I came across one known issue of uploading the pcap files from UI: https://docs.splunk.com/Documentation/StreamApp/7.2.0/ReleaseNotes/Knownissues
You can try the following command:
./streamfwd -r pcap_file_path
... View more
@vector_sec
The Splunk Add-On for Office 365 consists of a Tenant and Input page where you can do your Configuration.
So I think below link will work for you:
For tenant configuration: https ://[splunk hostname:port]/en-US/app/splunk_ta_o365/tenant
For Input Configuration: https ://[splunk hostname:port]/en-US/app/splunk_ta_o365/input
For logging and proxy settings: https: //[splunk hostname:port]/en-US/app/splunk_ta_o365/settings
... View more
Where are you not seeing the splunk_app_stream folder in search head or heavy forwarder?
Is the Splunk_TA_stream folder is present at $SPLUNK_HOME/etc/apps/ ?
... View more
1) Navigate to Stream App -> Admin Dashboards -> Stream Forwarder Status dashboard. Check the status of the Stream forwarder. Also, check the Total events dashboard. From there you can identify whether stream app is indexing data or not.
2) In the Search bar, run this query sourcetype= stream:* . If search query returns no result, then Stream App is not indexing any data into Splunk.
... View more
From logs, it seems like the pooling stanza is missing in the default/server.conf file. Add the pooling stanza https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Serverconf and the web UI will be accessible.
... View more
According to me, you have to mention field name in rex, which you can use further,
like (?<Name>//)
Please refer doc for more info:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex
... View more
The collect command stated in the question is correct and it will indexed the data in new index:
host="host_name" sourcetype="My_sourcetype" index="test" | collect index="new_index" host="host_name" sourcetype="My_sourcetype"
... View more
I don't think there is a syntax error.
Because this query works for me. I am seeing events on my new_index. I used below query:
host="host_name" sourcetype="My_sourcetype" index="test" | collect index="new_index" host="host_name" sourcetype="My_sourcetype"
... View more
Have you created your destination_index in the indexer? I tried the same query of yours and it works for me, the events are copied to my new destination_index.
If the destination_index is not available then you will get below message :
Received event for unconfigured/disabled/deleted index='test' with source="source" host="my_host" sourcetype="my_sourcetype". So far received events from 1 missing index(es).
... View more
Have you upgraded your ServiceNow Add-on from 3.1.0 to 5.0.0? If yes, then you need to reconfigure your previously configured ServiceNow account. The link for the doc is: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Releasenotes#Upgrade
... View more
Please refer to this doc to see the compatibility of Splunk Universal Forwarder and Splunk Enterprise Indexers:
https://docs.splunk.com/Documentation/Forwarder/8.0.0/Forwarder/Compatibilitybetweenforwardersandindexers
... View more
I tried the query in regex101 and it takes 650 steps to match the regex. And the same query with little modification takes the 78 steps to match the regex. Here is the query:
error\s+message\s+(?<Message>.*(?=(\:\s+message\s+\:)))
... View more