Hello Splunk community, Let's say my input to Splunk is three csv files that use the following schema. Each csv populate an index: Faults, Incidents and Status For each Faults entry there is one (and just one) Status entry. That Status entry will have parent_id = id of that fault. In the same way there is also a 'Status' entry for each Incident. When I am querying Splunk or making dashboards I have to retrieve information not only from 'Faults' or 'Incident' indexes but also from 'Status'. That makes me use a lot of joining indexes queries like this:   index="faults" |join type=outer status_id [search index="status" | rename id as status_id]   I liked this solution at first because 'Faults' and 'Incident' indexes look very clean, but I have read that these types of SPL queries are computational expensive and I am concerned that perhaps this will not escalate well in the future. Should I perhaps modify the schema and remove the Status index and put all that information in the Faults and Incidents like this? Thank you all a lot in advance for your answers. Fran  

We have multiple environments and we have to check whether splunk logs indexed or not. Based on environment we have to run query. In this below query, it's running as: (Dev1 is missing in env=trafficui) index=*_dev sourcetype=WebSphere* OR sourcetype=http* env=trafficui OR env=trafficbatchDev1 NOT source=*/nodeagent/* NOT source=*/dmgr/* NOT source=*native_stdout* NOT source=*native_stderr* | stats min(_time) as FirstTime, max(_time) as lastTime by host index sourcetype source | convert ctime(FirstTime) | convert ctime(lastTime)</set>   But I wanted like: index=*_dev sourcetype=WebSphere* OR sourcetype=http* env=trafficuiDev1 OR env=trafficbatchDev1 NOT source=*/nodeagent/* NOT source=*/dmgr/* NOT source=*native_stdout* NOT source=*native_stderr* | stats min(_time) as FirstTime, max(_time) as lastTime by host index sourcetype source | convert ctime(FirstTime) | convert ctime(lastTime)</set>   Original Query: <form> <label>DEV1 - Logs Indexed</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="env_tok" searchWhenChanged="true"> <label>Select Environment</label> <choice value="Dev1">DEV1</choice> <choice value="Dev2">DEV2</choice> <default>Dev1</default> <initialValue>Dev1</initialValue> </input> <input type="dropdown" token="app_tok" searchWhenChanged="true"> <label>Select Application</label> <fieldForLabel>env</fieldForLabel> <fieldForValue>env</fieldForValue> <choice value="trafficui OR env=trafficbatch">Traffic</choice> <choice value="roadsui OR env=roadsbatch">Roads</choice> <change> <condition value="Roads"> <set token="new_search">index=*_dev sourcetype=WebSphere* OR sourcetype=http* env=$app_tok$$env_tok$ NOT source=*/nodeagent/* NOT source=*/dmgr/* NOT source=*native_stdout* NOT source=*native_stderr* | stats min(_time) as FirstTime, max(_time) as lastTime by host index sourcetype source | convert ctime(FirstTime) | convert ctime(lastTime)</set> </condition> <default>Roads</default> <initialValue>Roads</initialValue> </input> <input type="time" searchWhenChanged="true"> <label>Select Date</label> <default> <earliest>-1d@d</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>$new_search$ </query> </search> <option name="showPager">true</option> <option name="count">50</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>

Hi I have log file like this, need to extract "id" from lines that A=20 and match these lines to lines where that B=10, finally show them in a single table. 1-where A=20 export "id(s)" from these lines: 07:59:42.213 app module: Z[200]id[12]A[20] 07:59:42.213 app module: Y[300]id[88]A[20] 2-if "id" that export in pervious step and B=10 matched join them and make table. share field is "id" between these lines. 07:58:21.533 app module: Q[230]id[12]B[10] 07:58:21.533 app module: V[230]id[88]B[10] expected result: id        A      B 12     20  10 88     20  10 any idea? Thanks,

I'm a Splunk Add-on/App developer, and the Splunk-App I developed has passed the app inspect and runs well on Splunk Enterprise, but how can I get Splunk Cloud certification flag? The flag like this picture: Only customers can send Splunk Cloud App request? Really? I think It's too inconvenient, as a developer, I can't submit my own review request...

