Hi Splunkers,   I'm using splunk 8.2.1 with splunk stream 7.3 . I'm using the deployment server for the deployment of Splunk_TA_stream.  I'm getting Data to Splunk but the "Host" is set to "$decideOnStartup". On the other hand Stream Forward ID is set to the correct hostname.  I followed this Guide (https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/InstallSplunkAppforStreaminadistributeddeployment) but Step 5 of "Use the deployment server to distribute the Splunk Add-on for Stream Forwarders" did not work for me, so I copied the content of Splunk_TA_stream manual to deployment-apps.   Any Ideas?   ... View more

Hi, I'm able to receive and extract firewall traffic data using the log exporter function.  But system messages (e.g. kernel warnings) are still using "normal" syslog. There is no field extraction for these logs. Did I miss something?   Best, Sebastian ... View more

Hi, I'm using the Splunk App for VMware version 3.4.5 and facing an issue with p_average_cpu_coreUtilization_percent metric in virtual machine detail dashboard. Other metrics are populating, but there are no graphs for p_average_cpu_coreUtilization_percent metric. Best, Sebastian ... View more

Hi, I'm using the Splunk App for VMware version 3.4.5 and facing an issue with the Virtual Maschine Snapshot dashboard. There are only some of the snapshots listed. So I'm missing snapshots for most of my virtual machines. If I expand the time range (e.g. 7 Days) there are still not all snapshots listed. Is someone dealing with the same problem? Best, Sebastian ... View more

Hi Splunker, I want to rename an unknown field name from a JSON file. Please find the minimal example below: {"timestamp": "2018-10-24T08:46:02.205664", "type": "sw", "serial": {"Switchah3nv": "000123456789"}, "system_time": "Wed Oct 24 08:46:04 CEST 2018", ..... } {"timestamp": "2018-10-24T08:47:02.205664", "type": "fw", "serial": {"Switchcklaie7": "000987654321"}, "system_time": "Wed Oct 24 08:47:04 CEST 2018", ..... } I'm trying to make a table for all the serial numbers. So something like: hostname | serial_number Switchah3nv |000123456789 Switchcklaie7 |000987654321 I'm able to rename one serial by using | rename serial.Switchah3nv AS serial_number , but I need something like | rename serial.{} AS serial_number or | rename serial.hostname AS serial_number So anyone got an idea? Best regards, Sebastian ... View more

Hi splunkers, I'm trying to add a pcap file via command line: ./streamfwd -b 10000000 -r /tmp/tcpdump.pcap -s http://localhost:8889 Everything works fine, but the timestamps of the packets is the time point when the streamfwd sends the packets to the splunk instance. But it should be the timestamp of the packet itselfs (capture time point). I'm not using the -systime option. Best regards, Sebastian ... View more

Hi Splunkers, I'm trying to uploading a large pcap file (3,5 GB). After entering a name and choosing the file I select next. I can see that the file is being uploaded, but after this step nothing happened. Is someone facing the same issue? Best regards, Sebastian ... View more

Hi splunkers, Is there a way to animate more than one data point per time point? For example: t represents time point x represents longitude y represents latitude t | x | y | value 1|25|42 |31 1|32|51 |28 1|12|52 |30 2|13|31 |24 2|17|35 |20 At the moment only this animation is possible: t | x | y | value 1|25|42 |31 2|13|31 |24 If you take a look at the heatmap.js plugin page, it should be possible (https://www.patrick-wied.at/static/heatmapjs/example-heatmap-animation.html). So my goal is to get an animated heatmap and not just an animated point. Does anyone have an idea? Best, Sebastian ... View more