Hi @Sachin, I’m a Community Moderator in the Splunk Community. This question was posted 9 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

Original question was posed in 2017. Now, in 2024, 7 years later it is still not very clear how one applies a saved extraction regex to an existing search to extract fields from the search. Especially without access to the various server side configuration files. Splunk has grown long in the tooth, dementia encroaching. Reality: You probably can't do it simply. If you have a sourcetype X. The extractors you saved will only run against the base, plain data set sent as X, not against your search, and they run against the base sourcetype automatically. If it was going to work, it would already be working and you would already have your field. Now, if your search does any kind of transformations like for example pulling log fields out of JSON data using spath, messing around with _raw or similar, the extractor you created isn't going to run against that resulting data set. I know, I've tried. The extractors get applied before that part of the search runs. See: https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Knowledge/Searchtimeoperationssequence You're going to have to go into Settings -> Fields -> Field Extractions and copy/paste the regex created by the web extractor page into your search and manually extract the field within your search using the "rex" command. You may have to tweak it slightly especially for quotes. It's a little disingenuous of the splunk web extraction generator to take the results of the current search as the input and imply that a saved extractor will actually operate against such a search and pull fields out for you. It doesn't. ... View more

It may depend on the OS version.  In mine when I did dpkg -l | grep xz, that's the only one I see.  I thought about xz*.  That might be a better play here.  is lib different from util or just different names per OS?   thanks for the feedback! ... View more

$SPLUNK_HOME/etc/system/local/web.conf is the one you would want to adjust the splunkdConnectionTimeout in.  ... View more

Can you share the soluition? ... View more

You can save a search as a report and then open "advanced edit" from settings -> searches, reports, and alerts -> "edit' dropdown. Then search for "preview" and disable it there. You will find an option similar to "display.general.enablePreview" and it defaults to the number 1 for "True". Change it to 0 and click the save butotn. Then you can just use | savedsearch "YourReportName" https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch This is particularly useful if you're using an external system to pull the data via API and the developers of the integration were unaware of the preview function being enabled by the default mode of operation in Splunk search. ... View more

Hi you should create a separate question for this as this thread is quite old and probably the issue is different. r. Ismo ... View more

Thank you @jkat54 for sharing your inputs. Strangely, its just that expression that leads to such issue. Like when I try to remove characters from the string one by one, the drilldown works. ... View more

Monitor Windows data with PowerShell scripts - Splunk Documentation   Here is the update link to docs. ... View more

Hi, Can you help me with where I can download the Splunk forwarder 6.3 rpm package. ... View more

Thanks for the tag. Yeah there is some confusion with the latest release because we added the ability to set default api key as well as others and they way we implemented it is causing the issue.  Basically we need users to enter a default ORG and default KEY but wanted to give them the option to add others as well and yeah I need to rework the setup page. The screenshots under installation section on GitHub should help clarify https://github.com/bentleymi/ChatGPT-4-Splunk   ... View more

In my case, I forgot to enable listening on my indexers. (You'll need to do this on any heavy forwarders forwarders as well).  /opt/splunk/bin/splunk enable listen 9997 ... View more

Opened 8191 to resolve as well. Happened on initial build. ... View more

Check this server.conf setting that you may be  missing: goes under sslOptions sslCommonNameToCheck = <commonName1>, <commonName2>, ... * If set, and 'sslVerifyServerCert' is set to "true", splunkd limits most outbound HTTPS connections to hosts which use a certificate with one of the listed common names.   ... View more

Above Link (https://answers.splunk.com/answers/52850/plotting-text-values-on-y-axis.html) does not work for me. Has this question ever been answered? I am also looking for a way to show words (enumerations) on the Y-axis ticks. Such as state descriptors "-1=unknown, 0=off, 1=reduced_mode, 2=on" etc. ... View more

There is no need to go back to the addon builder the app came from. As long as the app runs in a Splunk instance, this command can be used to generate an .spl that can be easily imported into any Splunk instance with Addon Builder: sudo /opt/splunk/bin/splunk package app <PACKAGENAME> Splunk username: Splunk password: All that is required is a Splunk UI account with admin rights from which the app is installed and is to be exported ... View more

