Darn ! I clicked on Ask a question button here : https://community.splunk.com/t5/c-oqeym24965/Radius+Technical+Add-on/pd-p/4547 and it removed the info about the app. I thought it would've been sent to the developer .... Ok, so the add-on is RADIUS Technology Add-On developed by some Brian Daniel Potter The only info splunkbase has about it (and I'm surprised it was published with just that) is:      I built this radius TA against a very large dataset that was geographically diverse, with different software (freeradius, radiusd, etc), different versions, etc. This should work for most *nix *Radius implementations. If you have data that fails to parse with this add-on please send me a note and a sample log and I will expand the add-on scope.      My understanding would then be it's supposed to monitor some radius configs ... but really it's not explicit.   ... View more

Any news ? How did you solve that issue, if ever ? ... View more

  Invalid key in stanza [webhook]   This is a bug in 9.0.0 Updating should get rid of it. If you want to remove the message without updating, you can edit    /opt/splunkforwarder/etc/system/default/alert_actions.conf   and remove the line 229 : enable_allowlist = false But this will have a impact on the manifest check at start, as you're not supposed to edit files provided with the installation.   You could also edit the manifest file and remove the line which checks for this specific aler_actions.conf, but splunk support may ask for the original manifest file if you open a case with them.     About  Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk /opt/splunkforward This is a automatic message since version 9 everytime you type a splunk command line. At this time the correct procedure to get rid of this is not clearly defined, as far as I know.   ... View more

| append [...] will append the inner search results to the outer search. For example: index=foo | stats count | append [index=bar | stats count] | appendpipe [...] will prolongate the outer search with the inner search modifications, and append the results instead of replacing them. For example: ... | appendpipe [ | stats count as extracount] | eventstats ... will add extra columns to an existing table with a treatment like a stats, without any further transformation. For example | eventstats avg(bytes) by server  | streamstats ... will add extra columns to an existing table, but each calculated result depend on the previous results. For example:  | streamstats count as rank For your needs, append may not be what you're looking for. The 2 searches are independant. ... View more

You want to index all the events from that WinEventLog, so you can't do that from the UF inputs.conf. You need the parser (HF or Indexer) to apply a different treatment for those specific events : props.conf [source::TheWindowsSecurityLog] TRANSFORMS = firewall_only transforms.conf [firewall_only] REGEX = EventCode=515[67] DEST_KEY = MetaData:SourceType FORMAT = sourcetype::wineventlog_firewall The REGEX probably needs some modification, but the spirit is to give a specific redirection for only those events that match the expression. All the other events will follow the natural process. No need for a blacklist/whitelist from the UF inputs.conf. ... View more

I would see only one way to do this. And it's ugly. ... Mount the 10 file systems on NFS from the 10 servers on one single UF.  That way, the fishbucket will consider treat the file as unique/identical on the 10 different paths, and it will be indexed only once. ... View more

You should get your answer here:  https://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps#How_Splunk_software_assigns_timestamps under the section :  How Splunk software determines timestamps with no year ... View more

Assuming you use | timechart, you can immediately after use | timewrap to let the display split by your favorite span. For example :  ... earliest=-1d @d | timechart count span=1h | timewrap 1h ... earliest=@w | timechart count span=1h | timewrap 1d .. earliest=-4w@w | timechart count span=1d | timewrap 1d Timewrap will automaticaly add new series with a suffix as ...1hour_before ...2days_before  ... latest_day ... View more

You don't say where the traffic analysis comes from ... Any index, source, sourcetype ? Do you want to analyze the activity toward the Splunk Web server itself ? If so, you would start looking in index=_internal  source=splunkd_access.log sourcetype=splunkd_ui_access clientip=* Here the clientip is the field that tells you about the incoming connection. If you want to compare it with the lookup you can then add this : ... | LOOKUP <lookup.csv/lookup definition> clientip OUTPUTNEW clientip AS knownIP If the ip address is in the csv, then it will be shown in the knownIP field. If it is unknown, the knownIP field will be inexistent. After what you can filter the results based on the existence of that knownIP field, with: | where isnull(knownIP) or | where isnotnull(knownIP) ... View more

When you create a dashboard directly from the DS editor, it comes with a Canvas height of 900. Adding text boxes or any other element would make them present in the canvas If you convert an empty XML dashboard to a DS, it will have a Canvas height of 0. Adding elements here would make them outside of the canvas shown as a thin line on top of the view The canvas size can still be edited, from the code or by clicking that tiny dotted line and your elements will become visible So, it's not really an issue, just a question of: where did you place these elements? ... View more

I can't say why I understand the difference in count between your 2 searches. But trying a similar syntax as yours in my test environment gives me an execution time of 0.37s with the subsearch vs 0.075s without it, while I don't have any discrepancy in the results. Based on these performance, I would probably not investigate that syntax any further if it leads to an execution time 5 times worse.   ... View more

Try where like. It can compare with any value inside the mv field. | where field1 LIKE (field2)   ... View more

You can propose any format for the date, and do some calculation with the token  as I mentioned. If the date format is DD/MM/YYYY, use strptime($timetoken$,"%d/%m/%Y) to make it in epoch format do the required math to create another token by subtracting 186400s (that's -1week) if you need to display, then reformat with strftime($weekago$,"%d/%m/%Y") You need to set or eval tokens in XML code to make them compatible with the search or the display. Then the tokens can be used anywhere in the dashboard, for any panel, or any chart. ... View more

Just to be sure ... you would have noticed the typo in stanza [target-broker:deploymentServer] that you wrote [target-broker:depolymentServer] instead ? If the typo exist and exactly the same on both OS, consider it is being ignored on RedHat 8.4 for some reason, while RedHad 7.9 does not accept the error. Anyway, as mentioned the correct location for  phoneHomeIntervalInSecs is in [deployment-client]. ... View more

