Hi, @ brent_weaver, please update the title and question and avoid saying the event is json. Otherwise, people misunderstand this question itself. ... View more

I'm still trying to understand your question especially your word "this field" above. Maybe it is because I do not understand Azure event contents. Assuming you want to have Key-Value field extraction for any format of "key"="value" string, you can achieve it in transforms.conf and props.conf. Note: I'm assuming sourcetype is azure_test in this example. - props.conf [azure_test] REPORT-extract_kv = extact_kv - transforms.conf [extract_kv] REGEX = "(?<_KEY_1>[^\"]+)"="(?<_VAL_1>[^\"]+)" Of course using this idea, you can do more specific for only for certain field value, etc. ... View more

I'm still not understanding why you need version control for a lookup file and .index file. So, my answer might not be proper to your question. If your app requires to keep track of all changes users updated lookup csv files, you need your own way to do it. Current Splunk does not have such feature. Splunk automatically create index files (tsidx files) when csv file is large. tsidx file will improve search performance. If a lookup is updated, Splunk needs to create a new tsidx files. Splunk will not keep those tsidx files. tsidx files. They are binary files. So, when you say version control, I assume you keep all of them because diff would be really difficult. So, size of the app will eventually become very large depending on how much version records will be kept. What is purpose of version control? Do you have a real use cases and examples? Do you need to revert back to different versions? Do you need something to check diff or merge lookup files by your own app's feature, not Splunk feature? Because I do not understand your use case for requiring "version control" of lookup files, I believe my answer is not proper. ... View more

So, you're trying to save a new sourcetype. Probably your role does not have edit_sourcetypes capability. ... View more

Does DMC's KVStore view show no error or warnings? Probably SH2 is out-of-sync. Hope you're using v6.5.0 which added easier procedure to check status and resync kvstore. https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/ResyncKVstore ... View more

A direct copy of "$SPLUNK_HOME" should work. I still recommend you to test it in a small test environment. ... View more

Free trial license should be able to build multi-instance test environment. You really should play around with SHP. Without it, most likely you run into something you're not sure what you're doing. If you read document and could not understand what it means, probably you're not ready to do it in prod environment. Certificates should not be affected in SHP in general. Two questions you had above. Place the confirmed working apps in the search head pool shared storage area => Those apps are coming from Search Head you tested in "Prepare the upgrade". Copy the apps and user preferences from the search head to the shared storage => Before this steps, you already upgraded and tested in one of SH in SHP. Once it worked, you copy the apps and users directories to SHP shared path. 3) You can disable SHP configuration to remove a search head so that the SH won't check the shared location. I cannot really tell exact expected steps to work for your environment. All I can tell is similar to the doc as default behavior if you do not have any custom things it may or may not work. My advices would be; 1. You test how SHP works and update in test environment using virtual machines. This is very important before changing production environment. Contact your sales rep and ask for help for a little more detail if you're still not sure how to do upgrade after reviewing the doc and testing it in test env. If you run into problem at migration stage, file a Support case and upload diags to the Support case for troubleshooting. ... View more

Maybe Line Chart Format for Null Value is Connect? If so, how about changing it to "Zero" ... View more

Please file a Support case for further investigation. ... View more

In general, you will find more errors or warnings around that message. Sometimes it is related to bundle from deployer. Other time, it is related to configuration replication errors due to corrupted file or large contents or something. If you find which file or configuration is related to this error, you can try to delete or remove it and see if it helps. For detail of troubleshooting, you might want to file a Support case with a splunk diag file so that Support engineer can take look into more detail. ... View more

As you can see in this discussion, there is no feature in Splunk fits in what you are looking for. I knew it 🙂 I simply pointed out available feature which may or may not help. And, it is glad to see this further discussion for the question. Yes, I agree with @mikaelbje, dev. environment with closest settings to prod. is a general approach if we cannot do in prod env. If you're looking for this feature in Splunk, please file an enhancement request with use cases. ... View more

I agree with both somesoni2 and bmacias84 . PostProcess sometimes helps for similar searches. But, in many cases, it becomes slower. Even when aggregation search is used at base-search, it is still possible to make it slower. It depends on data and searches for a dashboards, either PostProcess got benefit or not. In my personal experience, some dashboard performance was improved while the other didn't. ... View more

Do you think Forwarder Management view will help ? (ref: http://docs.splunk.com/Documentation/Splunk/6.5.0/Updating/Forwardermanagementoverview) ... View more

Sorry but I think you should try it in test environment several times before trying it in prod environment if this is your first time. Or, considering professional service would be a safe direction. ... View more

It depends. Your system admin should be able to advise how to remotely run command or access to remote server by script. ... View more

If that attribute is not working, you should report a bug. Maybe your expectation and how the attribute works is different. In such case, doc/spec file needs to be improved. ... View more

Sorry but I do not understand your question. Also, instead of creating a new answer, can you add comment to an existing answer or, update your question as more elaborated question? ... View more

Some users is using 32 CPU cores physical machines for DCNs. You can have multiple DCNs for one vCenter env. VMware app's scheduler will take care of which DCN will collect which data type. One vCenter with 2000 VMs. Potentially vCenter's response for API calls are slow often times. Or, vCenter will reach its own timeout sometimes? ... View more

There is no way to make it unlimited. Good practice is to use more search heads with SHC to distribute alerts and increase actions_queue_size (500 or so? ) Any unlimited settings need to be careful. It could use up all available resources. ... View more

Splunk used to support Multi-tenant Deployment Server (Main Deployment Server to multiple sub-Deployment Server as repositories). But, the feature is not supported any more. Splunk Deployment Server/Client requires tcp session establishing from DC to DS. Can you set firewall at the gateway to accept such communication? If not, you might need to put DS to each secure domains. ... View more

Will the following link help? https://answers.splunk.com/answers/177798/why-is-fishbucket-getting-really-big-on-my-univers-1.html ... View more

If you're going to have multi-site Clustering, why do you need to make it non-Indexer Clustering env? Probably the following steps would work. I strongly recommend to test it in a test env before trying it if possible. Change CM's RF and SF to 1 Restart CM Remove excess buckets to make sure only one copy per bucket Stop CPs(Indexers) and remove Clustering settings Move apps from etc/slave-apps to etc/apps Start the Indexers Stop SH and remove clustering configurations Start SH and add those indexers as Search Peers from Splunkweb Stop CM ... View more

Nope I haven't seen such behavior. ... View more