Hi, I have a lookup file which has ClientName,ostype,currentforwarderversion   I wanted to know which Client is reporting to which deployment server.  can we have a query to find and how to use the client name as a filed value in the query  Thanks ... View more

Hi Team, I am getting this error on the universal forwarder. 07-10-2023 14:18:24.639 +0200 WARN TailReader [16165 tailreader1] - Could not send data to output queue (parsingQueue), retrying... 07-10-2023 12:59:18.463 +0200 INFO HealthChangeReporter - feature="TailReader-1" indicator="data_out_rate" previous_color=yellow color=red due_to_threshold_value=2 measured_value=2 reason="The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data." in the UF i configured [thruput] maxKBPS=0 CPU usage is below 50%. but still i am facing the issue i am getting these figures when using perc95(current_size)=7020604.800000001 in metric logs name=tcpout_SplunkCloud The errors are in the universal forwarder and the logs from the uf are being pushed to Splunk cloud i.e indexers on Cloud. @gcusello Please help me on this    ... View more

Hi Team, I wanted to forward my logs from heavy forwarder to Splunk Cloud and the same logs should forward to my test indexers as well. Now the configurations exists to forward the logs to Splunk cloud indexers and how to configure the same logs to forward to test indexers. Where do we configure the outputs.conf and how do we  configure. Is there a possibility  for this type of requirement.  Please do let us know.   Thanks & Regards, Umesh ... View more

Hi,   We have Configured custom threat intel feeds with splunk. The connection is succesful the status of the file shows "file downloaded".  I have checked the threat intel audit logs and found some thing here | status="No observables or indicators found in file" stanza="custom feeds" It is a CSV file and we have checked the ouput by giving the curl command and we got the response as IOC listed in the excel. but we  found this issue  | status="No observables or indicators found in file" stanza="custom feeds" Can you help me how to fix this issue .  ... View more

Hi  I wanted to integrate Nessus professional Data with splunk. Can you please suggest the best Add-on for integrating the data.   Can you please help me on this? ... View more

Hi, I am using Splunk Cloud and we are getting all the logs in IST timezone when IST is my preferred time zone. there are some of the logs reporting in UTC time zone and the logs we are getting to search head via UTC time zone. i wanted UTC time zone to reflect as IST.  Can you please help me in this way. if the way is to use TZ attribute in props.conf what will be the value for TZ attribute. Please let me know. props.conf must be edited in HF or indexer?  Thanks in advance ... View more

Hi Team,   I have created a notable in the Splunk ES and i received a notable and i analyzed the notable and i can see 130 events in the raw logs. But after sometime if i analyse the same notable i can see that there is increase in the  count of events . Can i know what the issue is regarding the increase in the event count. Thanks & Regards, Umesh ... View more

Hi , I am forwarding logs from UF -----> HF -----------> Indexer------->Search Head i am forwarding Windows Event Logs on index = os_windows  from UF to Heavyforwarder and then to indexer Do i need to create index =os_windows on Heavy forwarder . If the answer is No - i wanted to check the logs on HF if the logs are sent from UF to HF. How do i need to search. Please let me Know. Thanks    ... View more

Hi team, I have "file_size" in my  extracted fields and the values are 1.56 KB,5.03 MB, 1.06 B. and those values are strings. I need a query how to convert string to Integer to sum(file_size)  i need to use max and min and sum commands for the file_size. Please help me on the same.   Thanks ... View more

Hi I have created dashboard with column charts  and tables and it is working fine but when i export the dashboard to pdf i am unable to see the bar chart but the statistic tables are visible in the pdf. Any help will be appreciated.   Thanks   ... View more

Hi  I have two questions here  1.In the drill down search i have given dest=$dest$ and it is not working and when i click on contributing link it is reflecting the same.  2. When i click on drilldown search it is taking me to the search window with the time range as last 30 mins but what i expect is the  custom timerange when the event got triggered.  i kept offset values to default  Please let me know. Thanks   ... View more

Hi    I wanted to get the details  of the top 5 indexes consuming high license seperated by date  for last 7 days in a single query. 16th -top 5 index --gb 17th -top 5 index --gb 18th top 5 index  --gb  ......... Please help me with the above query    ... View more