We have an existing environment with 100+ servers sending data to IDX. We never had a DS before and now we want to introduce DS so that it's easier to manage the client.  What are the things I consider before I start planning? Which config files I should be worried about getting overwritten when I add the existing UF as client to my DS.   ... View more

I have couple of related things to be addressed.  I want to remove the search button from the panels so that users from specific roles can only see the dashboards.  While the 'user' cannot see the search button, I want admins to see that option.  So putting <option name="link.openSearch.visible">false</option> in the XML is ruled out.  Is there any other way?   I do not want users to have the search capabilities as well. If I am doing that, the searches in dashboards are also not working. Can I make them see the dashboards but take away the capabilities of running the ad-hoc searches?      ... View more

My current setup has 1 search head (SH) and 1 indexer. I want to be notified if there is an additional SH connecting to my indexer along with user/IP details if possible. I am sure there will be some events generated when a SH successfully connects to the indexer. This way, if someone has admin access on the new SH, it will be able to access all the data — No?? If yes, which I think is the case, all the user based access is of no use. Yes, you need credentials of indexers to be able to connect, but let's assume the user has the credentials and then are able to connect to the indexer. ... View more

I am setting Splunk ES and sending data from Fortinet. Data is well parsed and CIM compatible however Network dashboards are not loaded. After digging in macros I found that a particular command is stopping the dashboards to load. Below is the query when I expanded all the macros. | tstats prestats=true local= tstats_local summariesonly=true allow_old_summaries= allow_old_summaries_bool count from datamodel=Network_Traffic.All_Traffic where * by _time,All_Traffic.action span=10m | timechart minspan=10m count by All_Traffic.action | drop_dm_object_name("All_Traffic") If I change summariesonly to false then dashboards are loaded well. I read that summariesonly=true will only work if the datamodel is accelerated and in this case it is already accelerated and hence should work. Anyone else faced the issue??? ... View more

I am using the app for Google maps and want to plot some static data on particular latitude and longitude. Example: index=myindex| eval lat="2.068939" | eval lon="75.308099" | geostats latfield=lat longfield=lon count Works on the default map provided by Splunk but I want to show the building and street level information too and hence using the Google maps app. Idea is to plot these values in a look up and plot it on map. ... View more

So I am looking to join results of 2 searches and as I can see on docs.splunk there are various ways to join https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Join I am looking for difference between join and search command specially. Can someone elaborate please? ... View more

I am trying to setup an event action for my Pandion. While posting the URL to browser, '?' sign is getting converted to %3F which is the HEX for '?' sign. This results in URL not passing the field values like source and dest IP. If I delete the %3F and put ? sign again and hit refresh, then rerun it then it passes the values properly and Pandion is able to search the data. URL mentioned in Workflow action: https://IP_address/#/search/UUID?sip=$src_ip$&from_time=$_time$ Actual URL when it gets posted in another window: https://IP_address/#/search/UUID%3Fsip=$src_ip$&from_time=$_time$ Do you see the change after ? Anyone else faced this while posting URL from workflow actions?? ... View more

I want to integrate Phantom for SOC automation and I was wondering if I can integrate Splunk without ES app and there is very little documentation about it. Any guidance would be helpful. ... View more

Not that familiar with *NIX hence the question. I created the user and group called splunk and then ran Splunk for the first time with splunk user. Now I want to ensure my Splunk is running as splunk user and not as root. Can someone help me below command and the output? -bash-4.2$ ps -af|grep splunk root 1658 1473 0 22:33 pts/0 00:00:00 su - splunk splunk 1659 1658 0 22:33 pts/0 00:00:00 -bash splunk 2121 1659 0 22:36 pts/0 00:00:00 ps -af splunk 2122 1659 0 22:36 pts/0 00:00:00 grep --color=auto splunk ... View more

I followed the steps mentioned on below link to send internal logs from SH to indexer. http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Forwardsearchheaddata Now I am looking for a way to check and validate that I am receiving internal logs from SH to my indexer. How do I do that? ... View more

Here is a very generic question and can be related any CRM use case. I was thinking about the scenarios in which CRM logs can be used, for example when I look at Salesforce app, it mostly has information about dashboard performance and stats, login stats, reports downloaded etc.. What are the use cases derived from these dashboards? ... View more

I want to pass the Country name when I click on my map. Country is one of the fields in the data. Say if I click on Keyna, I want Kenya to be passed as a token on the next search. Here is what I am doing - I have an inputlookup file where I have the list of countries and the coordinates. Then on my index, I have the list of few countries. Running a join on lookup file and the indexed data. Here is my search: |inputlookup Countries.csv | join type=inner [search index=crm] | geostats latfield=latitude longfield=longitude binspanlat=1 binspanlong=1 count This gets me the Blue dots on the map based on the indexed data. However I am not able to run the count by command. Also I would like if the Name of the country appears next to the dot on the map. Later, I want to know how to pass a specific field's value when I click on the Country. I want to pass the country name to next search. I know how to pass a token, I need to know how to pass a value from a specific field. SOS!!! ... View more