Hi. I'm not sure why you try to use that syntax. The subsearch is executed before the outer search, and adds up to the execution. In term of performance, this is not nice. But let's say you have your reasons ...: It seems to me there is no space here: fields -_time while it should be: fields - _time but you don't even need to get rid of that field. If you want to return only 1 value, you can use [ | makeresults | eval Audit.action="add" | return Audit.action] though I'm still unsure of what you try to achieve. ... View more

There is no problem using NOT source=*bz2 ... or source !=*.bz2 assuming you mention source=... Adding an extra filter after a pipe with any where/search/regex option would not give you the best performance. If this is a real problem, then consider indexing the bz2 files in another index. You should also find your data by narrowing down to the sourcetype, no ?   ... View more

So, your dropdown input gives you a date from any search (let's populate the input with this example to propose today and the previous 14 days): | makeresults count=14 | streamstats count as offset | eval _time=_time-offset*86400 | eval _time=strftime(_time,"%a %d %B %Y") Because _time is stored in epoch format but displayed in human format you can use the input settings: Field for Label=_time  Field for Value=_time The trick for your 2nd dashboard panel is to use a time calculated from the first token. This can be done in the dashboard XML code inside the input definition like this : <change> <eval token="weekago">strftime(strptime($time_tok$,"%a %d %B %Y")-7*86400,"%a %d %B %Y")</eval> </change> As you can see, I substracted 7*86400 seconds to the chosen time to make it 1 week earlier. Then I use both strptime and strftime for the calculation and display. Now I have $time_tok$ shown and stored in human format from the dropdown, and $weekago$ as well in human format. If they are needed in a search for the earliest/latest settings, I'd need to reformat them with strptime. Complete code : <title>Chosen date: $time_tok$ / 1 Week ago= $weekago$</title> <input type="dropdown" token="time_tok"> <label>Pick a date</label> <fieldForLabel>_time</fieldForLabel> <fieldForValue>_time</fieldForValue> <search> <query>| makeresults count=14 | streamstats count as offset |eval _time=_time-offset*86400 | eval _time=strftime(_time,"%a %d %B %Y")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <eval token="weekago">strftime(strptime($time_tok$,"%a %d %B %Y")-7*86400,"%a %d %B %Y")</eval> </change> </input>   ... View more

Assuming your lookup definition has a match type set to WILDCARD(foo), you have to understand the wildcard in the lookup as either * for a search or % for a where command.  Even if your lookup table uses *, we will interpret the match that way: x="abc" matches because | where x="abc" | where "abc"="abc" matches the lookup x="*cba*" matches because | where x LIKE "%abc%" | where "*cba*" LIKE "%cba%" matches the lookup. See how the * in the eval/where syntax are treated as characters, not wildcards x="ab*" does not match because | where x="abc" | where "ab*"="abc" does not match ! * is NOT a wildcard in the eval syntax for the left argument | where x LIKE "%cba%" | where "ab*" LIKE "%cba%" obviously does not match x="dcba"does not match you say, but it should match (it does on my env) because | where x LIKE "%cba%" | where "dcba" LIKE "%cba%" matches thanks to the wildcards. So, you can't consider the * in the data as a wildcard, but as a character. ... View more

If you want it indexed and parsed, you can make it a scheduled saved search to run every 5' with an extra | outputcsv append=true tobeindexed.csv Then ensure you monitor that file and you can define whatever parsing settings you want. Personally, I use a dashboard to generate some events with either a log format or a JSON format, and I add a filter to reduce activity by a random of 50% for night hours and 20% for weekends. I can generate thousands of events in a blip, export them as a file, and test my parsing settings easily. For more advanced types and inputs, I use the SA_eventgen. ... View more

It's possible to append makeresults to an events search so to generate events instead of a stats table, with that syntax : index=dummy earliest=-1s | append [| makeresults count=8935 | eval _time=('_time' - (random() % 86400))] After that you can play with the number of events and the timrange (here with a backfill of 24h). You can improve the events content with some random data before closing the subsearch: | eval ip=((((("10." . (((random() % 4) * 10) + 10)) . ".") . ((random() % 16) + 17)) . ".") . ((random() % 16) + 33))   | eval _spacelist="Lungdanum Londres Londra Londar Landan Londin Lonn London Paris Parigi Paras Lutetia Parais Paras Pari Paries Pariis Pariisi Parijs Ba-le Parisium New-York Berlin Washington Kathmandu" | makemv delim=" " _spacelist | eval city=mvindex(_spacelist,((random() % mvcount(_spacelist)) - 1))    | eval _dashlist=" problem- issue- situation- operation- intervention-" | makemv delim="-" _dashlist | eval operation=mvindex(_dashlist,((random() % mvcount(_dashlist)) - 1))   And end up with: | eval _raw=_time.operation." in ".city." from ".ip There nothing indexed. Events are generated on the fly. You can create your own lists with or without a lookup. You can add that to a dashboard to make it more interactive.   ... View more

Almost there! I had a bad substitution in the regex, missing \/ for / as eventgen logs told me. Now, trying to replay 1 event at a time from that big 10k raw sample.  ... View more

(Old question with an answer still valuable) In a SHC the SH resources are not shared among searches, but for scheduled searches. Ad-hoc searches running on a SHC member will consider the cpu cores and memory resources as if it was unique.  For the scheduler, the captain will mitigate starvation by distributing scheduled jobs to available members. Each member not being supposed to consume more than its capacity. So you give more resources to scheduled jobs automatically in a SHC,  while for adhoc searches it depends on where the users are logged in. A load balancer for users connections can help, for high availability: users don't need to know each member fqdn nor ipod address to get in.  ... View more