Hi Team, 1) I am searcing for APPAP100E cyber ark keyword error in splunk. we are not getting output .  2) I am searching for LicenseVerifier perticular word but not getting output. 3) I am searching for SSLHandshakeException error  but not getting event details output in splunk UI.4 please help & guide to resolve.   Thanks and regards

Hi Team, I am very new to Splunk Dashboard. Do you think we can form some SQL queries from the backend for any of the tasks below so that we can capture them via Splunk dashboard? 1. API Service UP/ Down 2. Response Time by UI API 3. Frequent Users 4. CPU Utilization 5. Mem Utilization 6. Login Statistics 7. API Error Report Database we use: HDFS   Regards, Harish

Hi All, I have query which return all the events for two Hybris pods. When I am using stats it shows the number of events under each pod but when I try to check events for particular pods it shows 0 events are there.  Attaching Snippet for better understanding. Please provide your suggestions.

I have a field 'Value'  in dashboard that is being validated by an external .js . When the validation match fails it shows the error message "Please input a valid Value". But when I ignore that message and hit submit button, it anyways submits that record. I want the dashboard not to submit, until I input the field with correct values and no validation message comes. I have so many input fields , but I am validating only the 'Value' field. And I don't want the user to be able to submit record while ignoring the validation message. =================================================== <input type="text" token="value" id="tkn_value_id" searchWhenChanged="true" depends="$some_condition$"> <label>Value</label> ======================================== require([ 'underscore', 'splunkjs/mvc', 'jquery', "splunkjs/mvc/simplexml/ready!" ], function(_, mvc, $) { var tkn_value = splunkjs.mvc.Components.getInstance("tkn_value_id"); tkn_value.on("change", function(e) { console.log(e) // e.preventDefault(); if (!isValueValid(e)) { alert("Enter Valid Value") return false; } }) function isValueValid(userInput) { console.log(userInput) var res = userInput.match(/(^\s|\"|\s$)/g) if (res == null) return true; else return false; } ======================================================== })

Hi All, I have created a Tools button (as shown in the below screenshot). I need to add the Edit,Export and ... button(Highlighted in yellow) inside of the Tools button.     When Tools button is clicked, the Edit,Export and ... should appear as a drop down under it. Please help with a jquery/XML for achieving this please.   Thank you!

Hi all, I'm planning an architecture with a redundant Heavy Forwarder and double Syslog collector Servers. Where do i place a Load Balancer? and how do these Components communicate in terms of Ports and Firewalls? What do i need to plan?  I cant find the right places to read about this in the documentation. Thank you for your help in advance. Oj.

Previously, my heavy forwarder is working fine. Able to search from latest logs in my searchhead. But upon testing another app for another SIEM in the heavy forwarder, it has been routing to there since. But after the POC ended, we want to switch back to sending it back to our splunk indexer.  We remove the app for the SIEM and left with our outputs for this forwarder which is towards the splunk indexer IP. I tried restarting the splunk service in this heavy forwarder but still unable to search those host in the searchhead.  Is there anything to look out for? 

How does DMC calculate load average?  I understand the number comes from rest api. But it does not explain how exactly the number is calculated. And the number is quite different from Linux Load Average when you use uptime command.   Thanks. Hanny.

We have Splunk 8.0.3 deployed to a private AWS cloud. We use AWS i3.8xlarge instance types for our indexers, recently upgraded from i3.4xlarge. We combine the 1.7TB "ephemeral" volumes into a logical volume group and use them for splunk index buckets mounted on /opt/splunk/var/lib/splunk. When we were running on i3.4xlarge instances where we had two 1.7 TB volumes, we were using 3 TB of the 3.4 TB logical volume group per indexer as Splunk  indexes. When we upgraded to i3.8xlarges we removed the old indexers and the new indexers are only using 200GB of the 6.8TB logical volume groups, slowly creeping up about 4GB/hour. I have tried running searches over long periods of time, but they fail with: ! DAG Execution Exception: Search has been cancelled ! Search auto-canceled ! The search job has failed due to an error.  You may be able view the job in the Job Inspector How do I get the cache volumes to fill up again quickly with index data from the S3 storage so my searches will be fast and complete again?