Put your problem with that document into the feedback form at the bottom. The docs team is really good and will get back to you to get that page properly updated. ... View more

Hey, try this: | makeresults | eval begin="2018-05-02 22:00:23.235371" | eval end="2018-05-02 22:01:33.815546" | eval begin_epoch=strptime(begin, "%Y-%m-%d %H:%M:%S") | eval end_epoch=strptime(end, "%Y-%m-%d %H:%M:%S") | eval diff=end_epoch-begin_epoch The field diff will then contain the difference between the two. I left out the milliseconds on purpose, because you said you expected "70" as a result. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Do you want to keep those in a single event? If you do field extraction, you might get a field "servername", but it would contain multiple values, e.g. (fsServer1, ociServer2, etc). Can you show us how you would like your result to look like? ... View more

Hey, try using | timechart span=1mon - then timechart will not automatically determine which time slots to group, but will build one per month. ... View more

I have the impression that you have a misunderstanding on how lookups and mvappend works - maybe it helps if you re-read that part of the docs to make sure your expectations match. ... View more

Try this: index=whatever (host=Server-01 OR host=Server-02 OR ...) searchterms | stats latest(interestingValue) by host Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Don't get me wrong - I didn't mean to say all courses on udemy are bad. I just wanted to make clear that they are in no way affiliated with Splunk, and if they claim that a course can help you pass a certain exam, it only means it covers it's contents, but it's not in any way officially recognized by Splunk. I've enjoyed good courses on udemy (although I haven't had any on Splunk there) 😉 Getting experience is a really important part, you may also hang out here on Answers or on the Splunk Slack Usergroup, a lot can be learnt there. In addition, you could try asking the certification support, as mentioned above, if you can skip the required course for the Poweruser exam - it's worth a try, they can only say "no". ... View more

Forgot about udemy, they're as unofficial as it gets. Literally anybody can offer a course there and claim anything. It's like YouTube, but with money 😉 Somewhere back in my head I remember something about being able to circumvent the course requirements with proven experience, but I'm absolutely not sure about this, and if it's possible, it's on a case-by-case base. If I were you, I'd contact certification@splunk.com, because they're the only people who can make valid statements if this is possible. ... View more

Your df shows that you habe only 1.7GB free, that's why Splunk complains that there is not enough (>5GB) free space. You could lower that limit like described here: https://answers.splunk.com/answers/214804/the-minimum-free-disk-space-5000mb-reached-for-opt.html I would however avoid that and instead make that partition bigger, because else you might into problems again soon. ... View more

We're you able to try this? ... View more

Please do df -h to show the free space on your partitions. ... View more

Build a search that returns the data in a format that is good for you. Append | outputlookup your-lookup.csv to the search, which should write the results to a lookup with that name. The data can then later be used as any other lookup with the | lookup and | inputlookup commands. ... View more

At least that very error message is related to a different folder name, it says HTTPError: HTTP 404 Not Found -- {"messages":[{"type":"ERROR","text":"Application does not exist: Splunk_TA_salesforce"}]} I've to admit I'm a little confused why it checks for the app, but it's worth a try. ... View more

Or didn't restart Splunk 😉 ... View more

Check the corresponding doc: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf It does not explicitly state seconds are impossible, but it states the format for crown schedules and therefore what is possible. ... View more

I thought about something similar. Possible, but really dirty hack: For all events, append the content of index to _raw, using a very creative separator. E.g. an event yourtext becomes yourtext#&#&#&QA_main For all events, match on a regex like .*ERROR.*#&#&#&QA.* and route all events to nullQueue For all events, remove the append separator and index again. That should work, because you could match ERROR and index in the same step, however it would require three steps to be performed on ALL events, which might get ressource heavy and also is dirty like hell. ... View more

I did just install it on my Splunk 7.1 test instance, and although it doesn't come with any prebuilt dashboard, it offers prebuilt dashboard panels. Therefore, create a new dashboard, select Add Panel..., then choose Add Prebuilt Panel. See the screenshot on how to do it: ... View more

Sorry, I don't have any good ideas on this that don't sound like really dirty hacks. I'd try to somehow get this organized with hosts and sourcetypes, but I can see how this can be difficult on it's own. ... View more

The makeresults part is only used to create fake events because we don't have your data available 😉 Happy it worked out for you 🙂 ... View more

I fear that's not possible at index time, because you can only filter on either the event text OR the index name. It would be much easier if those events have a common set of source, sourcetype or host, then filtering on the event text would be easy. ... View more

Why do you think there's a seperate installation guide for Windows? Should be the same as for Linux. Just do it 😉 ... View more