I Am having Hf and it is configured to send data via sourcetype A After sometime it stops sending data to A Then i move the data to diffrent HF in sourcetype : test ( to test if it is working)  then from new HF I am routing the data to Source type A itself Will it reingest the data or checkpoint from the data it is left off, will it ignore the data which was sent to sourcetype :test?? need help and clear explanation ... View more

I Need to take a CSV file as input with a list of UF hostnames and check if they are reporting to splunk deployment server in a dashbaord ... View more

Here we are using a PowerShell script to extract the data from the AD subnets from a windows server This is scheduled to run once every week to pull the list of subnets on a particular root domain We are supposed to get the results only from a parent domain, instead we are getting the results from the subdomains which is not the expected result. Also when we run the Script in PowerShell ISE directly we are getting a list of subnets from a domain , but the result we see in splunk is entirely different from different domains than the results we get while running the script locally Since the results contains the subnets and IP Address we are unable to attach the screenshot due to the sensitivity of the results. Script used “ # extract domain rootDNS $domain=$([adsi] "LDAP://RootDSE").Get("rootDomainNamingContext") -replace "DC=","" -replace ",","." # create LDAP path for AD subnets $subnetsDN="LDAP://CN=Subnets,CN=Sites," + $([adsi] "LDAP://RootDSE").Get("ConfigurationNamingContext") #ouput properties $props = @{domain=$domain;ip="";sitename=""} # get subnets and loop through list foreach ($subnetDN in $([adsi] $subnetsDN).psbase.children){ $tmpTable = new-object psobject -property $props # get CN of the subnet's site objects $tmpTable.sitename=$([adsi] "LDAP://$($subnetDN.siteObject)").cn.tostring() # validate sitename if($tmpTable.sitename -ne $null){ #extract subnet CN $tmpTable.ip=$subnetDN.cn.tostring() #write output $tmpTable |select domain, ip, sitename } } Input Stanza: [powershell://Get-ADSubnets] script = . "$SplunkHome\etc\apps\bhp_hf_ad_audit_powershell_subnet\bin\RunAudit-ADSubnets.ps1" schedule = 30 15 * * 0 sourcetype = microsoft:ad:subnets   ... View more

I have enabled monitoring for zip files and there are two subfolders inside a zip file in that i have a text file LOG_ xxx which only iwant to monitor, I want to ignore the other files inside the zip file. Also when i index splunk auto decompress the files and extracts as file.zip:./folder1/folder2/Log_.txt I only want the Log_.txt but splunk indexes all the files even if i give the source in the above format like: filename/.zip:./folder1/folder2/LOG_.txt Need help ... View more

I am using this query to fetch current logged in user "|rest splunk_server=local /services/authentication/current-context | fields realname" It displays real name as Lastname, Firstname Now i want a nother field with value "Firstname Lastname" format ... View more

index=* [search index=_internal [| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user ] |top user limit=1 | fields user ] ... View more