Hello there,  i've a report that is scheduled as follows: * * * * *  But in the next scheduled time i got 2022-01-20 11:53:40 CET but i want 2022-01-20 11:53:00 CET   Is there a way to set seconds?   TY

I have a problem when I set DLTK containers. I chose Golden Image CPU (3.7) from the list and I already pull phdrieger/mltk-container-golden-image-cpu:3.7.0 to the local docker, but always have the error say [list index out of range] Can someone help me, that would be great  

I have created a bar graph. The following is the query. index= "cx_metrics_analysis" sourcetype="cx_metrics_httpevent" | eval duration=floor((TASK_DURATION)/3600000)| bin duration span=2s|chart distinct_count(TASK_NUM) as "Tasks" by duration | bin duration span=2 Since the bar graph is having a lot of values in x axis i'm trying to limit the values. I'm trying to group the values into 3. One which has duration less than 15, second one having duration between 15 to 25 and last one having duration greater than 25. | eval red = if(duration>25,duration,0) | eval yellow = if(duration<=25 AND duration>15,duration,0) | eval green = if(duration<=15, duration, 0) Is this the correct method to do this? Anyone knows how to solve this?

Hi Splunkers, I am experiencing issues with an index cluster and it would be great if you could help me out. Every time I change or create an index a restart is required and it takes up to an hour until all the indexers are ready again. This used to work without a restart and only started happening after an upgrade at some point. I found this, but that doesn't say anything about creating indexes. Do you have an idea where this is coming from exactly and if it can be avoided in some way? Since changes are made weekly, it is really annoying.

After reviewing the Intelligence Audit Events, the following error message shows up, it seems that the feed cannot write to intel. Any idea?   2022-01-20 09:24:09,703+0000 ERROR pid=28186 tid=MainThread file=threat_intelligence_manager.py:process:432 | status="Error when writing output - threat intelligence may be incomplete." filename="/opt/splunk/etc/apps/SA-ThreatIntelligence/local/data/threat_intel/2022-01-18T11-23-26.053064.xml" Traceback (most recent call last): File "/opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/threat_intelligence_manager.py", line 427, in process self.write_output(filename, metadata, intel) File "/opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/threat_intelligence_manager.py", line 497, in write_output time_field='time' File "/opt/splunk/etc/apps/SA-Utils/lib/SolnCommon/kvstore.py", line 150, in batch_create response, content = splunk.rest.simpleRequest(uri, sessionKey=session_key, jsonargs=json.dumps(records)) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 500, in simpleRequest raise splunk.SplunkdConnectionException('Error connecting to %s: %s' % (path, str(e))) SplunkdConnectionException: Splunkd daemon is not responding: ("Error connecting to /servicesNS/nobody/DA-ESS-ThreatIntelligence/storage/collections/data/threat_group_intel/batch_save: ('The read operation timed out',)",)

HI All, I am looking for host mapped to a list of app in the serverclass using the btool command but unfortunately I am unable  to get details.   ./splunk cmd btool serverclass list --app="test-fwd-p" --debug | grep -i "testhost*"     Please correct me if the above syntax is in correct. 

Getting the following message in splunkd logs ERROR CMRemotePrimaryManager - Failed to evict delete for bid=index_name~XXXX.XXXX.XXXX as part of onPrimary initialization task, delete files might not be synced Please help fix this issue. Thanks

I would like to send a monthly  report with month and year in the Subject , like   "Report for 01/2021" I have done  "Report for  - $trigger_date$" , but now I want to print the month and year only  How I can do it  ? 

Hi, When I ran the command ./splunk list forward-server , we are getting below error message. Active forwards: 10.20.30.40:9997 Configured but inactive forwards: None Can you please help me to troubleshoot the below error? Regards, Rahul Gupta