Hey All 🙂 I've configured tcp-ssl on HF, created certificates and the following configuration. The HF receive syslog from third-party, I'll send the third party company the CA (combined certificat) I created based on these docs: 1. How to create and sign your own TLS certificates  2. Create a single combined certificate file  inputs.conf [tcp-ssl://2222] index = test sourcetype = st_test [SSL] serverCert = C:\Program Files\Splunk\etc\auth\mycerts\myServerCertificate.pem sslPassword = <Server.key password> sslRootCAPath = C:\Program Files\Splunk\etc\auth\mycerts\myCertAuthCertificate.pem Server.conf [sslconfig] sslPassword = <password encrypted that I didn't configured> And yet Splunk isn't listening to the requested port for example 2222 What am I missing? The error I get in Splunk _internal is: SSL context not found. Will not open raw (SSL) IPv4 port 2222 Please assist, and Thank YOU!!!   ... View more

  Hi, We have event with time field  Time=1650461136000 Props configuration parsing the time into  _time: 2022-04-20 16:25:36 _indextime: 04/20/2022 16:22:43 [props] TIME_PREFIX = ,\Time\= TIME_FORMAT = %s%3N That means the data ingest with future time. With that being said, what are we missing?  Why we still receive the warning   "WARN Date ParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (350) characters of event. Defaulting to timestamp of previous event" Thank you!   ... View more

Hi All, I'm running the query  | tstats count where index=<index name> by sourcetype No results   OR  | tstats values(sourcetype) where index=<index name> by index and the results for values(sourcetype) is null\empty. I have up to date data with  no delays in indextime . I've checked the fields.conf on indexers and I do see the field [sourcetype] **Also there are sourcetypes that does work and I see the field  Any ideas how to check this? or what can be the issue?   Thanks, Hen ... View more

  Hi  We get the error "500 Internal Server Error" on many pages of ES Splunk server  (Windows) Tried to change this on web.conf [settings] mgmtHostPort = XX.XX.XX.XXX:8089   Spoke with Splunk support they suggested to remove unnecessary apps and reduce the acceleration  time for DM. Still didn't help   Any Idea, what is the issue? Please assist.   Thanks, Hen ... View more

Hi All, I've ran a search and got these errors   I've checked the lookup and it's empty Is there a way to recover it? Thanks, Hen ... View more

Hello, I'm using DB connect 3.1.4, Here are the errors we get 2020-10-21 11:55:00.165 +0100 [QuartzScheduler_Worker-9] ERROR org.easybatch.core.job.BatchJob - Unable to write records java.io.IOException: HTTP Error 403, HEC response body: {"text":"Invalid token","code":4}, trace: HttpResponseProxy{HTTP/1.1 403 Forbidden [Date: Wed, 21 Oct 2020 10:55:00 GMT, Content-Type: application/json; charset=UTF-8, X-Content-Type-Options: nosniff, Content-Length: 33, Vary: Authorization, Connection: Keep-Alive, X-Frame-Options: SAMEORIGIN, Server: Splunkd] ResponseEntityProxy{[Content-Type: application/json; charset=UTF-8,Content-Length: 33,Chunked: false]}} at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:132) at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:96) at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36) at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203) at org.easybatch.core.job.BatchJob.call(BatchJob.java:79) at org.easybatch.extensions.quartz.Job.execute(Job.java:59) at org.quartz.core.JobRunShell.run(JobRunShell.java:202) at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573) 2020-10-21 11:55:00.165 +0100 [QuartzScheduler_Worker-9] INFO org.easybatch.core.job.BatchJob - Job 'XXXXXXXXXXXX' finished with status: FAILED   Execute SQL works, connection with DB is good The problem is that I don't see any new data coming in Already checked the Timstamp and tried to add  to db_inputs.conf token = [My_Token_Number]   Please assist. Thanks, Hen ... View more

Hello, I have logs from syslog server, my goal is to have events from the same log but these events will indexed with different sourcetype according to the IP in the log. lets say I have a row in the log with IP X his sourcetype will be ST1 for IP Y the sourcetype will be ST2 and so on. Here are my configurations inputs.conf [monitor://D:\Kiwi_DB] disabled = false index = db_it_syslog sourcetype = transformsourcetype props.conf [transformsourcetype] TRANSFORMS-transformsourcetype = change_st_by_IP1,change_st_by_IP2 transforms.conf [change_st_by_IP1] REGEX = "0.0.0.0" FORMAT = sourcetype::cyberark:epv:cef DEST_KEY = MetaData::Sourcetype Thanks! Hen ... View more

Hi All, I have 1 master cluster and 2 indexers . I've been using configuration bundle actions - push , several times. The last time I used this process I was trying to push an add-on the results on both of the indexers were: Added certificates , after that I edit the server.conf on both indexers with the correct URL and still didn't work. Any suggestion? Thanks! Hen ... View more

Hi All, I've installed CIM (same installation file) on 2 search heads. both of them with the same configuration, same Splunk Enterprise version, same OS. using Chrome in both servers. How is possible to have different UI? Can I keep going with the configuration on both of them? or is it wrong? I've tried to remove the CIM -> splunk restart -> installed CIM -> splunk restart And it happened again. Please assist, Hen. ... View more

Hi Everyone! I've tested the transferring buckets between 2 different Splunks, both of them are Win. Transferred .bucketManifest file and hot_v1_0 folder from the old Splunk to the New. After restart I still cant see the data. I also tried to transfer the the db folder . What am I missing? Please assist. Thank you!! 🙂 ... View more

Hi ! I have this search: | makeresults | eval customField="$Soc3$" , soc3dField="$multi$" | table customField soc3dField | makemv soc3dField delim="," | mvexpand soc3dField | append [ | inputlookup append=t $Lookup$ | where soc3dField != "$multi$"] ] $multi$ - could contain multiple values that I get from multiselect The table I get is with duplicate rows: What I'm trying to do is to take all the values in the $multi$ (contain the soc3dField) ---> update the customField in the lookup As you can see below, I've tried the same search with no tokens and It worked good! | makeresults | eval customField="f43256" , soc3dField="bytesIn,bytesOut" | table customField soc3dField | makemv soc3dField delim="," | mvexpand soc3dField | append [| inputlookup append=f Test.csv | where soc3dField != "bytesIn" AND soc3dField != "bytesOut"] Thank you !! ... View more

Hi Everyone! Like you, I have a text box (Splunk Field) that can get the value as a token by clicking from the table on the left side. The token is $splunkField$ I defined multiselect (Mapping options) that contain list of values I get from a search. | inputlookup append=t $fldMappingSet$.csv | fields soc3dField My question is, can I display in the multiselect values from a new search as default? I mean according to the token in the textbox I want the multiselect that will choose the values by default (with another search ) | inputlookup append=t MappingDemo.csv | search customField=$splunkField$ | fields soc3dField Like this for example: I hope I've explained myself well. Thank you all!! ... View more