This is an ancient thread, but bears updating. As of 9.1.x, this is what I see: Default is 10K lines.  You need to change it in alert_actions.conf.  Any change there will propagate to "Advanced Edit" for a saved search; there is no need to change the value there. If the mail doesn't come through, look through splunkd logs for "Message size exceeds fixed limit" as many mailers reject attachments larger than a given size (10M is typical) ... View more

This is an ancient thread, but bears updating. As of 9.1.x, this is what I see: Default is 10K lines.  You need to change it in alert_actions.conf.  Any change there will propagate to "Advanced Edit" for a saved search; there is no need to change the value there. If the mail doesn't come through, look through splunkd logs for "Message size exceeds fixed limit" as many mailers reject attachments larger than a given size (10M is typical) ... View more

Hi, I wanted to import your add-on into the add-on builder so I can view the checkpoint logic and replicate it for my app, but I`m getting the following error when I try to import the project: "The add-on project could not be imported because a problem occurred while extracting project file." Is there another way to view the checkpoint logic ? Thanks,  Toma ... View more

Thanks for this!  This worked for me in 9.1.2.  Definitely nicer than my thought of grepping for the index  name recursively from all /opt/splunk/etc/apps/search and /opt/splunk/etc/users. ... View more

disable all inputs  clean kvstore splunk clean kvstore -app TA_MS_Teams -collection TA_MS_Teams_checkpointer enable inputs in this order webhook, subscription, call record. ... View more

Here is the suggestion for best performance with no issues for your case. https://splunkbase.splunk.com/app/7130    Give me a like if that solves yours https://splunkbase.splunk.com/app/7130 ... View more

I tried:   | makeresults count=10 | eval src=random().".wxyz.com" | eval name = replace(src,".wxyz.com", ".abc.com")   To see how it worked. ... View more

I know this is an old topic, but i recently had the same issue.  So maybe it will help someone else.  the mvzip takes 2 required and one optional parameter.  You can only combine two fields at a time, followed by any character as a delimiter.  in the example below, I use a pipe character | But i have discovered, you can nest the mvzip and then extract them out so for your example using FieldA, FieldB, and FieldC A simple mvzip would be: | eval combined_data=mvzip(FieldA,FieldB,"|") and that's it, but wait there's more, proceed with nesting | eval combined_data=mvzip(mvzip(FieldA,FieldB,"|"),FieldC,"|") next expand the mv field | mvexpand combined_data Finally, extract the fields in the same order you combined them: | rex field=combined_data "^(?<FieldA>[^|]*)\|(?<FieldB>[^|]*)\|(?<FieldC>[^|]*)"           ... View more

I even opened a support case with splunk.  They told me to read the development guide.  apparently this error is a mystery to anyone who sees it.  ... View more

Remove the port 8088.  Splunk cloud listens on https only change https://prd-p-571sl.splunkcloud.com:8088  to  https://http-inputs.prd-p-571sl.splunkcloud.com/services/collector   https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/UsetheHTTPEventCollector#Configure_HTTP_Event_Collector_on_managed_Splunk_Cloud:~:text=Send%20data%20to%20HTTP%20Event%20Collector%20on%20Splunk%20Cloud%20Platform ... View more

@splunkyj  You do this for the service account that SQL Server runs as. ... View more

I don't know if you noticed but this thread is already 12 years old and the post you're asking about is 4 years old. You have better chance of getting a response by writing a new question (maybe pointing to this old thread for reference) instead of digging up such ancient history 😉 ... View more

Excellent work! Thanks! There is also idea to keep those as searchable on conf archive https://ideas.splunk.com/ideas/PORTALSID-I-141    ... View more

I have the same issue but rolling restart does not resolve the issue . Do you resolve your issue? ... View more

This Worked for me as well.  No need to give admin_all_objects permission! Splunk V. 8.2.5 ... View more

Hi @thambisetty  I have opened the firewalls/proxy In SIEM trace log file - no errors and logs related to connections are there In MCAS portal it is showing as connected In splunk, how should I check the logs? Do we have any index or sourcetype? ... View more

Splunking Microsoft Teams Data | Splunk - https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-microsoft-teams-data.html  ... View more

The incidents and alerts inputs for this add-on work perfectly!  We bring them in all day.   The alert_actions do not work very well.  We are using the workaround @jconger  mentioned below.   We have the makeresults command setup as a scheduled report to bring in custom advanced threat hunting queries.  @jconger  - on the next release, could you add a custom KQL input?  This would be similar to how TA for Defender ATP hunting API | Splunkbase does this.  There is an input to simply run the KQL against defender api.  The makeresults command already has the correct structure.  ... View more

nice response.  Thank you. What if the event log has spaces, found in the Applications and services node? Do we need quotes or anything?  [WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/MSI and Script] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Deployment] disabled = 0 index = wineventlog interval = 60 [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Execution] disabled = 0 index = wineventlog interval = 60 ... View more

Link is now broken ... View more

I see this one is kinda older, but did you find a solution? my inputs seem to stop every few days or less.  Sometimes cloning all the inputs corrects it, sometimes it does not.  ... View more

I made one adjustment in case you need the days to show up If days are less than 1, there will be no value, so fillnull to 0 | makeresults | eval minutes=1698 | eval result = tostring(minutes*60, "duration") | rex field=result "((?P<day>\d+)\+){0,1}(?P<hour>\d{2}):(?P<min>\d{2}):(?P<sec>\d{2})" | fillnull value=0 day | eval result = day." days ".hour." hours ".min." minutes ".sec." seconds" | table result Adjusting the minutes value: | makeresults | eval minutes=111698 | eval result = tostring(minutes*60, "duration") | rex field=result "((?P<day>\d+)\+){0,1}(?P<hour>\d{2}):(?P<min>\d{2}):(?P<sec>\d{2})" | fillnull value=0 day | eval result = day." days ".hour." hours ".min." minutes ".sec." seconds" | table result ... View more

entering a / character in the manual check path made the error go away.  I didn't enter anything in that path because the manual check was disabled.   ... View more

Hey @jaxjohnny2000 Did you find any solution to this Broken Pipe error? ... View more