Hello Team, We are planning to upgrade Splunk Enterprise v6.5.1 to v7.1.2. I understand that we need to upgrade or make changes to SSL/TLS config as per http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Compatibilitybetweenforwardersandindexers Current UF Version Deployed and connecting to Heavy Forwarders. 6.2.6 6.3.0 6.3.7 6.4.3 6.5.1 6.5.2 I am confused as in link it says to change the cipher suite on forwarder but when clicked on Known issue list it is not clear where to make the changes. From Known issue: SPL-141964 - For splunktcp-ssl - we are not using it SPL-141961 - This seems to be applicable but it states "Upgrade your older instances to the latest maintenance releases or on your 6.6.x Splunk instances. Add the following stanza to server.conf:" [sslConfig] sslVersions = *,-ssl2 sslVersionsForClient = *,-ssl2 cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH Can you advise what changes need to be done? I believe it is SPL-141961 but where this change need to be done IDX/HF/UF? ... View more

Hello, We have log which have 5 different timestamp. I am trying to use custom datetime.xml created using splunk train dates cmd but it is not working. Different Timestamps 2018-01-05_18:15:42.208 2018-01-05 18:15:42 Jan 5, 2018 6:15:52 PM <05-Jan-2018 6:15:58,916 EST PM> custom datetime.xml <text><![CDATA[\<(\w+)\s(\d+),\s(\d+)]]></text> <text><![CDATA[,\s\d+\s(\d+):(\d+):(\d+)\s(\w+)\s(\w+)]]></text> <text><![CDATA[(\d+)-(\d+)-(\d+)]]></text> <text><![CDATA[-\d+-\d+_(\d+):(\d+):(\d+)\.(\d+)]]></text> <text><![CDATA[(\d+)-(\d+)-(\d+)]]></text> <text><![CDATA[-\d+-\d+\s(\d+):(\d+):(\d+)]]></text> <text><![CDATA[(\w+)\s(\d+),\s(\d+)]]></text> <text><![CDATA[,\s\d+\s(\d+):(\d+):(\d+)\s(\w+)]]></text> <text><![CDATA[\<(\d+)-(\w+)-(\d+)]]></text> <text><![CDATA[\w-\d+\s(\d+):(\d+):(\d+),\d+\s(\w+)\s(\w+)]]></text> props.conf TZ_ALIAS=EST=GMT+11 SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=UTF-8 disabled=false DATETIME_CONFIG = /opt/splunk/etc/system/local/datetime.xml LINE_BREAKER=([\r\n]+)(?:(?:<(\w{3})\s(\d{1,2}),\s(\d{4})\s(\d{1,2}):(\d{2}):(\d{2})\s(\w{2})\s(\w{3})>)|(?:(\d{4})-(\d{2})-(\d{2})_(\d{2}):(\d{2}):(\d{2}).(\d{3}))|(?:(\d{4})-(\d{2})-(\d{2})\s(\d{2}):(\d{2}):(\d{2}))|(?:(\w{3})\s(\d{1,2}),\s(\d{4})\s(\d{1,2}):(\d{2}):(\d{2})\s(\w{2}))|(?:<(\d{1,2})-(\w{3})-(\d{4})\s(\d{1,2}):(\d{2}):(\d{2}),(\d{3})\s(\w{3})\s(\w{2})>)) When testing using above configuration using Add Data - Splunk is not showing any data and reporting "No results found. Please change source type, adjust source type settings, or check your source file." ... View more

Hello, Can someone tell is Splunk db Connect app is supported on Solaris 11 Sparc Platform. For DB connect doc - it was mentioned that it is supported on Linux and Window platform only? We have installed Splunk Enterprise for Solaris 11 Sparc having last supported version is 6.2.3 , will Splunk DB connect v2.4.1 work on it? Please advise Thanks Hemendra ... View more

Hello, I am having hard time in understanding timezone assignment to the log event. I went through all the required doc but still doesn't have proper understanding. My log time stamp look like below, having timezone information as UTC. 2017-10-13 03:08:19.185+0000: starting up Search Head/Indexer time zone is AEDT (Australia/Sydney). I want to ingest the data where user can search the data based on AEDT timezone only without changing timezone from web interface. I have done below config in props.conf TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N%z% TZ = UTC Here's how logs are looking in Splunk. Is this correct? So If user is searching the data he will see the correct result based on time range selected and result will be UTC logs converted to AEDT time zone? Please help. ... View more

Hello, We have requirement to have Splunk search/dashboard result data in csv format to be fed into another tool. There should not be any manual process- search should run at scheduled time provide result to be picked by another tool. Options: 1) The tool can pick the csv file generated from search using outputcsv command but in doc it was written that it is not supported in distributed env. So if any other node run the search it will written local to that search node. Tool need to check all the nodes for the file. This can be done based on script checking the timestamp of the file generated and pulling it. 2) Can query write the data into separate index in csv format and tool can use Splunk API details to pull up the data? Are there any other ways to implement this and which might be the best option? Thanks Hemendra ... View more

Hello, I am trying to find response time between events in different sourcetype but not able to figure out how to find time difference. For some it is coming correctly but for some value is coming negative , look like end time value is not coming correctly. Below is the search I am using. I need to find value based on common conversation ID and find avg by action. I tried with transaction but with conversation id is not having same value for all the events and transaction is not working. index=A sourcetype="A_log4j" "Input Validation Passed" | rex "CONV_ID\s:\s(?.+)" | stats values(_time) as start by conversation_id | appendcols [search index=A sourcetype="B_log4j" "Outbound payload received" | rex "convId:\s(?[^/,]+)" | rex "action:\s(?[^/,]+)" | stats values(_time) as end by conversation_id,action] | eval diff=tonumber(start-end)| table conversation_id start action end diff. For some : getting wrong value for subsearch and hence diff time is coming incorrectly. Please advise how I can find response time in this scenario. Thanks much!! ... View more

Hello, For same base query I am getting different distinct count result in timechart and stats for same time range (old time to mitigate any new events coming in) stats - query - mysearch | stats dc(field) I ran the query for 2 hours between 16:00 - 18:00 and getting result as 507 Result ( Running it individually for 1 hr) 16:00 - 17:00 - 293 17:00 - 18:00 - 223 ** Difference of 9 when compared to running it for complete 2 hr. timechart - query - mysearch | timechart span=1h dc(Field) Result ( For whole 2 hours) 16:00 - 293 17:00 - 223 Result ( Running it individually for 1 hr) 16:00 - 293 17:00 - 223 It seem stats gives correct result if searched for separate 1 hr interval but not for running full 2 hours. I am at loss here what is happening? Please advise. Thanks ... View more

Hello Team, I have the Splunk Add-on for NetFlow installed on Splunk Heavy Forwarder (HF), receiving data from Netflow enabled device. I am getting the data and it is sent successfully to indexer. I want to filter fields send only specific fields for indexing. Can you let me know how to achieve this? E.g I need to completely remove below fields from indexing. These fields are as is extracted by add-on tcp_flag,fwd_status,src_tos Will the below configuration work? And do I have to perform the change at HF or Indexer level? props.conf [netflow] TRANSFORMS-nullQ= nullFilter transforms.conf [nullFilter] REGEX = tcp_flag|fwd_status|src_tos DEST_KEY=queue FORMAT = nullQueue Thanks Hemendra ... View more