All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Can Splunk SmartStore enabled with single site Indexer clustering which is spanning across two AWS regions?  Ex: One set of Indexer Cluster located in AWS Region A and another Set of Indexer Cluster ... See more...
Can Splunk SmartStore enabled with single site Indexer clustering which is spanning across two AWS regions?  Ex: One set of Indexer Cluster located in AWS Region A and another Set of Indexer Cluster sitting in Region B, Can one s3  Remote Object Store used with all Indexers from both Clusters?  Thanks.
Hi @robertlynch2020, I'm not aware of a native method, although you could override the Splunk bar's behavior with a browser extension, assuming you control the browser. My preference is to customiz... See more...
Hi @robertlynch2020, I'm not aware of a native method, although you could override the Splunk bar's behavior with a browser extension, assuming you control the browser. My preference is to customize the launcher or provide a default app with customized navigation menus.
Hello Splunk community,   We have a device on the windows systeme. I tried to find a LOG file on it that is responsible for the Internet connection and connection quality. But unfortunately, this ... See more...
Hello Splunk community,   We have a device on the windows systeme. I tried to find a LOG file on it that is responsible for the Internet connection and connection quality. But unfortunately, this screen saves a limited amount of information in its LOG files regarding the Internet connection.   I wanted to know, does Splunk have a solution for such situations? Perhaps there is an application that we can install on this device that will allow us to erase the necessary LOGs?   Thank you in advance for you answer  
Can you share a screen cap of the options there but not available to click on? Interim shot in the dark - ask for a rolling restart on the ITSI SH or SHC - assuming you've done this before so shou... See more...
Can you share a screen cap of the options there but not available to click on? Interim shot in the dark - ask for a rolling restart on the ITSI SH or SHC - assuming you've done this before so shouldn't be a permissions/capability issue - perform a log out and clear cache on browsers, I know you've tried more than one already
The apps menu toggle recognizes individual unique apps.  The fact that it appears you have the same app multiple times is an indication the app is not designed per best practices.  Even if the versio... See more...
The apps menu toggle recognizes individual unique apps.  The fact that it appears you have the same app multiple times is an indication the app is not designed per best practices.  Even if the version number is in the title the app should be replacing itself so that you are only ever seeing the most recent install. Options a) Fix app so that it install over itself rather than creating unique instances b) Start removing older versions that serve no purpose anymore
Classic XML dashboards wont let you extend multiple rows.
We need more information.  How data will be ingested each day?  How long will that data be retained?  How much searching will the system perform? If you have a single indexer then there is no need f... See more...
We need more information.  How data will be ingested each day?  How long will that data be retained?  How much searching will the system perform? If you have a single indexer then there is no need for a Cluster Manager (f.k.a. Cluster Master) and the search head can serve as the License Manager on such a small system.  If larger ingest amounts and for better search performance, multiple indexers may be needed, which call for a Cluster Manager. Syslog data should not sent directly to a Splunk process.  Instead, send it to a dedicated syslog server (rsyslog or syslog-ng) and write it to disk.  Have a Splunk Universal Forwarder monitor the disk and forward the data to the indexer(s).
This is easy to do in Dashboard Studio. Either use absolute or grid layouts.
We are building a small Splunk installation in Azure and I'm not sure what the architecture should look like. The client came up with the idea based on the following link - Deploying Splunk on Micros... See more...
We are building a small Splunk installation in Azure and I'm not sure what the architecture should look like. The client came up with the idea based on the following link - Deploying Splunk on Microsoft Azure. They created an indexer, a search head, and a license server/cluster master. We do need to ingest syslog data from Meraki devices, so I wonder whether we need a heavy forwarder. Any thoughts?
I want to use HTML on multiple panels in order to create a custom layout of my Splunk Dashboard. I want to use this layout where each rectangle is a panel - Please advise. Is this possible to im... See more...
I want to use HTML on multiple panels in order to create a custom layout of my Splunk Dashboard. I want to use this layout where each rectangle is a panel - Please advise. Is this possible to implement in a Splunk Dashboard?
To be fully honest - I have no idea what you want to do. Please post a sample of your incoming data and tell us where you want it broken into separate events.
The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name | rex field=message "IamExample(?<total>).*" | rex field=message ".*... See more...
