Hi Everyone, Could you please help me to find out the issue with my Splunk instance. I am not getting email from splunk for the scheduled report/alert. Splunk version: 6.6.2 SMTP server is configured on that local server and port 25 is open. 1. for testing triggered email command from powershell in this case I am getting email .   $MailparamsDisable = @{ 'To' = 'himanshu.b.shekhar@xyz.com' 'Subject' = 'xyz account maintenance' 'From' = 'IAM.Admin@xyz.com' 'SmtpServer' = 'xyz.abc.com' 'Body' = "Hi Splunk" } Send-MailMessage @MailparamsDisable     2. but from splunk i am not getting email. index=_internal | head 5 | sendemail to="himanshu.b.shekhar@xyz.com" server="xyz.abc.com:25" subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true Search Factory: Unknown search command 'sendemail'. what could be issue please help me on this.   Thank in advance.   Thank You, Himanshu ... View more

Hi , i want to import below data in splunk - "C:\Windows\System32\CertLog\xyz Authentication CA - Ext.edb" it is in edb = Exchange Database format which contains all the certificate information , i want to import this data in to splunk . How to achieve this , please help here . Thanks in advance . ... View more

Hi All, I have drafted a splunk query (splunk versin 6.6.2 ) which gives certain fields and i tabulated those fields . I have field name (CommonName) , i want to exclude a particular event based on CommonName which is already present in a lookuptable (inputlookup CN_SAN_list.csv ). For few events which is not present in lookuptable still i am NOT getting those events in query. Please give some idea to fix this issue . Thanks in advance . Query : index=ssl_certificate sourcetype="ssl:pending" (Request_CommonName="abc.com" OR SAN="abc.com") | dedup RequestID | rex max_match=0 field=Request_EMail "(?.com)" | eval occurrences=mvcount(Mail) | eval Request_EMail=lower(Request_EMail) | eval access=if(((occurrences>1 OR Request_EMail like "dl-%@%.com" OR Request_EMail like "technology%@%.com" OR Request_EMail like "bhp%@%.com") AND ( Request_CommonName like "%.ent.abc.net" OR Request_CommonName like "%.abc.com") ),"Grant","reject") | fields "RequestID","Request_RequesterName","Request_SubmittedWhen","Request_CommonName","CertificateTemplate","Request_EMail","RowId","ConfigString","Table","SAN" ,"occurrences" , "access" | where access = "Grant" | sort RequestID | rename Request_RequesterName as RequesterName,Request_CommonName as CommonName, Request_SubmittedWhen as SubmittedWhen, Request_EMail as EMail | table "RequesterName","SubmittedWhen","CommonName","CertificateTemplate",RequestID,"EMail","RowId","ConfigString","Table","SAN" | search NOT [| inputlookup CN_SAN_list.csv | table CommonName] ... View more

hello content of /opt/splunk/etc/splunk-launch.conf : in my environment , i can see it is commented then how it is working now , right now it is working fine just i want to know . i am bit confused here please help me out . # Version 6.6.2 # Modify the following line to suit the location of your Splunk install. # If unset, Splunk will use the parent of the directory containing the splunk # CLI executable. # # SPLUNK_HOME=E:\Program Files\Splunk # By default, Splunk stores its indexes under SPLUNK_HOME in the # var\lib\splunk subdirectory. This can be overridden # here: # # SPLUNK_DB=C:\wrangler-2.0\build-home\kimono\var\lib\splunk # Splunkd service name SPLUNK_SERVER_NAME=Splunkd # Splunkweb service name SPLUNK_WEB_NAME=splunkweb ... View more

Hi , i want to calculate total no . of opened incidents by a user over a time interval in dynamic environment in splunk (assuming the time input via time picker and we have snow data in splunk ) for example i want to calculate total no. of opened incident by users from 15 feb 19 to 20 feb 19 .(obviously some ticket will be in closed , resolved, in progress , new ....etc states) we have dv_opened_at , dv_closed_at , sys_updated_on, dv_number fields in splunk as below - dv_number Team_Name dv_state dv_opened_at sys_updated_on INC0346726 Desktop Computing Updated by Customer 1/21/2019 7:34 2/22/2019 18:45 INC0349402 IAM In Progress 1/23/2019 19:28 2/22/2019 16:57 INC0363170 Desktop Computing On Hold 2/7/2019 20:19 2/22/2019 19:10 INC0368256 Desktop Computing On Hold 2/13/2019 19:53 2/22/2019 18:58 INC0370984 On Hold 2/16/2019 18:46 2/22/2019 18:17 INC0375322 Updated by Customer 2/20/2019 16:13 2/22/2019 17:58 INC0375327 Endpoint Security Updated by Customer 2/20/2019 16:18 2/22/2019 18:48 INC0375361 Desktop Computing In Progress 2/20/2019 17:22 2/22/2019 16:58 INC0376457 In Progress 2/21/2019 11:12 2/22/2019 18:48 INC0376813 Desktop Computing In Progress 2/21/2019 22:33 2/22/2019 18:26 INC0377715 IAM New 2/22/2019 17:24 2/22/2019 17:27 INC0377755 Messaging New 2/22/2019 18:56 2/22/2019 19:14 this log is pulled by splunk in last 4 hours(22 feb), here we can see have we have OLDER incidents also we are getting all those incidents because those got updated in this time interval . How we can exclude all those incidents ?? Thanks in advance 🙂 ... View more