Hi all, Recently I've upgraded all splunk deployment tiers (search head, Indexer and Heavy Forwarder) and we are collecting Windows event by Splunk_TA_windows add-on. Before the upgrade, Windows event fields like EventCode was appearing but after the upgrade only general fields is visible. The Splunk_TA_windows add-on installed on all components of splunk (HF, SH and indexer) Despite not appearing the fields, I can use missing fields like EventCode in search query and commands like top and stats. How can I troubleshoot and resolve the problem? What's wrong? Anybody can help me?

Hello ! Currently I'm trying to optimize splunk searches left by another colleague which are usually slow or very big. My first thought was to change the "basic searches" (searches that don't use tstats) to searches with tstats to see the most notable accelaration. The needed datamodels are already accelerated and the fields are normalized. bellow is one of those searches I would like to change into tstats.   index=* message_type=query NOT dns_request_queried_domain IN (>different_domainnames>) | lookup1 ip_address as dns_request_client_ip output ip_address as dns_server_ip | search dns_server_ip=no_matches | lookup2 domain as dns_request_queried_domain output domain as cmdb_legit_domain | search cmdb_legit_domain=no_matches | lookup3 domain as dns_request_queried_domain output domain as wl_domain | search wl_domain=no_matches | eval list="custom" | `ut_parse_extended(dns_request_queried_domain,list)` | search NOT ut_domain="None" | lookup4 domain as ut_domain output domain as umbrella_domain | lookup5 domain as ut_domain output domain as majestic_domain | search umbrella_domain=no_matches AND majestic_domain=no_matches | bucket _time span=5s | stats count by _time, ut_domain, dns_request_client_ip | search count>100 | sort -count   now, I struggle to "get" how to connect the way tstats works with the way the basic search works. as far as I've read and seen tstats only works with indexed fields but not fields that are being extracted at search time? so I guess my question is how could I use tstats and still incorporate the above fields and lookups into an optimized search ? I really struggle to understand how to really incorporate tstats in that case. thanks so much for every hint or help André

Hi Splunk experts - I have an unusual math problem on my hands and I'm not sure how to deal with it. We are trying to prove how many tickets have been completed, so we are only counting the numbers that show improvement, not the numbers that show the addition of more tickets (following me?). Here's the data: report_date total 2022-11-07 4111 2022-11-08 3764 2022-11-09 3562 2022-11-10 3633 2022-11-11 3694 2022-11-14 7506 2022-11-15 12987 2022-11-16 15159 2022-11-17 14851 2022-11-18 14410 2022-11-21 6674 2022-11-22 5793 2022-11-23 5601 What I am trying to do is determine the difference between the "total" fields, but only when the count goes down. So for example, 11/7 - 11/9 show counts going down (4111-3562=549). But the numbers go up on 11/10, so we don't want to count those. And then the numbers go down again on 11/17, so I would add the difference between 11/16 and 11/17 to the previous 549. I feel like I am making this more complicated that it needs to be. Help.

I have two indexes: IndexA has a `thisId` field. IndexB has fields `otherId` and `name`. I want to write a query which returns a table of all `thisIds` with a matching `name`. The challenge has been writing the query such that it doesn't return all the `otherId` fields as well. My current query is: (index="indexA") OR (index="indexB") | eval id=coalesce(thisId, otherId) | stats values(name) as name by id However, this is returning all the ids in indexB as well. Thank you

Hi, I'm researching the Splunk Enterprise Environment and as of now I'm on "Architecture Optimization". I had a quick question for version 9.0.2 and that is how and what is the recommended Ulimit increase on Linux for optimization purposes? Regards,

Hi Friends, My current query: index = pg_idx_whse_prod_events host="*" sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS MarkSweep__collection-count.csv" | stats latest(value) as "Marksweep collection Count" by host |join type=left max=0 host [search index = pg_idx_whse_prod_events host="*" sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS MarkSweep__total-time-ms.csv" | stats latest(value) as "Marksweep total time ms" by host] |join type=left max=0 host [search index = pg_idx_whse_prod_events host="*" sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS Scavenge__collection-count.csv" | stats latest(value) as "Scavenge collection count" by host] |join type=left max=0 host [search index = pg_idx_whse_prod_events host="*" sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS Scavenge__total-time-ms.csv" | stats latest(value) as "Scavenge total time ms " by host] I want to use Same index, same sourcetype, same field name but different source. I want each source field value corresponding to host. Instead of use Join in the above command kindly suggest alternate SPL to achieve this result. @gcusello