Hello, I have Universal Forward and Heavy Forward in Linux machine, how would I stop and restart them.  Any help will be highly appreciated. Thank you so much, appreciate your support in these efforts.

I have a list of files name under one field called "attachment"  and I would like to split this string into multiple rows by file names. I tried split/makemv method but it was unsuccessful.. really appreciate any tips on separating this string by file. Thank you    For example:  Raw output: "image001.png Project_Preference_crosstab (3).csv GC_Preferences - 8 Oct.xlsx GC updated skills with ratings - 30 Sep 2021.xlsx Skill_Details_-_Base_crosstab (3).csv AP Talent list - 30 Sep 2021.xlsx UCD_Skills_Compliance_Details_crosstab (2).csv"   I would like to see: image001.png Project_Preference_crosstab (3).csv GC_Preferences - 8 Oct.xlsx GC updated skills with ratings - 30 Sep 2021.xlsx Skill_Details_-_Base_crosstab (3).csv AP Talent list - 30 Sep 2021.xlsx UCD_Skills_Compliance_Details_crosstab (2).csv

I have a dashboard that has a timechart displaying a count of values occurring every hour. My query is: index=app host=... sourcetype="..." siteType=... | timechart span=1h count(eval(status!=200)) as Fails | eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | table Time, Fails This works perfectly, but I want to add a drilldown on my table so the user can click on a row and see all the values for that hour. The closest thing I have been able to come up with is this query: index=app host=... sourcetype="..." siteType=... status!=200 ((earliest=$earliest$ latest<$latest$)) But if I click on a row, it gives me a search that looks like this: index=app host=... sourcetype="..." siteType=... status!=200 ((earliest=1633096800 latest<1633702712)) And I have an error in the search, "Invalid earliest_time." What is going on here? Is there a conversion I need to do on the earliest and latest tokens to get the correct time? 

Hello, I have a field with this values /v1/accounts/96ea01b5-7ea7-4dc6-b534-39ae8b114bba/transactions /v1/accounts/ff572b85-c3c6-4e54-8343-75c5aa954285 /v1/accounts/469754d0-9169-45ca-af86-a885142d6ad4/transactions /v1/accounts/c68b8246-bd76-4d34-9d33-7fb4be4ebe9f/limits /v1/accounts/d9f1e948-e9aa-4a46-9e78-deeaf1d21143/limits /v1/accounts/f6fa235c-858d-42d2-80ae-85b12a750351 /v1/accounts/f4a0877f-5807-41ed-b7ee-c6be2e4e25be /v1/accounts/042c6b58-ea01-48cd-838e-06929b427f75 I need a query that show me only the lines that doesn't have nothing after the ID. Exemple  /v1/accounts/ff572b85-c3c6-4e54-8343-75c5aa954285 /v1/accounts/f6fa235c-858d-42d2-80ae-85b12a750351 /v1/accounts/f4a0877f-5807-41ed-b7ee-c6be2e4e25be /v1/accounts/042c6b58-ea01-48cd-838e-06929b427f75 Thanks

I am trying to install the Splunk App For Jenkins (v 2.0.4) in our Splunk Cloud environment (v 8.1.2103.3) and the app is failing vetting.  On the Splunkbase page for the App, the compatibility indicates that I should be able to install. Is someone out there actively maintaining this app and can take note of some changes in a future version? Thanks, REID These are the messages related to the failures (there are some warning too): [ Failure Summary ] Failures will block the Cloud Vetting. They must be fixed. check_rest_handler_python_executable_exists The handler of stanza [script:customIndex] should be `python3` executable. File: default/restmap.conf Line Number: 12 The handler of stanza [script:customPanel] should be `python3` executable. File: default/restmap.conf Line Number: 1 The handler of stanza [script:userValidation] should be `python3` executable. File: default/restmap.conf Line Number: 23 check_for_telemetry_metrics_in_javascript The telemetry operations are not permitted. Match: window._splunk_metrics_events.push File: appserver/static/pages/job.js Line Number: 6 The telemetry operations are not permitted. Match: window._splunk_metrics_events.push File: appserver/static/pages/health.js Line Number: 6 The telemetry operations are not permitted. Match: window._splunk_metrics_events.push File: appserver/static/pages/audit.js Line Number: 6