Hi! Kara here, Splunk Community Manager. Thanks for your question, but I see this post is from 2016. I recommend you post a new question to gain more visibility and current answers.   Cheers! ... View more

On windows you may need to use os.sep in the path variables: Ex: ARCHIVE_DIR = os.path.join("c:",os.sep,"splunk","frozenPath")   ... View more

I realize this is a dated post but is closely aligned with the issue I am having with my shell script custom alert action.. Please elaborate on how you read in the stdin arguments to the shell script. I copied the sample script in the docs. The alert triggers the script and will print the $0 but the rest of the variables are null. Do I need to list the SPLUNK_ARG_x variables out in the alert_actions.conf? ... View more

I know this is an old thread, but wanted to provide some details as I ran into the same issue. The Splunk docs provides separate iRules for DNS request logging and DNS response logging. DNS request logging is configured in DNS > GSLB > iRules. They incorrectly state that you can apply this rule to your Listeners. You can only apply a GSLB iRule to wide IPs.  DNS response logging is configured in DNS > Delivery > iRules. I believe some older versions might list them in Local Traffic > iRules. They incorrectly state you can apply the rule to wide IPs. You can only apply a LTM/Delivery iRule to Listeners. While the logging does work assuming you apply the rules to the correct objects, the problem I had is ensuring that the request logging rule gets applied to all wide IPs. I want to do logging on the Listeners so I can set it and forget it. Rules configured within DNS > Delivery > iRules support both DNS_REQUEST and DNS_RESPONSE events, but they don't support the whereami, whoami, whereis, and wideip name commands. I simply remove the references to those commands and joined both the request and response rules into a single rule and applied it to my Listeners. I copied an example below. when DNS_REQUEST {     set client_addr [IP::client_addr]     set dns_server_addr [IP::local_addr]     set question_name [DNS::question name]     set question_class [DNS::question class]     set question_type [DNS::question type]     set dns_len [DNS::len]     set hsl [HSL::open -proto UDP -pool Pool-syslog]     HSL::send $hsl "<190>,f5_irule=Splunk-iRule-DNS_REQUEST,src_ip=$client_addr,dns_server_ip=$dns_server_addr,question_name=$question_name,question_class=$question_class,question_type=$question_type,dns_len=$dns_len" } when DNS_RESPONSE {     set client_addr [IP::client_addr]     set dns_server_addr [IP::local_addr]     set question_name [DNS::question name]     set is_wideip [DNS::is_wideip [DNS::question name]]     set answer [join [DNS::answer] ;]     set hsl [HSL::open -proto UDP -pool Pool-syslog]     HSL::send $hsl "<190>,f5_irule=Splunk-iRule-DNS_RESPONSE,src_ip=$client_addr,dns_server_ip=$dns_server_addr,question_name=$question_name,is_wideip=$is_wideip,answer=\"$answer\"" } ... View more

A while back I noticed the "endpoint" setting in the "serverclass.conf.spec" which *probably* could be used to create a functional Windows-based DS by directing the clients to retrieve the files from a non-Windows repository such that file modes are preserved: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverclassconf ... View more

How about eval's urldecode? | eval decoded=urldecode(yourEncodedField) or | eval decoded=urldecode("yourEncodedString") https://docs.splunk.com/Documentation/SCS/current/SearchReference/TextFunctions#urldecode.28.26lt.3Burl.26gt.3B.29 ... View more

We are having this same issue, 7 years later on Splunk 9.04.1. Has anyone identified a solution? We have a cron job running every 6 hours which deletes all files. Additionally, we added an IgnoreOlderThan = 6h to our inputs.conf, but it did not make any impact and we are still using 100% swap memory, instead of system memory. ... View more

I have the same issue but the link you mentioned is no longer working. ... View more

Hello, you are right, if you put files in thawed it does return to frozen, you have to delete manually. ... View more