The log we have for WinEvenLog for Security EventCode IN (4768) is missing the parts "Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. EditMore Resources" This is after Certificate Thumbprint. This only what we have in Splunk. The SEDCMD in props.conf were already commented out but still we are not getting this part in Splunk.     ... View more

Hi, I have just installed the Lookup FIle Editor in one of our search heads in Splunk Cloud. It's seems to be ok but I want to know if it needs also to be installed in other Splunk components, like the forwarder? Thanks in advance! ... View more

Hi Everyone, I am trying to monitor xml files from a directory in a certain server. But for some unknown reason/s no data is coming in. I have tried different path in the inputs.conf assuming that the provided path is not correct. As I check on the _internal logs, I can see the following events will all the paths I have in my inputs.conf. However, there's still no data ingested. TailingProcessor - Adding watch on path: <path1> TailingProcessor - Adding watch on path: <path2> TailingProcessor - Adding watch on path: <path3> TailingProcessor - Parsing configuration stanza: monitor:<path1> TailingProcessor - Parsing configuration stanza: monitor:<path2> TailingProcessor - Parsing configuration stanza: monitor:<path3> What could be error in this? Hope someone could help me with this. Thanks in advance! ... View more

Hello All, I was wondering if there's a way to manage lookup files in Splunk. What I want to do is to create/upload lookup files in Splunk and have this files saved in a location, if possible outside Splunk. And then when this lookup file get updated, it will save a new version in this location, without overwriting the old one. But in Splunk, only the updated version will remain. I hope I make myself clear with this. 🙂 Hoping someone could help me with this. Thanks in advance! ... View more

Hello. I have an email alert that sends the results in a csv file attached to the email. The search result of this alert has chinese characters in it. But as I checked the csv file, the chinese characters were converted to some weird characters. One way I have thought to solve this issue is instead of csv, an excel file would be attached. Is there a way to do attach an excel file instead of csv file? Because the only options in Splunk are pdf, inline and csv. Or is there any other solution to solve the issue with these special characters? Thanks in advance! ... View more

Hi, I have an email alert that will send a table with a field Status. Now, I need to send this email every hour starting from 8am, until all values of Status is equal to 100%. If all Status is equals to 100% it should stop sending email. Is this possible to do in email alert? Thanks in advance! ... View more

Hi All, Good day! I just want to ask for some help here. 🙂 I have multiple fields with the data I'm working on with values, "0, 1, 2, 3, 4, 5, NULL". Ex. I replace the "NULL" values and replace it with space, " ", and add all of these fields and put it in a new field with this code: | replace NULL WITH " " IN "FIELD A" "FIELD B" "FIELD C" "FIELD D" "FIELD E" | eval newField ="FIELD A" + " FIELD B" + " FIELD C" + "" FIELD D" + " FIELD E" But instead of adding the values of the fields, it concatenates it like like this: Notice that the events where there was a "NULL" values where seem to be treated as a string. I tried to use the tonumber() function to convert it to string but it doesn't work. Ex: |eval "FIELD A" = tonumber("FIELD A") |eval "FIELD B" = tonumber("FIELD B") |eval "FIELD C" = tonumber("FIELD C") |eval "FIELD D" = tonumber("FIELD D") |eval "FIELD E" = tonumber("FIELD E") What could be the possible cause of this issue and what could be the solution? Thanks! 🙂 ... View more

Hi All, I have 3 files in one index, Cycle 10.csv, Cycle 11.csv, and Cycle 12.csv. All of the 3 files have a "Cycle Number" fields with values: 10 for Cycle 10.csv 11 for Cycle 11.csv 12 for Cycle 12.csv The Cycle Number field is just an indicator for each cycle to be able to identify the previous and the current cycle. What I want to do is, first, to search the top 2 values of the Cycle Number field. So, I am expecting that it would return only the Cycle 11.csv and Cycle 12.csv Then, I would like to have a separate search for the Cycle Number with minimum value(Cycle 11.csv) and maximum values(Cycle 12.csv) How would I be able to do this? Thanks in advance and best regards. 🙂 ... View more

Hi All, I have a search: | savedsearch Cycle_11 | append [| savedsearch Cycle_10] with the results: The result I want is something like this: What do I need to do to get the result I want? I have tried appendcols but the results is somehow messed up. Note: Both savedsearch returns more than 30,000 results. I hope someone can help me with this. Thanks in advance and Best Regards 🙂 ... View more