Hi @aliyusuf,   were you able to get the issue resolved. We have a similar requirement. ... View more

were you ale to solve this issue? ... View more

were you able to find a solution for this? how did you improve performance for your UF ... View more

may be below inputs can help. let me know if this helps [monitor:///var/log/.../*.log] disabled = false index = rpi_logs sourcetype = linux_logs ... View more

Sid, There must be a field like action which provides details for if it is failed login or success login you can form a search as below index= (action = success OR action= failed) | stats count by user, action | sort -count | stats list(action) as login_type, list(count) as count by user Hope this helps. ... View more

do you have the path for this python script? ... View more

Hi Brettcave, I am not sure I understand your question completely but RF and SF are required to ensure you have data durability. I would not suggest to go for 3 rf and sf as u only have 3 indexers. I would suggest to go for RF 2 and SF either 1 or 2 depending on requirements. RF = 2 would mean that 2 copies of your data is available which would help in data availability in case of 1 of the server is not available SF = 2 would mean you have 2 searchable copies. but this would also require more disk space as well. ... View more

Hi Sukisen Thank you for suggestion but my we do not want to remove the backslash available. We wanted to parse that backslash as a filed value using delimiter. Looks like I have found a solution though I am just testing it and should post the answer soon. ... View more

Hi Richard, Did you find a solution for this I am facing similar challenge with my data ... View more

Could you tell me where are you trying to define the TZ value i would assume you have a heavy forwarder in place which is used to receive messages from syslog. If yes you can try to set TZ value in your HF it should work. Also, make sure that splunk is taking time from the logs by setting appropriate Time Prefix and Time Format. If still does not work can you give me more details so I can try to help you. ... View more

We don't want to append the data to any of the old lookup, it should be a new lookup created when the search returns any results. ... View more

No, it just search for the events and write it to lookup. We do not append data as it will become very huge with time going forward ... View more

The issue is mainly due to rising column value being null. The rising column field should be unique for splunk to identify any new data. You can check for the with your database administrator to add a key value to the current tables or use a timestamp filed if already available. if not you can also use cast to create a new field, example below and use this field as your rising column. Ensure you put some checkpoint value. cast( cast(datepart(year, eventtime) as varchar) + right('0' + cast (datepart(month, eventtime) as varchar),2) + right('0' + cast (datepart(day,eventtime) as varchar),2) + right('0' + cast (datepart(hour,eventtime) as varchar),2) + right('0' + cast (datepart(minute,eventtime) as varchar),2) + right('0' + cast (datepart(second,eventtime) as varchar),2) + right('0' + cast (datepart(millisecond,eventtime) as varchar),3) as numeric(18,0)) as numtime ... View more

The app is used to build dashboards and reports from Tanium logs and contain only search time operations. It needs to be installed on Search Head only. To integrate tanium with Splunk, tanium has inbuilt connector which can be configured to send tanium queries as events to Splunk(a total of 19 queries are executed by tanium). you need to enable a syslog input on specific port on your forwarder and set sourcetype to "tanium" in inputs.conf. ... View more