All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Here  is what I can see on my own test instance. As you see there are a lot more information than only count of buckets. You can also click that magnifying glass and then you see the exact SPL ... See more...
Here  is what I can see on my own test instance. As you see there are a lot more information than only count of buckets. You can also click that magnifying glass and then you see the exact SPL query how to get this information. Then you can modify this for better answer your needs.  
Are you using the same Java version on both environments?
@jawahir007 its very tedious to specify the status of 11 month old bucket start and end time.  suppose data age of event is 427 days and I want to delete 30 days of data then it data age now wou... See more...
@jawahir007 its very tedious to specify the status of 11 month old bucket start and end time.  suppose data age of event is 427 days and I want to delete 30 days of data then it data age now would be 397.Now how can I identify the epoch of start and end time of bucket ?
@isoutamo  Yes you are correct.  The acceleration detail has an Summary Id , which does correspond to the savedsearch_name  _ACCELERATE_<redacted>_search_nobody_<Summary Id>_ACCELERATE_ This... See more...
@isoutamo  Yes you are correct.  The acceleration detail has an Summary Id , which does correspond to the savedsearch_name  _ACCELERATE_<redacted>_search_nobody_<Summary Id>_ACCELERATE_ This confirms the issue is the License Usage Data Cube  cube report/acceleration. I will need to adjust the search resources to prevent the skipping. Thank you!!!
@isoutamo  Yes From MC i can take refrence of number of bucket counts atleast.
Hi @uagraw01 : The Splunk SPL command below might be helpful for you... |dbinspect index=your_index In Splunk, the dbinspect command is used to gather detailed metadata about the index buckets in a... See more...
Hi @uagraw01 : The Splunk SPL command below might be helpful for you... |dbinspect index=your_index In Splunk, the dbinspect command is used to gather detailed metadata about the index buckets in a specified index or set of indexes. This command provides information about the state, size, and other characteristics of the index buckets, which can help with monitoring storage, troubleshooting indexing issues, and understanding how Splunk is managing the data on disk. Key Information Provided by dbinspect: Bucket ID: A unique identifier for each bucket. Index Name: The index to which the bucket belongs. Start and End Time: The time range of events contained within the bucket. Bucket State: The current state of the bucket, such as: hot: Currently being written to. warm: Closed and searchable. cold: Moved to colder storage. frozen: No longer searchable, either deleted or archived. thawed: Restored from archive (frozen) and searchable again. Size on Disk: The storage size of the bucket. Event Count: The number of events contained in the bucket. Size before Compression: The size of the bucket before compression. Example Use Cases: 1. Search for Buckets by State: To filter for buckets in a specific state (e.g., cold or warm buckets), you can modify the query like this: | dbinspect index=your_index | search state="warm" OR state="cold" | table bucketId, index, startEpoch, endEpoch, state, sizeOnDiskMB This query filters for buckets that are either in the warm or cold state and displays useful details such as the bucket ID, size, and time range 2. Analyze Bucket Sizes: You can use dbinspect to analyze how much storage each bucket is consuming and understand your disk usage: | dbinspect index=your_index | stats sum(sizeOnDiskMB) as totalSize by index This query calculates the total disk size used by the specified index. 3. Find Old Buckets: To find the oldest buckets in an index based on their time ranges: | dbinspect index=your_index | sort startEpoch | table bucketId, index, startEpoch, endEpoch, state, sizeOnDiskMB This helps to identify which buckets contain the oldest data and may be candidates for deletion based on your data retention policies. ------ If you find this solution helpful, please consider accepting it and awarding karma points !!    
I am working on obtaining all user logins for a specified domain, then displaying what percent of those logins were from compliant devices. I start by creating a couple fields for 'ease of reading' -... See more...
I am working on obtaining all user logins for a specified domain, then displaying what percent of those logins were from compliant devices. I start by creating a couple fields for 'ease of reading' - these fields do produce data as expected, however, the table comes out with 'null' for the percent values. I have tried the below variations in pipeflow unfortunately with similar results - when trying to create a 'total' value by creating then combining compliant and noncompliant to divide, the total field does not have data either. base search | eval DeviceCompliance='deviceDetail.isCompliant' | eval compliant=if(DeviceCompliance="true",DeviceCompliance,null()) | stats count as total by userPrincipalName | eval percent=((compliant/total)*100) | table userPrincipalName total percent base search | eval DeviceCompliance='deviceDetail.isCompliant' | eval compliant=if(DeviceCompliance="true",DeviceCompliance,null()) | eval noncompliant=if(DeviceCompliance="false",DeviceCompliance,null()) | eval total=sum(compliant+noncompliant) | stats count by userPrincipalName | table userPrincipalName compliant total | eval percent=((compliant/total)*100) | table userPrincipalName total percent  
I have to create a base search for a dashboard and I am kinda stuck. Any help would be appreciated. index=service msg.message="*uri=/v1/payment-options*" eHttpMethodType="GET" | fields index, msg.s... See more...
