Hi Team,
Environment
1 - Search Head, 2-Indexers, 1 - Deployment Server, 1 - Heavy Forwarder, 1 -Cluster Master
Problem Statement
1)I am unable to retrieveevents when searching with index...
...n my instance the command "eventcount index=XXX* " returns a number of 160 millions events in my indexes. When I try to do a command "| tstats count where index=XXX* by sourcetype", the c...
I able to retrieve Windows event logs from remote machines using WMI, and I'm also indexing local Windows event logs. I like to organize the events coming from the local system and from remote s...
I have a search query which uses dedup to get the latest eventfrom my source type.
Search:
sourcetype = MonitorLog | dedup Username | WHERE SecondsElapsed >= 300
Username, A...
Hi
I am trying to retrieve data from summary index and it is taking 300secs to retrieve 140000 eventsfrom 4 search peers.
index=summaryindex earliest=-7d@d latest=now (240000 events t...
The metadata command does not work for virtual indexes used by Hunk.
My goal is to get a list of values from items enclosed in ${}'s within the v-index path (which are extracted as fields). With t...
...xx field2=yyyy filed3=uuu`(command) I've create a new index called misp where i would like to put the events that i retrievefrom the search. For this i pipe the previous command with c...
...alues for all expected fields of the index. For example, in index4, I do not get data for field8 and field9. But, if I increase the number of events limit in head from 6000 to 10000, I get the data for t...
Good morning,
We have an splunk architecture with 2 Search Heads and 2 Indexers.
This morning when our user tried to look for today's logs from the SearchHead, he could not retrieve any data. C...
Hello,
I trying to retrieve all login/off/fail on my inderxer from UniversalForwarder filtered by Heavy forwarder :
UF v5.0.5 (All Security logs) > HF v5.0.5 (Filtering only 4642/4625/4634 events...