Hi, If you just need a new time field with dates, you can try this: your search | eval newtime=strftime(_time, "%Y-%m-%d") This will create a new field called "newtime" that's a time field with only the date (year (Y), month (m), day of month (d)). See more information on the time functions here: http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/DateandTimeFunctions And see more information on date and time format variables (the %Y, %m, etc.) here: https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Commontimeformatvariables ... View more

Great, thanks! I'll try it out. 🙂 ... View more

Thank you very much for the suggestions! I'll keep the question open some time loger. A Buttercup event generator would indeed be nice. 🙂 ... View more

The showcases that are built into MLT includes some static lists, but no live data. I guess we could use these lists, or use internal data, but it would be more "real" if we where to use live data that's not internal. Examples could be traffic on web sites, sales, disk usage, performance, etc. ... View more

Aha, thanks. I didn't know export didn't work for post process searches. ... View more

Hi. Maybe a stupid answer, but you know it should be sourcetype=_json, and not simply json? ... View more

I'm not quite sure what you mean with "download option", could you please elaborate? What's important to have in mind with base searches is that it shouldn't return raw events. If you can do a stats command on the base search before sending the results to the sub-searches, or at least strip away as much data as possible, you maximise efficiency. ... View more

Right, thx. Still need to clean the instances though. ... View more

Well, what do you mean by real time? You could schedule the searches to run, say, every 5 minutes. If so the users could potentially see data that is 5 minutes old, worst case scenario. If you need the data to be seen in actual real time, then I guess you couldn't even use a summary index? If you haven't already, you could also utilize a base search, and run sub-searches on that search, if possible. Though, this is maybe what you mean when you say that you use post process searches? ... View more

Splunk best practise says to always use clean instances when adding members to a SHC. If you remove SH instances from the cluster for a while, and then attempt to add them back in, changes could have been done on the the SHC in the meantime, meaning that the removed instances would no longer be in sync with the cluster. As far as I know this is not supported, but I'm just thinking out loud here. ... View more

I've encountered some serious performance issues when a lot of events have the exact same time stamp in a search, so I think "forcing" Splunk to index a lot of events with the same timestamp would be a bad idea. That being said, how are you setting the timestamp on the events, extracting it from the raw events, setting it on index time, or using the timestamp from the file name? If the latter is the case, you could try using the timestamps from the raw events (if any) or set DATETIME_CONFIG=CURRENT in props to set a timestamp at the time of indexing. ... View more

Note that if you're going for alternative 1, even if the captain is static, if won't be able to actually make changes to the cluster, like distributing knowledge objects, as this would need a majority of the search heads to confirm the change. Check out this explanation on RAFT; http://thesecretlivesofdata.com/raft/ If you're going for alternative 2, be sure to remove the search head gracefully. Do not just kill the VM (I've seen people do this before). There is a command to properly take a search head out of a search head cluster. I think alternative 3 is a neat solution. You could add a low spec SH on that site, but not include it from the load balancer, so that the users will still only use the remaining 3 high spec SHs. After the migration is done, gracefully remove the low spec SH and delete the VM. ... View more

Have you considered using scheduled searches to populate the dashboard panels? https://answers.splunk.com/answers/418731/is-it-possible-to-schedule-a-dashboard-to-run-pane-1.html ... View more

We found the cause of the error. The datastream for the index wasn't being parsed correctly; the milliseconds was not being extracted. This meant that if say 100 events all occured in the same second, as Splunk wasn't extracting the milliseconds, they would have all appeared to have happened simultaneously from a Splunk perspective. This apparently confused Splunk, and performance went bad. Fixed the parsing, and now the we can search on the index just fine. ... View more

Did you ever find a solution to these performance problems? We have the same symptoms when searching on one of our indexes, and we get the same error message. ... View more

If I'm not looking at the wrong place or something, the HEADER_FIELD_LINE_NUMBER is in the "Structured Data Header Extraction and configuration"-section. It's specified that "all of its settings apply at input time, when data is first read by Splunk." INDEXED_EXTRACTIONS just happens to be one of many settings that an be specified at input time. ... View more

INDEXED_EXTRACTIONS, why is that? Though, when I look at the props.conf documentation again, I understand that the HEADER_FIELD_LINE_NUMBER will have to be configured in props.conf on the instance reading the log file (probably an UF). ... View more

I was thinking, if you set HEADER_FIELD_LINE_NUMBER so that Splunk will start reading the file from the line you want Splunk to read from, reading only the last "xxx" lines, wouldn't that work? ... View more

I don't know if this is what you're looking for, but you could perhaps set the HEADER_FIELD_LINE_NUMBER in props.conf. HEADER_FIELD_LINE_NUMBER = integer - Tells Splunk the line number of the line within the file that contains the header fields. If set to 0, Splunk attempts to locate the header fields within the file automatically. - The default value is set to 0. ... View more

Maybe I'm missing something here, but I can't see that this app has a tags.conf, which I understand is needed to map logs to CIM. My events looks like the samples presented by Splunk in the documentation. http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/MonitorActiveDirectory#Sample_AD_monitoring_output ... View more

Thank you for you answer. I was actually wondering if there's a TA for the ActiveDirectory logs that can map them to CIM. If that's even possible at all? ... View more

Hi. Did you find an answer for what to do with your ActiveDirectory logs? I'm facing the same issue here. ... View more