The latest version on Splunkbase fixes this issue. ... View more

OK Bad news, Upon closer inspection here: https://dev.splunk.com/view/app-cert/SP-CAAAE85#failures it turns out that calling btool is explicitly not allowed on Splunk cloud 😞 ... View more

You can also use |rename sparkline as " " ... View more

It looks like you are trying to start using systemd except you got the servicename wrong. By default it is systemctl start Splunkd (capital S) ... View more

The top "Billing period" panel did not work. It was expecting the billing period to still be in the format YYYYMMDD. I fixed it by changing the search to be this: `azure-billing-period` [| makeresults | eval id=$latestBillingPeriodId|s$ | rex mode=sed field=id "s/01$/-1/" | return id] | stats count by name properties.billingPeriodStartDate properties.billingPeriodEndDate | table name properties.billingPeriodStartDate properties.billingPeriodEndDate | rename name AS "Billing Period Name", properties.billingPeriodStartDate AS "Billing Period Start Date", properties.billingPeriodEndDate AS "Billing Period End Date" All other panels were still working but I had to run the savedsearches first to populate the required lookup tables. ... View more

This is failing for us as well. It looks like Microsoft has (silently?) changed the {billingPeriodName} . Previously it was the the format YYYYMMDD e.g. 20190301 but now it must be specified as YYYYMM-N e.g. 201903-1 Now I am not 100% sure if this is the correct fix as I am not an Azure person, but the following change worked for me and I can now retrieve data: You can fix this by editing the modular input. A better option is to wait for Jason to update the Modular input properly, but in the meantime you could put this hack in place: Edit TA-Azure-billing/bin/input_module_azure_billing.py At about line 83 there should be a regular expression for calculating the billing period name Change this from billing_period_search = re.search('\/subscriptions\/([^\/]+)\/providers\/Microsoft\.Billing\/billingPeriods\/([^\/]+)$', billing_period_id, re.IGNORECASE) to billing_period_search = re.search('\/subscriptions\/([^\/]+)\/providers\/Microsoft\.Billing\/billingPeriods\/(\d{6})', billing_period_id, re.IGNORECASE) then change line 86 from billing_periods_returned.add(billing_period) to billing_periods_returned.add(billing_period + "-1") The OOTB dashboards will also need a minor change becuase of this change to billingPeriodName. I don't have time to investigate the root cause right now, but I think this change is OK for the short term. Cheers, ... View more

Well you could carve it up yourself like this: | makeresults | eval val ="305:44:03" | rex field=val "(?<hr>\d+):(?<min>\d+):(?<sec>\d+)" | eval duration = (hr * 3600) + (min * 60) + sec | table duration All the best ... View more

What about this: your search | rex "startTime\",\"Value\":\"\\\"(?<startTime>[\d\-T:\.Z]*).*?endTime\",\"Value\":\"\\\"(?<endTime>[\d\-T:\.Z]*)" |eval start = strptime(startTime, "%Y-%m-%dT%H:%M:%S.%3QZ") |eval end = strptime(endTime, "%Y-%m-%dT%H:%M:%S.%3QZ") | eval duration = end - start | table * ... View more

It will run every minute, and search the past 15 minutes. This means you will get 15 emails for every event. So you need to set the time range the same as the run frequency. Set trigger conditions to "Trigger once if results > 0 " ... View more

you don't need to use bin command. Your original query will work fine for any time period you want to set. Just be sure to use the "scheduled" and then set the "time-period" in the alert configuration to match the run frequency. ... View more

OK this one should work: your search | rex "startTime\",\"Value\":\"\\\"(?<startTime>[\d\-T:\.Z]*).*?endTime\",\"Value\":\"\\\"(?<endTime>[\d\-T:\.Z]*)" |eval start = strptime(startTime, "%Y-%m-%dT%H:%M:%S.%3QZ") |eval end = strptime(endTime, "%Y-%m-%dT%H:%M:%S.%3QZ") | eval duration = end - start | search duration > 30 ... View more

I have updated my answer. Can you give it another try? ... View more

The linux OOM (out-of-memory) killer probably killed the Splunk search process. You should run this command to see if the OOM killer is occuring: dmesg -T| grep 'illed process' If this returns results it means you don't have enough system memory for what you are trying to do. All the best. ... View more

This is one way you can do it: (ref: https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest ) In props.conf, set the TRANSFORMS-null attribute: [your_sourcetype] TRANSFORMS-null= discard_header_row In transforms.conf: [discard_header_row] REGEX = ^\s*TIME, DEST_KEY = queue FORMAT = nullQueue Hope this helps ... View more

You can do this: YOUR_SEARCH | rex "\"variableName\"\s*:\s*\"age\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<age>[^"]*)\"" to get the age. Or you can use this sort of field extraction to extract all values properly: props.conf [my_sourcetype] REPORT-my_json_pairs = my_json_pairs transforms.conf [my_json_pairs] REGEX = \"variableName\"\s*:\s*\"(?<_KEY_1>[^"]*)\"\s*,\s*\"[^\"]+\"\s*:\s*\"(?<_VAL_1>[^"]*)\" All the best ... View more

There are no issues that should be of concern for the license master when going from 7.2.0 to 7.2.2 If you don't upgrade it properly (or if you run boot-start again) you will be affected by the systemd changes which cause confusion for some people. ... View more

Using LINE_BREAKER is the best thing to do. If the split works on Regex101 then it should work in Splunk. However two tricks to be aware of: 1. Make sure you put the LINE_BREAKER where the parsing is happening, this usually means the indexer or the first heavy forwarder the data goes through. 2. Make sure you have a "capture group" in your regular expression otherwise it won't work. e.g. LINEBREAKER = \<\/Doc_OutPut\>([\r\n]*) ... View more

You need to Make a POST call to the debug/refresh endpoint, specifically this one: https://__SPLUNKURL__/en-GB/debug/refresh?entity=admin/conf-inputs All the best! ... View more