Hi @m92, using the above cron, you run your scheduled search at 12:00 and 19:00. Ciao. Giuseppe ... View more

Hi @m92, you can schedule the runs of your alert twice in a day using cron: 0 12,19 * * * the question is: do you want the same time period (e.g. 24 hours) on bothe the searches? Ciao. Giuseppe ... View more

Hi @matheusvortex , you could write the results of the two searches in one summary index (called e.g. Notables), adding in each alert all the fields you need and then execute the third alert on the summary index displaying the fields you need. Ciao. Giuseppe This is the approach of Enterprise Security. ... View more

Hi @vineela, have you always the backslashes in your logs? if yes, you should consider them in the regex: in regex101.com https://regex101.com/r/7Fq96D/1 errorCode\s*\=\s*\\\"(?<errorCode>[^\\]+)   but in Splunk you must try: | rex "errorCode\s*\=\s*\\\\\"(?<errorCode>[^\\]+)" Ciao. Giuseppe ... View more

Hi @adrifesa95 , it shouldn't be a probem: on your HF, you can receive logs on port 9997 and send logs to Splunk Cloud on 9997 port. Check if from the UFs you can reach the HF (using e.g. telnet). Ciao. Giuseppe ... View more

Ciao @Jamietriplet , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @Siddharthnegi, yes, it's unusual (usual logs are read by Universal or Heavy Forwarders), but it's possible. Remember that anyway, it's a best practice to forward all SH logs to the Indexers, so for this reason it's possible. Ciao. Giuseppe ... View more

Hi @Jamietriplet, to use timechart you must use the -time field that's in epochtime format. If in your csv you have the _time field in a different format, you have to convert in epochtime (using strptime function in eval command) before the timechart command: Ciao. Giuseppe ... View more

Hi @adrifesa95 , if your HF is forwarding other logs, te connection is ok. so, try to remove the second stana in the inputs.conf of the HF leaving only: [splunktcp://9997] disabled = 0 Ciao. Giuseppe ... View more

Hi @sahityasweety, this timestamp seems to be in epochtime, so to transfrom it in human readable format you can use the strftime function in the eval command. e.g. to transform in format yyy-mm-dd HH:MM:SS, you could try: | eval timestamp=strftime(timetampo,"%Y-%m-%d %H:%M:%S") Ciao. Giuseppe ... View more

Hi @blbr123 , test it in Splunk using the regex command. Ciao. Giuseppe ... View more

Hi @blbr123 , (?ms) in a regex means that you have to consider a multiine event. Ciao. Giuseppe ... View more

Hi @jenkinsta , please try this: index=data earliest=-30d latest=now | eval period=if(_time>now()-86400,"last","previous") | stats dc(period) AS period_count values(period) AS period BY user | where period_count=1 AND period="last" Ciao. Giuseppe ... View more

Hi @blbr123, this seems to be a multiline og, try adding (?ms) at the beginning of the regex. Then test your regex in Splunk not outside Splunk. Ciao. Giuseppe ... View more

Hi @majilan1, you should create a lookup containing the perimeter to monitor (called e.g. perimeter.csv) containing at least the host fied and eventually also other information. Then you coul | tstats count WHERE index=* BY host | append [ | inputlookup perimeter.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | eval status=if(total=0,"Missed","Present") | table host status Ciao. Giuseppe d run a search like the following ... View more

Hi @blbr123, did you checked the regex in Splunk? If you could share some sample of your logs I can help you in this. are there other (one or more) HFs before the one where you located props and transforms? The transofrmation muste be applied in the first full Splunk instance where data pass through. Ciao. Giuseppe ... View more

Hi @Siddharthnegi , as I said in my answers to you previous question, if you install the Splunk Dashboard Example app ( https://splunkbase.splunk.com/app/1603 ), you'll find the example "Null Search Swapper, that describes how to replace a panel with a message when no results, that's exacly the feature you need. In the example there's the code to use in the dashboard, that you need only to customize for your searches and panels. What's the issue? Ciao. Giuseppe ... View more

Hi @adrifesa95, are you receiving Splunk internal logs from the HF and UFs in Splunk Cloud? how did you configure the outputs.conf on the HF? and on the UFs? Ciao. Giuseppe ... View more

Hi @avii7326, sorry but I don't understand the purpose of this search: you have the same search in the first part, with results aggregated using statsm so in one row you have three values Total Success and Error. Then in the append search, using the same search, you have many events listed with the table command. And there isn't any correlation between the two parts of the search. What's the output that you would have? Ciao. Giuseppe ... View more

Hi @Amadou, as I said, you have to find the conditions to search (in other words the words or strings or field values to search) then you can use the stats command to find the number of occurrences grouped e.g. for host and user. e.g. in windows if you want an alert with log failed greater than 5, you could run: index=wineventlog EventCode=4625 | stats count BY host user | where count>5  Ciao. Giuseppe ... View more

Hi @m92 , I added eariest and latest because you have _time in your searches, but you can ignore them. Ciao. Giuseppe ... View more

Hi @HugheJass , use this field in the conditions status.errorCode=* status.errorCode=0 status.errorCode!=0 or 'status.errorCode'=* 'status.errorCode'=0 'status.errorCode'!=0 Ciao. Giuseppe ... View more

Hi @Amadou, the main issue in developing a Splunk search is to know what to search, then you can use the SPL for searching the rules that you defined in your knowledge of the technology to monitor. I don't know what's your technology to monitor, as I said in my sample: if you are using windows EventCode=4625 menas log fail. So what are the conditions that you need to search? if you need to search a value in a field (e.g. EventCode=4625) you an use this field, if you need to search a string (e.g. "login successful"), you can search for this string. Did you tried to follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/8.1.0/SearchTutorial/WelcometotheSearchTutorial) to be guided in the use of SPL? Ciao. Giuseppe ... View more

Hi @Real_captain, this is one the few cases to use transaction command: index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) OR PIDZJEA OR IDJO20P) | transaction startswith="IDJO20P" endswith="PIDZJEA" | table _time eventcount Ciao. Giuseppe ... View more