sucks man 😞 ... View more

I hope they include it in future version. ... View more

To do this via Web UI, got Settings > All Configurations > Reassign Knowledge Objects (button) > (filter by Orphaned) Reassign ... View more

thank you. My thinking was right after all ... View more

Does that mean if I create an app, let say called "system_wide_configs" and put web.conf in its /local directory, use the CM to distribute it to slave-apps, it will still work? Theoretical Implementation: Create system_wide_configs/local/web.conf Put it in CM's ../etc/master-apps apply cluster bundle perform a rolling restart it will then create ../etc/apps/slave-apps/system_wide_configs/local/web.conf to all the indexers, right? Will Splunk be able to read it still? ... View more

How to disable DS? -- uninstall the Splunk Enterprise from the host that is serving as the DS -- if the Splunk Enterprise is working not only as a DS but other Splunky purpose and so you don't want to uninstall the Splunk in it, then delete all serverclasses, deployment-apps, and go to each client and delete the deploymentclient.conf If I disbale DS. Will the Apps pushed through DS earlier will be deleted from deployment clients? -- nope. apps in the clients will just stay as though they're installed there manually If Yes, How to avoid deletion of Apps deployed through DS from deployment clients? -- ... ... View more

I downvoted this post because %s is not the right format for milliseconds. this will cause you errors ... View more

This is a very helpful tool: https://splunk-sizing.appspot.com/ ... View more

I used Curl Command from splunkbase and used | collect to index the result ... View more

Amazing work. But how can I capture the fields with spaces? EDIT: i worked it out. thank you very much! ... View more

Brute force method I used: index="google_apis" source="https://www.googleapis.com/youtube" | timechart span=4h avg(subCount) by channel | fields - NULL | eval rand = tonumber("0." . random()) | eval rand = case( (rand > 0.00 AND rand < 0.16), -3, (rand > 0.16 AND rand < 0.32), -2, (rand > 0.32 AND rand < 0.48), -1, (rand > 0.48 AND rand < 0.64), 1, (rand > 0.64 AND rand < 0.80), 2, (rand > 0.80 AND rand < 1.00), 3, true(), 1) | eventstats avg as a_*, stdev as s_* | eval fnv = 'a_Making it happen Vlog' + (rand * 's_Making it happen Vlog') | eval "Making it happen Vlog" = floor(coalesce('Making it happen Vlog', fnv)) | eval fnv = 'a_The Juicy Vlog' + (rand * 's_The Juicy Vlog') | eval "The Juicy Vlog" = floor(coalesce('The Juicy Vlog', fnv)) | eval fnv = a_Morgz + (rand * s_Morgz) | eval Morgz = floor(coalesce(Morgz, fnv)) | eval fnv = a_MrBeast + (rand * s_MrBeast) | eval MrBeast = floor(coalesce(MrBeast, fnv)) | eval fnv = a_PewDiePie + (rand * s_PewDiePie) | eval PewDiePie = floor(coalesce(PewDiePie, fnv)) | eval fnv = a_Music + (rand * s_Music) | eval Music = floor(coalesce(Music, fnv)) | eval fnv = a_TSeries + (rand * s_TSeries) | eval TSeries = floor(coalesce(TSeries, fnv)) | fields - a_*, s_*, rand, fnv | fields _time, * ... View more

thank you. accepted answer ... View more

Thank you. I would also accept this as answer but another one has came in first. ... View more

Hey. thanks for the response. what is splunk:splunk? should I be changing that to my username? ... View more

Thank you. I will try this. ... View more