I have a few spreadsheets that are ingested into Splunk daily.  What is the best method to refresh the data, so I don't end up with duplicates? I am looking to do something like this: Today: Ingest spreadsheet.csv Tomorrow: delete previous data for spreadsheet.csv and then ingest new data Thanks, Garry ... View more

Hi, I am trying to figure out how to use join to table the results from 2 searches. sourcetype=AAD_MSGraph_UserData AAD_OnPremSID AAD_Email AAD_UserType AAD_LastSignInDateTime AAD_LastNonInteractiveSignInDateTime AAD_LastPWChange sourcetype=AD_UserData AD_SID AD_UserPrincipalName AD_LastLogon JOIN ON: AAD_OnPremSID AND AD_SID TABLE RESULTS: AAD_OnPremSID, AAD_Email, AAD_UserType, AAD_LastPWChange, AAD_LastSignInDateTime, AAD_LastNonInteractiveSignInDateTime, AD_LastLogon   Thanks! Garry ... View more

Hello, I have all auditing enabled via GPO and I am getting WinEventLog:Security logs in Splunk.  I am attempting to generate an alert when a user or group is added to local admin on a host.  I see the SID that gets added in the Win event log on the host showing as the group or account name, but I see the corresponding event in Splunk showing the same entry as the alpha/numeric SID.  How can I view the account or username in Splunk for these events?   Thanks, Garry   ... View more

Hello, We have a rather noisy agent that is logging about 19GB of data daily.  How can I filter the following from the inputs.conf?   Process Information:    Process ID: 0x1450  Process Name: C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.1.5.14\ir_agent.exe     Thanks,   Garry ... View more

Hello, I am encountering an issue with the event times for a specific set of logs.  We have been using Splunk Cloud for a little over a year now and I haven't experienced this issue with other sources/data. Most of the servers are located in PST and the events are being logged UTC.  The software vendor has a TA that is supposed to fix time issues on ingest, but that hasn't been updated since 2018 and Splunk won't install it on the Cloud tenant.   How can I enforce the proper time zones at the HWF level?  We have a HWF in each region where the logs are originating.   Thanks, Garry ... View more

Hello, I am working on upgrading from an older version of the Palo Alto Network App for Splunk. I have installed the TA on all indexers and the APP/TA on the search head. Most of the dashboards are being populated with data, but the GlobalProtect dashboard has nothing. I am seeing info in the pan_logs for GlobalProtect, but I don't see any reference to GP in the Pan Firewall Data Model. I see that the dashboard panels are making reference to: datamodel="pan_firewall" WHERE nodename="log.system.globalprotect" I've looked through the entire data model and don't see any reference to globalprotect. Splunk Version Version: 7.2.0 Build: 8c86330ac18 Palo Alto Networks Add-on 6.2.0 Palo Alto Networks App for Splunk 6.2.0 Data being sent from firewalls to splunk via UDP input Thanks, Garry ... View more