Hi, you have top stop splunk first. If you started it with root permissions, you have to stop it as "root". Change owner of /opt/splunk directory to you splunkuser (chown -R splunkuser:splunkgroup /opt/splunk) Please replace my splunkuser example with the username and the group you did choose to run splunk in you environment. After you did this, you should try to start is as splunkuser. Afterwards you can set the boot-start by doing the command @klischatb named: /opt/splunk/bin/splunk enable boot-start -user splunkunser Hope this helps. Please let us know. ... View more

Hi Gyr1991, I can provide following regex file_hash\=(?<EXTRACTION1>\w+)\s+ or just for the letters and numbers: file_hash\=(?<EXTRACTION1>[[:alnum:]]+)\s+ You can use one of them in the fields-extractor of splunk. Hope this helps 🙂 Kind Regards, Michael ... View more

Hi sugername, can you please provide more details? What does your stats command look like? I woud suggest the easiest way was to change x and y-axis within the stats command. Kind regards, Michael ... View more

Hi niranjan28, can you please describe your setup? Is there a Splunk Universal Forwarder sending data to your Indexer? If yes: Does it get listed in your Monitoring Console correctly? Kind regards, Michael ... View more

Hi Nadhiyaa, may be this helps you getting started: \}\s+(?<EXTRACTION1>\w+)|on_realm:\s+(?<EXTRACTION2>\d) It will extract the lines below your headline "organisations on_realm" This should also work for extractig all of the relevant data: ^\s+(? \w+):\D+}|(? \w+).\w+:\s+{\s+[-]|\w+:\s+\d+\s+\w+:\s+\d+\s+\w+:\s+\d+\s+(? \w+)|:\s+(? \d+)\s+ ... View more