I have to create a base search for a dashboard and I am kinda stuck. Any help would be appreciated. index=service msg.message="*uri=/v1/payment-options*" eHttpMethodType="GET" | fields index, msg.springProfile,msg.transactionId,eHttpStatusCode,eHttpMethodType,eClientId,eURI | dedup msg.transactionId | rename msg.springProfile as springProfile | eval profile = case(like(springProfile, "%dev%"), "DEV", like(springProfile, "%qa%"), "QA", like(springProfile, "%uat%"), "UAT") | eval request= case(like(eURI, "%/v1/payment-options%"), "PaymentOptions", like(eURI, "%/v1/account%"), "AccountTransalation") | stats count as "TotalRequests", count(eval(eHttpStatusCode=201 or eHttpStatusCode=204 or eHttpStatusCode=200)) as "TotalSuccessfulRequests", count(eval(eHttpStatusCode=400)) as "Total400Faliures", count(eval(eHttpStatusCode=422)) as "Total422Faliures", count(eval(eHttpStatusCode=404)) as "Total404Faliures", count(eval(eHttpStatusCode=500)) as "Total500Faliures", by profile, eClientId Now that I want to include the stats in the basesearch else my values/events  would be truncated. My problem is I need to also count  | stats count as "TotalRequests", count(eval(eHttpStatusCode=201 or eHttpStatusCode=204 or eHttpStatusCode=200)) as "TotalSuccessfulRequests" by request  for each of the profile such as Dev, QA,UAT to display in 3 different panels. How to incorparate this in the above basesearch
No, It gave the same error "Unauthorized access" 
Check out the custom Webhook Alert Action on Splunkbase. The default Webhook Alert Action allows you only to configure the URL. Custom Alert Webhook | Splunkbase
That was it!  Thanks for solving!
Hello, could you tell me about a real workaroud, this one is only disabling report, great thanks in advance... Best regards __ Philipp from France
I am using Splunk 9.2.2 Sorry that I forgot to mention the version of Splunk in the earlier version.  
Thanks @isoutamo .  The raw data contains some backslashes already:  \"TOPIC_COMPLETION\" So I had to perform my seach like this: index="..." "08:29:41.630" AND \\\"TOPIC_COMPLETION\\\" Now it's... See more...
Thanks @isoutamo .  The raw data contains some backslashes already:  \"TOPIC_COMPLETION\" So I had to perform my seach like this: index="..." "08:29:41.630" AND \\\"TOPIC_COMPLETION\\\" Now it's working properly. 
The mockup data contains events from both index1 and index2 (the first column of the dummy data). It is assumed to be an equivalent of searching over (index=index1 OR index=index2). Did you copy-pa... See more...
The mockup data contains events from both index1 and index2 (the first column of the dummy data). It is assumed to be an equivalent of searching over (index=index1 OR index=index2). Did you copy-paste my example search raw or did you modify it? And which Splunk version are you using?
Hi here is how this should work, but as there are some "magic" how those events are in buckets it's not as simple and doable as you could expect 2.1) Just query from that index if there is event... See more...
Hi here is how this should work, but as there are some "magic" how those events are in buckets it's not as simple and doable as you could expect 2.1) Just query from that index if there is events before that retention time. But quite probably there are some events still. The reason for that is that smallest storage artifact/objet is bucket not an individual event. And one bucket can contain events from very large time span. 2.2) This is totally dependent of amount of data, your instances sizes and other resource aspects which always depends. 2.3) You could look from MC (monitoring console) Settings -> MC -> Indexing. -> Indexes and Volumes -> Index Detail: Deployment. This dashboard shows that information. r. Ismo
Hi you haven't add any SPL for query there. You could check and use Splunk Dashboard example app https://splunkbase.splunk.com/app/1603 for creating your own dashboards. <input type="m... See more...
Hi you haven't add any SPL for query there. You could check and use Splunk Dashboard example app https://splunkbase.splunk.com/app/1603 for creating your own dashboards. <input type="multiselect" token="sourcetype_token" searchWhenChanged="true"> <default>splunkd, splunk_web_service, splunkd_access</default> <!-- The final value will be surrounded by prefix and suffix --> <prefix>(</prefix> <suffix>)</suffix> <!-- Each value will be surrounded by the valuePrefix and valueSuffix --> <valuePrefix>sourcetype="</valuePrefix> <valueSuffix>"</valueSuffix> <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them --> <delimiter> OR </delimiter> <choice value="*">ALL</choice> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>0</earliest> </search> </input> Just add/modify <search><query>....</query></search> part into your form. r. Ismo
I am getting error "could not create search". How to fix this error ? xml:: <input type="multiselect" token="environment"> <label>Environments</label> <choice value="cfp08">p08</choice> ... See more...
I am getting error "could not create search". How to fix this error ? xml:: <input type="multiselect" token="environment"> <label>Environments</label> <choice value="cfp08">p08</choice> <choice value="cfp07">p07</choice> <choice value="*">ALL</choice> <default>*</default> <valuePrefix>environment =</valuePrefix> <delimiter> OR </delimiter> <search> <query/> </search> <fieldForLabel>environment</fieldForLabel> <fieldForValue>environment</fieldForValue> </input>
Hello Splunker!!   Here’s your question rewritten in a business context and structured in points: 1. Objective: To free up disk space by deleting 1 month of data from a specific Splunk index conta... See more...
Hello Splunker!!   Here’s your question rewritten in a business context and structured in points: 1. Objective: To free up disk space by deleting 1 month of data from a specific Splunk index containing 1 year of data. 2. Key Considerations: - How can we verify that the deletion of 1 month of data from Splunk indexes is successful? - How long does Splunk typically take to delete this amount of data from the indexes? - Is there a way to monitor or observe the deletion of old buckets or data using the Splunk UI (via SPL queries)?   Thanks in advance!!  
If you are using Splunk 9.x then linux kernel 3.1 support has removed https://docs.splunk.com/Documentation/Splunk/9.3.1/ReleaseNotes/Deprecatedfeatures