Hi it depends how you have configured your environment. If you are using FQDN in every configurations then it shouldn't need any changes after you have updated your DNS. But if you are using IP then you must change those to correct ones or preferred way to use FQDN. Depending your configuration there could be some IPs which has detected automatically, but this is depending on your configuration (mainly in distributed environment with indexer clusters). r. Ismo

Hi @trashyroadz    @richgalloway  Thank you for your inputs. I think I got confused between search bundle and deployer bundle. So, I think I need to check the bundle in /opt/splunk/var/run/searchpeers in search head. I guess I can also whitelist/blacklist the items that needed to be sent to indexer in the distsearch.conf of search head(captain). Please correct me if it is wrong. There is another issue that we are facing because of which I thought both are related and I started checking the deployer bundle.  When we are executing a bundle push command from deployer, it is always taking more than 30 mins to complete and sometimes not getting the successful message/error message. There are many apps and I dont think increasing maxBundleSize will help in reducing the time taken for bundle push. Can you please suggest on this as well.

Hi @aditsss, sorry, but if you use a fixed (for all events) value for EBNCStatus, you'll have always only one value in this field, so when you'll dedup for this field, you'll always have one value! Could you better describe your requirement? Ciao. Giuseppe

Hello gcusello, Thanks for your inputs, However, like  I said the use case is I'm looking for IP that is causing maximum number of http errors(400s,500s) , lets say I'm trying to find a single IP that is causing  over 100 http errors . I think in the query we will have to use eval&case functions too. Please let me know if you need further clarifications on the above. Moh.

Hi @mohsplunking, if you need the total count of errors, the solution from @bowesmana is perfect. let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors

Hi @Jana42855, the first step is to know the data to search, otherwise it's very difficoult! Anyway, you could start to run a search like the following: index=<your_index> (src=* OR dest_ip=* OR dest_port=*) in this way you have all the events containing these fields. then you can analyze them  and identify index and sourcetype to use. Remember that you can see only the indexes where you were enabled, in other words, if you don't have grants to access an index you don't see it. Ciao. Giuseppe