Currently when building a pivot table the default time is set to "All Time". Is it possible to set it to some other value? I've tried overriding it by adding the following entries to $SPLUNK_HOME/etc/system/local/ui-prefs.conf, but they have no effect. We're running Splunk 7.2.1. [pivot] dispatch.earliest_time = -7d dispatch.latest_time = now [search] dispatch.earliest_time = -7d dispatch.latest_time = now [default] dispatch.earliest_time = -7d dispatch.latest_time = now ... View more

Hello All, I'm using Service now add-on for Splunk and installed on Heavy forwarder. Through setup page in add-on I have added few tables data into Splunk. But the add-on not properly extracted the field values and few metrics tables also not visible in Splunk index. add-on version 4.0.0, Splunk version 7.2.1. can some one help me with what might causing this problem. ... View more

Hello Folks, I have enabled a notable in ES_app, which triggers if it finds any ip available from local_ip_intel.csv. Now I got a notable for one IP address, which I don't want it present in that list. when I start searching, that IP is not available in local_ip_intel.csv. but i can see a foot print in "ES_App"-->"Threat Artifacts"--> "network" dashboard with source path "/opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/lookups/local_ip_intel.csv" What might be causing, this false alert from ES_app where IP is not available in source csv file. ... View more

Hello All, I am a certified Splunk Architect and want to become certified Architect 2 exam. I have completed my cluster admin and troubleshooting splunk courses successfully. as per the revised pattern for Architect 2 have an exam to pass. I didn't get any details regarding this that, whether is this a multiple choice question exam (like admin certification) OR Lab exam ( like Architect certification)? can anyone help me with details. ... View more

Hello, My question is regarding "Splunk App for Enterprise Security". This app will trigger Notables and logging at index=Notable Once I have change the status of a notable to inprogress Or pending, where it logged? I would like to make a search query to find out from past 1 month how my team responded/closed the notables. could you please help. ... View more

Hello All, I would like to write a query for an IP which is targeting every day to my system. I would like to make a trend diagram OR alert to showcase these kind of IP's. But with time chart command, I am unable to fulfill the need. Example: one IP is scanning my system, every day at 8'O clock in the morning for past 7 days. Then it should trigger an alert. with time chart I can make the time line with spikes, but not able to trigger alert for above one. any suggestion? ... View more

I am using CylancePROTECT App for Splunk version 1.0.0. this app contains Threat Summary dashboard. here, searches are not pulling the results because of mismatching of fields. Though I changed field names in searches, few fields don't exist in logs. I know extraction of fields, but if logs doesn't contain them, how do these searches work? Is this problem with version? in later versions did this problem solved? Please suggest to me how to resolve this problem. ... View more

I want to send indexed data to a syslog server. I created "syslog1", and I want to send this indexed data only to the syslog server. Problem is, by default, my indexer is sending "main", "syslog1", and all other indexed data to the syslog server (which is unnecessary data). Is there any option I can send this "syslog1" data only to syslog? ... View more

Hi Community, I am trying to integrate AppDyanamics with Splunk. Metrics data is coming fine, but have problem with Events data. When I was placing the events URL from Appd, on the browser for checking it gives the below output events url: url=http://*.*.*.*:8090/controller/rest/applications/Stock%20Trade/events?time-range-type=BEFORE_NOW&duration-in-mins=1400&event-types=POLICY_UPGRADED&severities=WARN,ERROR and, I am checking the "_internal" index from Splunk side, I am getting the below errors ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\appdynamics\bin\events.py"" IndentationError: expected an indented block ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\appdynamics\bin\events.py"" IndentationError: unindent does not match any outer indentation level ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\appdynamics\bin\events.py"" for i, c in entities.items(): ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\appdynamics\bin\events.py"" File "C:\Program Files\Splunk\etc\apps\appdynamics\bin\events.py", line 143 INFO ExecProcessor - New scheduled exec process: python "C:\Program Files\Splunk\etc\apps\appdynamics\bin\events.py" I think there is a problem with Events.py? isn't it. I am using Splunk verstion: Splunk 6.2.3 (build 264376) Appdynamics version: AppDynamics Version 4.1.0.4, build 45 AppDynamics app version: appdynamics_41 ... View more

Hi Team, We did Splunk and AppDynamics integration successfully, but we are unable to get the button which leads user from Splunk to the AppDynamics. From the diagram above, we should get a "search in AppDynamics" option. Could you please guide me how to get this button to display? ... View more