The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name | rex field=message "IamExample(?<total>).*" | rex field=message ".*ACCOUNT(?<accountreg>.*):" | rex field=message ".*Login(?<login>.*)" | rex field=message ".*Profile(?<profile>)" | rex field=message ".*Card(?<card>)" | rex field=message ".*Online(?<online>) " | stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online" | foreach * [| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%" | eval {name} = <<FIELD>>] | table " " Account:* Login:* Profile:* Card:* Online:*
index=test pod=poddy1 "severity"="INFO" "message"="IamExample*" | rex field=message "IamExample(?<total>).*" | rex field=message ".*ACCOUNT<accountreg>.*):" | rex field=message ".*Login(?<login... See more...
index=test pod=poddy1 "severity"="INFO" "message"="IamExample*" | rex field=message "IamExample(?<total>).*" | rex field=message ".*ACCOUNT<accountreg>.*):" | rex field=message ".*Login(?<login>.*)" | rex field=message ".*Profile(?<profile>" | rex field=message ".*Card(?<card>)" | rex field=message ".*Online(?<online>) " | stats count(total) as "Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online " Choosing a bar chart to display has "Total" show on the left hand side is there a way remove it? also hovering over the chart its showing the count is there a way to make it display like this example below? field, count , percentage we want to divide Account , Login , Profile, Online it by Total that we have above         
It is possible to break events on *anything*.  It would help to see a sanitized example of the events you wish to break, but these settings should help. SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\... See more...
It is possible to break events on *anything*.  It would help to see a sanitized example of the events you wish to break, but these settings should help. SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d\d:\d\d
@gcusello  Yeah it's odd. Neither of those 2 return any stats results (I checked to make sure I copied the whole query, updated as appropriate for indexes etc.) The original query is only giving 20... See more...
@gcusello  Yeah it's odd. Neither of those 2 return any stats results (I checked to make sure I copied the whole query, updated as appropriate for indexes etc.) The original query is only giving 20 entries under stats (and far less results) which used to work so that's also weird. What we've been doing is something along the lines of this:   index=test OR index=test2 source="insertpath" ErrorCodesResponse=TestError TraceId=* | fields TraceId | append [ search index=test "Test SKU" AND @mt !="TestAsync: Request(Test SKU: )*" | fields TraceId, @t, @mt, RequestPath | where isnotnull('@t') AND isnotnull('@mt') AND match('@mt', "Test SKU: *") ] | eval date=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%Y-%m-%d"), time=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%H:%M") | stats values(date) as date values(time) as time values(@mt) as message values(RequestPath) as Path by TraceId | where isnotnull(date) AND isnotnull(time) AND isnotnull(message) | table date, time, TraceId, message, Path This seems to work better than our old search but I'd prefer to try and figure out yours as it's not using those appended searches.
How to Break a multiple events into a single event based on timestamp? My logs doesn't have a date and it only has timestamp - For Ex - it starts as below format.. 17:22:29.875 Splunk version - ... See more...
How to Break a multiple events into a single event based on timestamp? My logs doesn't have a date and it only has timestamp - For Ex - it starts as below format.. 17:22:29.875 Splunk version - 9.2.1 i have tried many options in props.conf but no luck still i could see multiple events in my search and i couldn't see events are breaked as per each timestamp. will LINE_BREAKER works or BREAK_ONLY_BEFORE - tried both but no luck.. is it possible to break events with timestamp in splunk or it's possible to break events only with date and time ?? Thanks in Advance.
Submit a support request to delete the scheduled searches.  Include the old app name(s).
Some time ago, on Splunk Cloud, I deleted a couple of apps that were used only for testing. These apps had some alerts configured. Now, I see that those test alerts are still running. I found them b... See more...
Some time ago, on Splunk Cloud, I deleted a couple of apps that were used only for testing. These apps had some alerts configured. Now, I see that those test alerts are still running. I found them by searching: index=_internal sourcetype=scheduler app=<deleted app name> However, I can't see these apps in the app list anymore. How can I fix this? Thanks!
How to create custom datalink in Splunk observability cloud for passing filtered values from chart to identify the rootcause of the issue by navigating to APM,RUM,Synthetics page.    
Hi , we have instrumented sql server metrics using OTEL. https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/sqlserverreceiver/documentation.md we have a tempdb , ... See more...
Hi , we have instrumented sql server metrics using OTEL. https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/sqlserverreceiver/documentation.md we have a tempdb , 1.need to identify space usage , 2.And which query contributes to more tempdb usage using sqlserver receiver OTEL metrics?