Hello there, I am new to Splunk. I had configured my universal forwarder in order to send data to the indexer. The universal forwarder is a Linux server and running the command netstat -an | grep 9997 I can see that tcp packages are being sent to the indexer, but the status is 'TIME_WAIT'. While my indexer is a windows 10 desktop, I have added permission to accept tcp and ICMP packages, but still, I can't find the data I want on the splunk instance installed on the indexer (or any other data concerning the forwarder).  My question is then, what can I do in order to receive the packages on the indexer please? PS: I have another indexer which is a Linux desktop, and it works just fine, I can find the forwarder data. PS': Here is the link for the tutorial I've been following in order to configure the splunk instences I'm using Using the Universal Forwarder to gather data | Splunk Operational Intelligence Cookbook (packtpub.com) Any help would be appreciated ! Regards,

Can I use Splunk REST API to get data from Splunk Cloud? Can someone give me some examples? I have read some documents on how to get data from Splunk Cloud but not really understand? Any help is highly appreciated.

index=* namespace="dk1017-j" sourcetype="kube:container:kafka-clickhouse-snapshot-writer" message="*Snapshot event published*" AND message="*dbI-WAR*" AND message="*2022-03-29*" AND message="*" |fields message |rex field=_raw "\s+date=(?<BusDate>\d{4}-\d{2}-\d{2})" |rex field=_raw "sourceSystem=(?<Source>[^,]*)" |rex field=_raw "entityType=(?<Entity>\w+)" |rex field=_raw "\"timestamp\":\"(?<Time>\d{4}-\d{2}-\d{2}[T]\d{2}:\d{2})" |sort Time desc |dedup Time |table Source, BusDate, Entity, Time     output of above command is below ------------------- Source BusDate Entity Time dbI-WAR 2022-03-29 BOOKING 2022-03-30T02:05 dbI-WAR 2022-03-29 DATA_QUALITY_REPORTS 2022-03-30T02:04 dbI-WAR 2022-03-29 DATA_QUALITY_ENTITIES 2022-03-30T02:03 dbI-WAR 2022-03-29 COMBINED_POSITION_NORMALIZED 2022-03-30T01:40 dbI-WAR 2022-03-29 COMBINED_POSITION 2022-03-30T01:36 dbI-WAR 2022-03-29 DATA_QUALITY_ENTITIES 2022-03-30T01:35 dbI-WAR 2022-03-29 DEPOSIT 2022-03-30T01:34 dbI-WAR 2022-03-29 DATA_QUALITY_REPORTS 2022-03-30T01:33 dbI-WAR 2022-03-29 DATA_QUALITY_ENTITIES 2022-03-30T00:43 dbI-WAR 2022-03-29 NEXT_BUSINESS_DAYS 2022-03-29T23:49     question - i would like to line chart  x axis should be date as date is same for all  &  y axis should be time 

We have a distributed architecture  Search head cluster with 6 hosts across 3 data centres Index cluster with 6 index peers and 1 index master  Forwarders on all servers in environment  - web tier, app tier, load balancer tier Few months back , web tier stopped sending - log stopped coming to splunk ; but other tiers are are working  When checked the activity on web-tier , there was a patching happened and splunkd was restarted -after that forwarding stopped in web-tier  But splunkd process came up fine - still running in those  And observed below WARN messages started coming exactly same time  [ See the highlighted in red starting from 10 seconds it grows ] WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group index_peers has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. ---------- ------ +0000 WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group index-peers has been blocked for 9725460 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. +0000 WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group index-peers has been blocked for 9725470 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. =============================================================================  Why we picked this WARN message may be cause - as same happened in other tier recently  load lancer tier stopped stopped forwarding recently. Above WARN started showing  same time onwards - starting with  "blocked for 10 seconds  "   splunk forwarder is running fine in all these  App tier still working -sending data , so indexers are fine  not disk space or memory issue in any of these  No config changes done any where ( inputs or outputs conf or any file that matter) -its same , just that stopped working suddenly    What could have caused this sudden stopping of forwarding ? Splunk Enterprise Version:7.2.1Build:be11b2c46e23    

I have a macro named X that uses the lookup in the search and produces the results as follows  indexes index IN ("ABC","DEF")   where as indexes is column name   Now I want to use the macro X result (index IN ("ABC","DEF")) in a separate search as follows    my_search | where `X` which should execute as below my_search | where index IN ("ABC","DEF")   Now how can I achieve that?  

Hi, i have a Trellis view single value where it shows the statues of up/down. When the status is down, i would like to get a sound alert. Is it possible in Splunk? Please let me know, if there is a way of adding audible alert based on the query condition. Thank you!  

I have a single value trellis view where it shows the status of items up (Green) and down (Red). When the status is down (Red), i would like to get the trellis view to flash or blink. I added the html code below to my trellis view, however all statues green/red are flashing now. I would like the statuses or red items to flash only. Please let me know if there is a way to achieve this in Splunk dashboard. Thank You!   <panel depends="$alwaysHideCSSPanel$"> <html> <style> @keyframes blink { 100%, 0% { opacity: 0.6; } 60% { opacity: 0.9; } } #singlevalue rect { animation: blink 0.8s infinite; } </style> </html>