From Monitoring Console > Indexing > SmartStore > SmartStore Cache Performance: Deployment, we can see Max Cache Size value. | REST splunk_server_group=* /services/properties/server/cachemanager/max_cache_size | eval size=if(value=0, "No Max", tostring(value, "commas")."MB") | fields size But this query will return results of all splunk servers. I want to show custom values of indexers only, but there is no option to select indexers. Is there anyway we can customise it within MC. TKs ... View more

Hi all, I want to send syslog data directly from a Fortinet Firewall (remote site) to our Splunk Server via Internet. I want to encrypt the data while transferring the data via the Internet. Is it possible to do this without a syslog collection and a forwarder? Tks ... View more

Hi all, I have a problem when I tried to parse EventID=1 in wineventlog. The message look like this: 03/05/2020 09:01:58 AM LogName=System SourceName=Microsoft-Windows-Kernel-General EventCode=1 EventType=4 Type=Information ComputerName=H7Y2.nap.net TaskCategory=5 OpCode=Info RecordNumber=5763 Keywords=Time Message=The system time has changed to ‎2020‎-‎03‎-‎04T23:01:58.500000000Z from ‎2020‎-‎03‎-‎03T00:38:07.829890100Z. Change Reason: System time synchronized with the hardware clock. Process: '' (PID 4). When I used regex to parse the time from Message field. There is 1 unseen character before and after each number. Hence the command: | eval time_from = strptime(stime_from, "‎%Y‎-‎%m‎-‎%dT%H:%M:%S.%N") doesn't work because it doesn't have the unseen characters. Tks Linh ... View more

Hi, I ran a query: | ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="sAMAccountName,distinguishedName,lastLogon,lastLogonTimestamp,division" I found there are couple accounts witch lastLogon is null. But that field has value when I check that account in Active Directory. It is confusing because only some accounts have that issue. Tks Linh ... View more

Hi, I keep receiving the warning message related "Search peer xxxxxx03 has the following message: Dispatch Command: The number of search artifacts in the dispatch directory is higher than recommended (count=7948, warning threshold=5000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf / dispatch_dir_warning_size". I keep cleaning the that SH (other 3 SH don't have problems) dispatch folders, but the job increases very fast. I figured out that the dispatch folder has about 5000 records of rsa_scheduler. Many are more 2-3 hours old which are strange. So how can I know the Period of the scheduler search and where it is replicated from? For example: drwx------. 2 splunk splunk 263 Sep 16 14:03 rsa_scheduler_nobodynmonRMD5ee48120c2dd6c8cc_at_1568606400_26400_546F2A6F-BFB1-4954-9173-74A67615D481 drwx------. 2 splunk splunk 363 Sep 16 14:03 rsa_schedulernobodyuberAgent_RMD5b4e9f6a64f89a433_at_1568561400_15572_54E1D115-8124-4FE4-A9EB-5B4AADB08D33 Tks. ... View more

Hi all, I am working an LDAP add-on I have two panels: 1. Group: Group Name | Count Member 2. Member Details: Name | Group Name. And Group panel has multiselect input, while member panel has text input. As in AD we know that a member can belong to many groups, and a group can have many users. So when I click on a member record, I want to Group Panel to display all groups that member belongs to; and the multiselect input will display those groups name too. I have try to set token $group_tok$ but after the token is set, the query looking for group doesn't run at all | inputlookup ldap_group_members_kv_lookup where Members='click.value2' Does anyone have any idea? Tks Louis. ... View more