway, usually logs are plicated between the indexers of each site anche between the sites, in this way, you have at least one searcheabel copy (or more) in each site. e.g. to have two copies of data in each site, you should have: site_replication_factor = origin:2, site1:2, total:4 for more details see at https://docs.splunk.com/Documentation/Splunk/9.2.2/Indexer/Multisitearchitecture Ciao. Giuseppe ... View more

Hi @bhaskar5428 , here you can find all the information https://hurricanelabs.com/splunk-tutorials/the-indexed-extractions-vs-search-time-extractions-splunk-case-study/  Anyway, you can add INDEXED_EXTRACTIONS on the props.conf on the UFs and or the SHs or use something like this: [your_sourcetype] INDEXED_EXTRACTIONS = JSON or in search index = app_events_sdda_core_de_prod source="/home/sdda/apps/logs/sep-app/app-json.log" | spath Ciao. Giuseppe ... View more

Hi @bhaskar5428 , this is the regex to extract the highlighted fields:   | rex "\"orderId\":\"(?<orderId>[^\"]+)\"},\"error\":\{\"errorCode\":\"(?<errorCode>[^\"]+)\""   that you can test at https://regex101.com/r/XkBntG/1 but I hint to try with INDEXED_EXTRACTIONS = JSON or spath. Ciao. Giuseppe ... View more

Hi @bhaskar5428, this seems to be a json format, so if you use INDEXED_EXTRACTIONS = JSON in the props.conf or if you use the spath command (https://docs.splunk.com/Documentation/Splunk/9.2.2/SearchReference/Spath) in the search you should be able to extract your fields. It's also possible to use the rex command to extract the field, but to do this I need an example of your data in text format (not a screenshot), using the Inser/Edit code sample button (the one with "</>"). Ciao. Giuseppe ... View more

Hi @mobrien1 , maybe  "Once" and "For each result" became from Alerts. I don't find any other answer. let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @riyastk , let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @mobrien1 , I suppose that the meanng of the affermation is that e.g. risk score is counted for each value you can find in the results of your Correlation Search, so if you have more hosts in the results, the Risk Score is counted for all of them. But, why did you posted this question? Ciao. Giuseppe ... View more

Hi @mobrien1 , I don't know the opinion of other colleagues, but I don't like to use indextime instead eventtime (replacing timestamp with _indextime in indexing), because in this way you loose the correlation time of your events, in other words if something. if instead you want to maintain the event timestamp and use the _indextime for the searches, my question is one: why? This request certainly comes from the need to compare the results with those of other SIEMs that used this modality, but in my opinion, Splunk's approach is more rigorous and effective, and anyway, you can add conditions using _indextime to your main searches (I did it for an Acceptance Test). Anyway, if something happened at a certain time, I need that information to analyze the events in that time period, possibly from other sources, which perhaps were indexed before or after. Anyway to answer your questions: I don't think there is an impact in terms of search performance. Regarding use in DataModels, I believe that there are no impacts because the DMs are populated based on the timestamp of the events. regarding the filters on _indextime, you can use them right away. Last information: never use "All time" in your searches. Ciao. Giuseppe ... View more