Queues fill up when they can't send events to the next part of the pipeline.  In the case of the output queue, it happens when data can't be sent to the indexer(s).  That may be because the indexer is down or there's a network problem or perhaps other reasons.  The problem may have fixed itself because the indexer came back up or the network was fixed. ... View more

Hi folks, Any idea about the "_mkv_child" row created. I cannot find anything related to it in Splunk docs. Thanks, in advance. ... View more

  #tableColumWidth table th:nth-child(n+5), #tableColumWidth table td:nth-child(n+5) { display: none; } #tableColumWidth table th:last-child, #tableColumWidth table td:last-child { overflow-x: auto; width: auto !important; } </style> </html>   Can you replace it with the above?  This should hide all columns after the fourth column, and set a fixed width of 25% to the first four columns. The last column will have overflow-x set to auto to allow horizontal scrolling when necessary, and the width is set to auto !important to override the 25% width set earlier. This should allow the first four columns to be visible without scrolling horizontally, and allow the remaining columns to be accessed by scrolling horizontally. ... View more

OK. You lost me on that subsearch. (And I'm not gonna get started about the usage of join; just be warned that that's usually not the best idea). Your subsearch just outputs a list (with duplicates) of capabilities sets. And since it's a subsearch, it's limited to this execution scope. So how is it better than just stats values? ... View more

Thanks, I figured i was overthinking it all ... View more

Maybe reconfiguring the 'remote.gs.service_account_email' in indexes.conf located at $SPLUNK_HOME/etc/system/local for standalone or  $SPLUNK_HOME/etc/manager or master-apps/_cluster/local for cluster(push the replication bundle) might resolve the issue. Note: Make sure the indexer is hosted on GCP and permissions for Splunk to access the remote store is given. ... View more

Timeout means that one side performed some operation and waited for a result which didn't occur. In thes case it means that the forwarder tried to establish connection to a given ip:port but the receiver didn't respond in time to the connection request. It is typically an issue with your network configuration (routing, firewalling, filtering on the destination host). ... View more

Hi, From what I understand: The Phantom one is your license for the Phantom itself. The Splunk one is for the included Splunk Enterprise install. You can find it at $PHANTOM_HOME/splunk/ From the documentation: If Splunk SOAR (On-premises) is installed as a stand-alone product, it includes a version of Splunk Enterprise as the internal search engine. You can also configure Splunk SOAR (On-premises) to use an external Splunk instance for searching. A Splunk SOAR (On-premises) cluster also requires an external Splunk Enterprise instance. You can find more here https://docs.splunk.com/Documentation/SOARonprem/6.0.0/Install/ExternalSplunk    smurf ... View more

Any thoughts about this guys? ... View more

Guys, any thoughts on this?? ... View more

Unzip these files or use batch mode (batch://.../*.zip) to input these zip files. If you have a lot of mount zip files, write a shell scrip to unzip these zip files.   ... View more