ganon640 Try this - | makeresults | eval Feature.Flags.1 = "True", Feature.Flags.2 = "abc", Feature.Flags.3 = "xyz" | eval HostFlags="" | foreach "Feature.Flags"* [eval HostFlags='<<FIELD>>'] | where HostFlags!="" | table Feature.Flags* And | makeresults | eval Feature.Flags.1 = "True", Feature.Flags.2 = "abc", Feature.Flags.3 = "" | eval HostFlags="" | foreach "Feature.Flags"* [eval HostFlags='<<FIELD>>'] | where HostFlags!="" | table Feature.Flags* The first one will give you result and the second one will not. Which is what your criteria is. Let me know. Thanks ... View more

@alanzchan The decision is based on your requirements. Following is how this should be evaluated. Normally self signed certificates are used in test/dev environment and external certificates are used in PROD. However, again depends on your data/environment security requirements and also the network zone you have set up your splunk infra. If it's exposed to "outside" world, it's always advised to use a proper certificate. See - https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf Default certificate like you are following are not considered highly secure. If you want to get rid of your error, you'd want to go by this - https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Howtogetthird-partycertificates Hope this helps. Let me know ! ... View more

I am not sure if you'd find many people who might be using Splunk in this manner. But however at a high level for your requirement, it looks like you'll have to create templates for your VMs with specific Splunk Roles i.e indexers, search heads, Cluster Master, License Master etc. If its only the clusters that you'd require to tear down and not the forwarders layer. You'd want to also reserve IPs for your indexers. So that whenever your clusters are available, forwarders can start sending data. You'd require to consider connectivity tests to be run everytime after bringing up the clusters back. As well as a devops pipeline for installing the Splunk and deploying the relevant splunk confs. An automated LDAP integration of your SHs so that your users are able to access and not have to do it all over manually. I hope this gives you some tips. ... View more

Sorted. Downloaded the journal file from the server. Decompressed it using 7z. Then recompressed to gz. Put it back in the bucket. And restarted splunk. ... View more

@maniu1609 I believe you should once go through - https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitereplicationfactor https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Sitesearchfactor These will really help you clear your concept and in taking your decision. At high level, replication and search factors is a trade off between performance/availability and disk space. The more you increase on your search and replication factors, the more space you require. So that is certainly a factor to consider if you have a high data ingestion. This has to be calculated against data availability that you want. For my suggestion to your specific env, taking both disk space and data availability into consideration. I'd say - site_replication_factor = origin:2,total:3 site_search_factor = origin:1,total:2 This would mean that for : replication factor - your data origin site will always have 2 copies and 1 copy with the other site. There will be a total of 3 copies always across the 2 sites. search factor - your data origin site will always have 1 searchable copy and 1 copy with the other site. There will be a total of 2 copies always across the 2 sites. Please accept as answer and upvote if this helps. Thanks. ... View more

@mmsbswe Looks like you are trying to do this on the Univ forwarder itself. These would not apply on UF. You'd require to take these settings of props.conf and transforms.conf onto your indexer. Thanks! ... View more

@yutaka1005 Yes, the default listing of this setting is not there on Retention policies in Index Detail: Instance You can relax if you are worrying about this setting is in-effect or not. Thanks !! Let me know if there is any other doubt ... View more