Hi all, getting to grips with SPL and would be forever grateful if someone could lend their brain for the below:   I've got the lookup in the format below: (Fields) -->  host, os, os version ----------------------------------------- (Values) ---> Server01, Windows, Windows Server 2019   But in my case, this lookup has 3000 field values, I want to know their source values in Splunk (This lookup was generated by a match condition with another, so I KNOW that these hosts are present in my Splunk env)   I basically need a way to do the following:   "| tstats values(sources) where index=* host=(WHATEVER IS IN MY LOOKUP HOST FIELD) by index, host"   But i can't seem to find a way, I did try to originally match the below:   | tstats values(source) where index=* by host, index | join type=inner host | [|inputlookup mylookup.csv | fields host | dedup host]   But my results were too large to handle by Splunk, plz help ... View more

Hi all, I'm looking at volume of indexes and how much they ingest to calculate the volumes of licenses. I am aware I could find this answer straight away but I like to investigate further     I'm not sure on how to construct a SPL search that looks at just metrics indexes and checks how much volume they use up of the daily licesning quota per day   Anyone can help me with this? ... View more

Hi all, could someone please explain how licensing works for both Events and Metrics in Splunk Cloud. I've looked at other posts in the Splunk Community but they don't really make sense.    Would love a fresh answer to see if there are any differences/updated explanations     Cheers ... View more

Hi all, I have been looking at my Splunk CMC for a customer and have noticed that the ingest per day has been up and down since early November, I have had a look at the CMC (cloud monitoring console) but for some tabs, the graphs shown by default won't let me go back to November to find trends such as "daily event count per day in November"   Could someone guide me on why this is & what would be a good place to start on this investigation. For context:   Arch is: UF --> HF --> SC SC4S --> SC Cloud data --> HF --> SC ... View more

Hi all,   I am coming from Splunk on-prem so this is a bit confusing to me. I have looked at architectures regarding Splunk Cloud and can't understand how data configs are done when using Splunk Cloud. For example, let's say:   - You have a UF on a machine that forwards data to Splunk Indexers (cloud), you are to make a custom sourcetype for this specific piece of data. Where would you define the parsing rules for this if you don't manage the Indexers. Furthermore if the data can be on-boarded with a TA, how would you install this TA onto the indexers to assist with onboarding (assuming no need for HF)     Any help would be appreciated, thanks! ... View more

I have installed Splunk Enterprise free trial into a VM as a root user. I know the best practice is to avoid using root to run as Splunk in case the underlying OS gets compromised and then the hacker has access to your OS with root level. I am following the doc online and it says once you install Splunk as root, don't start the Splunk installation but rather add a new user and then change ownership of the Splunk folder to that new non-root user   But before I do that, when Splunk is installed I check its ownership and it's already configured to Splunk. Does this mean Splunk has already configured a non-root user automatically upon installation?   If so, how would I make sure it has read access to local files I want to monitor? ... View more

In the monitoring console of the Splunk Cloud. If you click on Forwarders tab then the "Forwarders Deployment" option. Scrolling down a bit until you see "Status and Configuration - As of <timestamp>".   The timestamp that I see is outdate by 6 months from todays date. So I see the timestamp 19/03/2023 13:09:03+1:00. I am confused as if I type in an Instance in the box, I get data live from when the Instance was last connected to the indexer with the timestamps being in the <15mins ago for active forwarders.   What does it mean if your timestamp is wrong? What sort of fixes can i take to try and solve this?     ... View more