try adding this props.conf [sourcetype] NO_BINARY_CHECK = true BREAK_ONLY_BEFORE = ... View more

Hi, Instead of fields * try adding the fields to search, filed extraction may not happening in dashboard since it runs search in smart mode by default. ... View more

Hi Arun, you can add regex to extract fields while search, add something like this to your search | extract pairdelim="\"{,}" kvdelim=":" or you can add the Rex field rex field=field "(?<StationName>[^\;]+)\ Or make add the extractions to your props.conf ... View more

index=index (sourcetype=sourcetype1 OR sourcetype=sourcetype2 OR sourcetype=sourcetype3) | join type=inner CommonField [ |inputcsv additional_data] ... View more

if you have a list of CC's try adding them to a lookup file which would be much easier. ... View more

you can use the replace command to do this. https://answers.splunk.com/answers/568552/how-to-use-replace-in-search.html Let me know if this helps. ... View more

Hi Ben, Try adding the complete values to your search try mentioning the complete index, source-type etc. | collect index=summary sourcetype=foo Re-check if any regex is applied on any field. Share few samples on what is missing, may be we can look into it. Let me know if this helps. ... View more

Check if the permissions are given properly. ... View more

Hi Karine, I am not sure on how to do this with a Java script, but you can try adding a Bulletin Messages to Splunk user group may be once or twice a month intimating new users to set the timezone information. https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Customizeuserexperience Let me know if this helps. ... View more

Hi itdept, Description by richgalloway is very details and will work, it should be something like this basing on your data. [sourcetype] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true BREAK_ONLY_BEFORE=Regex TIME_FORMAT=%H:%M:%S.%3N TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD=12 ... View more

Hi, In this case indexes to replicate they have to be created on Indexer, and from Search Head UI If you want to access the Indexes created on Indexer, you will have to create indexes similar indexes on the search head as well. These indexes on Search Heads will not store data but they are required to be created to appear in dropdown on management views. ... View more

Hi, Try using the Chart option and in Y-Axis you can change the scale from Log to Linear and add some visualizations to it. Put 0 in Min Value and 800 for the Max Value. Let me know if this helps. ... View more

Hi, This error may occur if the configurations is not properly done, may be one of the indexer is configured without enough space then this error may trigger. Having more than three warnings in a 30-day window is a license violation for the free license and will stop search head. Make sure your indexers all have sufficiently large license pools now to avoid new warnings on each new day. Then you'd have to wait for enough warnings to age out of the 30-day window. Simple way would be to reinstall splunk if there is not much data in it. ... View more

Hi, Try adding testsplunk to the default group, else exclude the default group. This will enable [WinEventLog://Security] logs to both mysplunk and testsplunk ... View more

Hi Abrice, UF do not have the capability which you are looking for, you need to replace your current universal forwarder with a heavy forwarder. Can copy all of your configuration files from the UF to the HF without having to rewrite anything. Below article helps you configure. http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Routeandfilterdatad Let me know if this helps. ... View more

"ContactId\":"(.*?)" ... View more

Hi Gn, if you want to make all field extractions global (instead of everything), you can instead put: [props] export=system [transforms] export=system into the file. Then all items configured in that app's props and transforms files (which includes lookups as well as field extractions, but not tags or inputs for example) will be global (other than ones specifically set to a lower sharing level). ... View more

Hi, You will have to specify a setting to archive data from frozen, else Splunk will delete all the data. http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Setaretirementandarchivingpolicy#Archive_data http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Automatearchiving Let me know if this helps. ... View more

Hi Aqudoos, Enterprise Splunk is a platform and Enterprise security is licensed application which resides on Splunk. For using enterprise security you need to install Splunk Enterprise/Cloud and then use Enterprise Security application. https://splunkbase.splunk.com/app/263/ http://docs.splunk.com/Documentation/ES/5.1.0/Install/Overview ... View more

Hi vgollapudi, Try adding in inputs.conf: http_header_propertys = content-type= application/json,accept=application/json turn streaming_request = 1 In props.conf: TRUNCATE = 0 INDEXED_EXTRACTIONS = JSON KV_MODE = none let me know if this helps.. ... View more

I am not sure if we can get that information from a remote search-head, this dashboard help to have a quick overview of the license usage and daily quota etc.. https://splunkbase.splunk.com/app/3178/ ... View more

https://splunk-sizing.appspot.com/#ar=5&cf=0.16&cr=6&gbi=200&i=2&if=0.28&v=9 ... View more

(?<=\[)(.*)(?= SFP) ... View more