I am trying to access ACS services (Admin config services) on splunk cloud trial , But not able to do it ,  After acs login , i am getting an error : linuxadmin@linuxxvz:~$ acs login --token-user test_acs_user Enter Username: sc_admin Enter Password: An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=1ccdf228-d137-923d-be35-9eaad590d15c). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips. { "code": "500-internal-server-error", "message": "An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=1ccdf228-d137-923d-be35-9eaad590d15c). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips." } Error: stack login failed: POST request to "https://admin.splunk.com/prd-p-pg6yq/adminconfig/v2/tokens" failed, code: 500 Internal Server Error linuxadmin@linuxvm:~$ acs login --token-user test_acs_user Enter Username: sc_admin Enter Password: An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=5073a1f1-79d0-9ac1-9d9a-675df569846f). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips. { "code": "500-internal-server-error", "message": "An error occurred while processing this request. Trying this request again may succeed if the bug is transient, otherwise please report this issue this response. (requestID=5073a1f1-79d0-9ac1-9d9a-675df569846f). Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips." } Error: stack login failed: POST request to "https://admin.splunk.com/prd-p-pg6yq/adminconfig/v2/tokens" failed, code: 500 Internal Server Error Can some one please help here . ... View more

Hello team ,   I am having one event in which single field have multiple value like provided below:   {"body":{"records": [{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.0631470Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.252.16:64967 to 54.83.8.19:54443. Action: Deny"}},{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.4217670Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.34.12:62142 to 131.100.0.201:5938. Action: Deny"}},{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.9262290Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.252.196:13973 to 40.79.154.87:443. Action: Allow"}} Above is one single event from which i want to extract src ip and dest ip  for example 10.119.252.16 is src ip and 54.83.8.19 is dest ip , I want to extract all from backend i dont wana use  rex max_match=0 .   Please let me know how can i extract all from backend .   Thanks Kannu ... View more

Hello Guys , I have one json event in which there is subarray so i want to create one field which will have first index value of array for example { "data": {"task":"pullFrom", "from_repo":"https://abc.mxz.com:8089", "to_repo":"https://abc.mxzz.com:8089", "to_repo_change_count":20008, "asset_uri":["kannu","search","ui-prefs","search"] } } in above event i wnat to create the field which will have value only "kannu" from subarray "asset_uri" . I tried doing data.asset_uri[0] as a normal json parsing but splunk is giving error while doing like this Thanks in advance ... View more

Dear splunkers , I want to monitor my universal forwarder agent license expiry date . I am able to monitor it for linux system using scripted input on "openssl x509 -in /opt/splunkforwarder/etc/auth/server.pem -noout -enddate" But how to do the same with windows system , please help Thanks Manish Kumar ... View more

Hello Splunkers , I have one csv file which gets dumped to location being monitored by splunk UF . That csv contains content like this 19752,"TTYHUJIKNN",sdfsdfsdfsdfwer,sdfsdfsdf,,,"04-04-2019 12:11:31 PM","06-14-2019 09:30:18 AM" Time stamp present in above logs will get changed when every time CSV get appended by new entry of logs , But i dont want splunk to indexed the event based on timestamp present in logs , i want data to get indexed with the time of creation of file like provided below it should be Jul 9 01:28 -rwxr-xr-x 1 ccc ccc 13308953 Jul 9 01:28 Device_Report07-09-2019.csv -rwxr-xr-x 1 ccc ccc 13311527 Jul 10 01:27 Device_Report07-10-2019.csv For achieving this i have used props.conf at UF end . TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 1 But its not working as expected , Please help ... View more

Hello All , I have vmware environment setup and i make 10 vm's using vsphere client So I need help in monitoring applications installed on those vm's , like any db application installed on VM , Note : i cant install splunk UF on VM , but can install UF on vsphere , SO is there any way in which from Vsphere itself i can monitoring applications installed on VM . What to monitor : application running or not . Thanks in advance Manish Kumar ... View more

Hello ALL , I am looking to ingest data into Splunk using an FTP connection. For this, I have installed the Splunk stream app. But I don't know how to configure that app to receive data on an FTP connection . Please help Thanks in advance Manish ... View more