Hi. We are using Splunk version of 7.1.3 and DB connect version is 3.6.0. We are planning to upgrade it by end of the year. Before that we are facing an issue as it shows only " Parsing search " for long period of time when we we try to run a DB query. Could someone suggest what may be the issue and how it gets resolved?

Hello, is there any way we can extract fields from this sample data, any help will be highly appreciated. Thank you!   2022-07-22 17:21:50 - { "type" : "core", "r/o" : false, "booting" : true, "version" : "7.2.9.GA", "user" : "anonymous", "domainUUID" : null, "access" : null, "remote-address" : null, "success" : true, "ops" : [ { "operation" : "add", "address" : [{ "system-property" : "dstest.tx.node.id" }], "value" : "vp2mbg_c001_r3050" }, { "operation" : "add", "address" : [{ "system-property" : "jdk.tls.client.protocols" }], "value" : "TLSv1.2" }, { "operation" : "add", "address" : [{ "system-property" : "org.apache.coyote.ajp.DEFAULT_CONNECTION_TIMEOUT" }], "value" : "600000" }, { "operation" : "add", "address" : [{ "system-property" : "org.apache.coyote.ajp.MAX_PACKET_SIZE" }], "value" : "65536" }, { "operation" : "add", "address" : [{ "system-property" : "javax.net.ssl.trustStore" }], "value" : "/opt/app/dstest/ssl/cacerts.jks" }, { "operation" : "add", "address" : [{ "system-property" : "javax.net.ssl.trustStorePassword" }], "value" : { "EXPRESSION_VALUE" : "${VAULT::vb::truststorepass::1}" } }, { "operation" : "add", "address" : [{ "system-property" : "javax.net.ssl.keyStore" }], "value" : "/opt/app/DSTest/ssl/tccs-proddr.keystore" }, { "operation" : "add", "address" : [{ "system-property" : "javax.net.ssl.keyStorePassword" }], "value" : { "EXPRESSION_VALUE" : "${VAULT::vb::certpass::1}" } }, { "operation" : "add", "address" : [{ "system-property" : "tcp.allow.dev.esa.token" }], "value" : "true" }, { "operation" : "add", "address" : [{ "system-property" : "tccs.allow.dev.esa.token" }], "value" : "true" }, { "operation" : "add", "address" : [{ "system-property" : "CLAS.ENVIRONMENT" }], "value" : "prod" }, { "operation" : "add", "address" : [{ "system-property" : "TCCS.ENVIRONMENT" }], "value" : "prod" }, { "operation" : "add", "address" : [{ "system-property" : "agent.user" }], "value" : { "EXPRESSION_VALUE" : "${VAULT::vb::agentuser::1}" } }, { "operation" : "add", "address" : [{ "system-property" : "agent.password" }], "value" : { "EXPRESSION_VALUE" : "${VAULT::vb::agentpass::1}" } }, { "address" : [{ "path" : "DSTest.server.ADCredStore.dir" }], "operation" : "add", "path" : "/opt/app/DSTest/profiles/instances/tccs/ADCredStore" }, { "address" : [{ "path" : "DSTest.ssl" }], "operation" : "add", "path" : "/opt/app/DSTest/ssl" }, { "address" : [{ "core-service" : "vault" }], "operation" : "add", "vault-options" : [ { "KEYSTORE_URL" : "/opt/app/DSTest/profiles/instances/tccs/configuration/eap7vault.keystore" }, { "KEYSTORE_PASSWORD" : "MASK-0dF/GimhesRBlxgjOeSNqf" }, { "KEYSTORE_ALIAS" : "vault" }, { "SALT" : "147asa2900" }, { "ITERATION_COUNT" : "8" }, { "ENC_FILE_DIR" : "/opt/app/DSTest/profiles/instances/tccs/configuration/" } ] }] }  

    platfrom      bkc_name     domain   testcase_id    tnl                 abzke             hef                  gh_102    asc                   kit1            touch                ig_103   sou                   kit2            hub                     jk_104   img                   kit3             hub1                 lk_105 ------------------------------- sub_gruop    platfrom      bkc_name     domain   testcase_id wow                   20                        19                  15                    12 audio                10                         16                   11                    13 sound                25                        30                  18                    19  

I have a kvstore like below populated with about 1mil rows.  _key name count1 count2 calculated_number1 calculated_number2 sha256 hash Joe Cool  1 2 3 4   How can I update the kvstore where I update the two counts and recalculate the two calculated numbers based on the newly updated counts? I am trying not to read in all 1 million rows and overwrite if I dont have to.  Any potential pathways are welcome and I am here to learn. Thank you all.   

We run a number of machine learning models and routinely run into limitations of the "knowledge bundle" getting too big with errors like this bundle errors   We increased the limits.conf to alleviate it but error came back after a few more models were made. I've noticed that these likely need to be included in the knowledge bundle since they are not explicitly blacklisted from the distsearch.conf         [replicationSettings:refineConf] replicate.algos = true replicate.mlspl = true replicate.scorings = true [replicationBlacklist] non_model_lookups = apps[/\\]Splunk_ML_Toolkit[/\\]lookups[/\\](?!__mlspl_)*.csv non_model_lookups_docs = apps[/\\]Splunk_ML_Toolkit[/\\]lookups[/\\]docs[/\\]...         Now looking at the users directory there are a lot of double ups.  /opt/splunk/etc/users/theusername/Splunk_ML_Toolkit/lookups users ML lookup directory Is there a way to get rid of these _draft_ ones in the Machine Learning GUI?  

Hi, I have my current search giving below output, I want to have stats listed by Month. Can someone help on this one Current Search:  my search |  eval True=(total1-total2) | eval False=round(False/(True+False)*100,2) | table False Output:        False                         42.12   Desired Output:  Month      False August    42.12 July           xx.xx june           xx.xx . . .

[tcp-ssl://9515] disabled=0 index = myindex connection_host = ip sourcetype = mysourcetype _TCP_ROUTING = myindexcluster   The above will allow raw events and default fields to be put into the indexer.  The below allows indexed csv fields (structured) to be put into the indexer. The props.conf entry for the sourcetype is used by both tcp and disk file input. I am using identical csv files as data for each. Why cannot the tcp ingested csv file be indexed by the forwarder and sent to the indexer?       [batch:///data/myfolder] move_policy = sinkhole disabled = 0 index= myindex sourcetype = mysourcetype crcSalt = <SOURCE> recursive = false _TCP_ROUTING = myindexcluster

Hi all! So I am helping the networking team transition their logging to Splunk and last week I discovered the Cisco Meraki Add-on.  Also discovered that in order to install the add-on as well as configure any part of it; connection, inputs, etc.. that I needed a pretty high permission level.  (requires capacity: admin_all_objects) Since I am not a Splunk "admin" here at work.. I am wondering if there an existing role that might allow me to configure add-ons but not allow me to manage "all_objects"? Our actual Splunk Admin is a super busy guy so I am trying to help him out on this. I do have a higher level of access than most but all objects on an add-on seems incredibly silly. Thanks!!

Hi We have a situation in PCI compliance app. The alerts are triggered and are acknowledge. A user from the ISOC has acknowledge all the alerts  So we are trying to roll it back.  Is there is any chance to do that.