Is this report scheduled? If yes, what is the alert action? ... View more

Search performance will be improved if more indexers are added in the indexer cluster. To get more out of it you can tune your search queries to use streaming commands before non-streaming commands to improve parallel processing so that searches are sent to the indexers to process as much of the search as possible on the indexers. More details here: https://docs.splunk.com/Documentation/Splunk/latest/Search/Writebettersearches#Command_types_and_parallel_processing ... View more

You need date in your log to extract timestamp. If offset doesn't matter much in timestamp then you can extract timestamp from first event and Splunk applies same timestamp to all other events. Below are configurations in props.conf: [ test ] SHOULD_LINEMERGE=false CHARSET=UTF-8 TIME_FORMAT=%S.%3N %Y-%m-%d %H:%M:%S ... View more

Check number of directories and files monitored by the forwarder. $SPLUNK_HOME/bin/splunk list monitor ... View more

Are you seeing values for the "field" in your base index search? Is this field extracted in index? ... View more

Yes, search macros can include base search terms. It will recognize wildcards in index name. From Splunk documentation: Search macros are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. Search macros can be any part of a search, such as an eval statement or search term and do not need to be a complete command. You can also specify whether the macro field takes any arguments. ... View more

That's great. Please accept and vote the answer and comment if you need anything 🙂 ... View more

May be it's due to field name, rename sm.to{} to smto in csv file and search query and try. ... View more

You are importing request, it should be requests. ... View more

Please share configurations created for custom alert action. ... View more

Can you post code snippet doing post call to /search/jobs? ... View more

If the content of log file is overwritten every time then you don't need to BREAK the events. Just set SHOULD_LINEMERGE to true and check. ... View more

hi @mbrownoutside, Your event has timezone (-05:00), Splunk will automatically extract and use it. TIME_FORMAT starts reading after the TIME_PREFIX. Here there is no TIME_PREFIX. Remove/comment TIME_FORMAT and TZ and check. ... View more

hi @praddasg You can filter results based on status values. You need to modify the query. index=apps sourcetype="pos-generic:prod" status=CONFIRMED OR status = REJECTED partner_account_name="Level Up" If you are calculating % of CONFIRMED and REJECTED then you logic should be result1 = (CONFIRMED/(CONFIRMED+REJECTED))*100 and result2 = (REJECTED/(CONFIRMED+REJECTED))*100. I might be wrong here, still if you are getting blank fields in result you can use fillnull (ex: | fillnull value=0 result). Try below query: index=apps sourcetype="pos-generic:prod" status=CONFIRMED OR status = REJECTED partner_account_name="Level Up" | stats count by status, merchantId | xyseries merchantId, status, count | fillnull value = 0 | eval count = CONFIRMED + REJECTED | where count > 10 ... View more

I am getting the proper result. With above query I got below value for description: The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support ... View more

Use replace. | makeresults | eval description = "The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support" | eval description = replace(description, "\n\n", "") ... View more

You can create a new kvstore collection on search head and enforce type checking in collections.conf in an app. collections.conf [test] enforceTypes = true field.TestTransaction.OrderEntryType = number field.TestTransaction.Number = number field.TestTransaction.CloseDate = time Then use REST API to write this data to collection, if field values in json doesn't match data type then insertion will fail and response is returned with an error. curl -kv -u admin "https://localhost:8089/servicesNS/nobody/APP_NAME/storage/collections/data/test" -H 'Content-Type: application/json' -d '{"TestTransaction":{"OrderEntryType":"test","Number":69909696,"CloseDate":"2020-02-03T15:31:38.1260000Z"}}' *<?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">JSON in the request is invalid. (Failed to convert key='OrderEntryType' with value='test' to type '1')</msg> </messages> </response>* ... View more

Since this is a small file, can you use monitor instead of batch and check? ... View more

@splunkdivya On Splunk cloud you can Enable HTTP Event Collector and create an Event Collector token. You can use same collection token ID in outputs.conf in app 'splunk_httpinput' ($SPLUNK_HOME/etc/apps/splunk_httpinput/local/) on on-prem splunk. # Default settings [http] disabled = 0 port = 8088 [http://test_data] description = HTTP event collector token for collecting data. disabled = 0 index = main indexes = main sourcetype = test token = <TOKEN> ... View more

Is there any extraction or parsing done on sourcetype 'my_sourcetype'? ... View more