@aashiqwork  Could you please more precisely specify where would I find the setting to permit my "varlog" index the indexing? I thought naively if I create it in the "search" app context it would accept whatever comes ... Kind Regards, Kamil ... View more

The name is correct and the folders are there .... The only thing is, that this is the Kubernetes cluster so I am not sure how the interaction here is. ... View more

Thank you, it worked. ... View more

We have around 160 users. Yes, I will open a new support case. Thank you for the idea with the workaround. Kind Regards, Kamil ... View more

Thank you, the workaround sounds good. However, in the meantime we noticed that the users (there was actually one user who was not able to logon, the rest are missing in the "user" overview, but are able to logon strangely), so this one user had an issue with the browser and also himself can logon. I interpreted this as an LDAP issue, because the users are missing in the Splunk list so I thought they do not get replicated. But this is not the case. They are able to logon, but their names are not on the users list .... I found the similar case in the Questions, but unfortunately after commenting out the mentioned parameter and restarting instance, nothing changed: https://answers.splunk.com/answers/734939/why-are-we-unable-to-retrieve-the-list-of-all-ldap.html Would you have any idea or should I create a support case? Kind Regards, Kamil ... View more

Thank you. After long trying the working result is following: | appendcols [ search index=_internal sourcetype="scheduler" suppressed=0 alert_actions!="" earliest=@d | rename savedsearch_name as label | rex field=sid "scheduler.+__mlbso__(?P<jobsid1>.+)_at.+" | convert ctime(scheduled_time) as scheduled | table scheduled run_time label sid jobsid1 | addinfo | rex field=info_sid "scheduler.+__mlbso__(?P<jobsid2>.+)_at.+" | where jobsid2 != "" | where jobsid1 = jobsid2 | sort by scheduled asc | streamstats count as triggered | fields label triggered scheduled run_time | sort by scheduled desc | eval triggering = "Alert name: " + label + "," + " # today triggered: " + triggered + " times," + " scheduled time: " + scheduled + "," + " Runitme: " + run_time + " sec;" | rename triggered as _triggered | table triggering | mvcombine triggering delim="," ] | eval f=mvindex(triggering,0) | rex mode=sed field=triggering "s/,/, /g" | rex mode=sed field=triggering "s/;/\n/g" | rex field=f "Alert.+triggered: (?P<counter>.+) times.+" | rename f as _f | rename counter as _counter | rename triggering as _triggering I have one last question: in the above what is not really working is the rex with appending the tab. I tried everything already, \x89, \t ... nothing works. I would like to replace the "," with the ",tab" to make the line a bit more readable and somehow i am not able to manage it. Do you have perhaps idea how i could do this? Kind Regards, Kamil ... View more

And how would I match it to the current running search? By sid? Unfortunately I have impression that the _internal index gets written first after the execution is completed, which means I am not able to read it from the SPL of the currently running search as it does not exists yet. ... View more

Thank you, it helped my understanding. This is not the first time that I miss the real if-else functionality in Splunk SPL, but I guess I am spoiled by other programming languages and this is not that easy to implement here. I solved above in relatively dirty way with the map command |dbxquery query="select top 1 m.host, s.service_name, round(m.used_memory_size/1024/1024/1024) as used_memory_size_gb , round(i.memory_allocation_limit/1024/1024/124) as memory_allocation_limit_gb, to_int(round(m.used_memory_size * 100 / i.memory_allocation_limit )) percent from isp_iop_kpistore.sys.m_service_component_memory as m join (select host, port, MEMORY_ALLOCATION_LIMIT from isp_iop_kpistore.sys.M_LOAD_HISTORY_SERVICE where time >= add_seconds(now(), -60)) as i on m.host = i.host and m.port = i.port join isp_iop_kpistore.sys.m_services as s on i.host = s.host and i.port = s.port where m.component = 'Statement Execution & Intermediate Results' and m.used_memory_size >= i.memory_allocation_limit * 0.01 order by round(m.used_memory_size/1024/1024/1024) desc " connection="HANA_MLBSO" | eval QUERY = "select top 100 component, category, SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 1) as \"TYPE_1\", SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 2) as id_1, SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 3) as \"TYPE_2\", SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 4) as id_2, SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 5) as \"TYPE_3\", SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 6) as id_3, sum(round(inclusive_allocated_size/1024/1024/1024,2)) as allocated_gb, sum(round(inclusive_size_in_use/1024/1024/1024, 2)) as used_gb from isp_iop_kpistore.sys.m_context_memory group by component, category, SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 1) , SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 2) , SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 3), SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 4) , SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 5) , SUBSTRING_REGEXPR('[^/]+' IN category FROM 1 OCCURRENCE 6) order by used_gb desc" | eval DUMMY_QUERY = "select now() from dummy" | eval SQL_TEXT = if(PERCENT >= 20, QUERY, "") | map maxsearches=20 search="dbxquery query=\"$SQL_TEXT$\" connection=\"HANA_MLBSO\" | append[|makeresults | eval HOST=\"$HOST$\" | eval MEMORY_ALLOCATION_LIMIT_GB=\"$MEMORY_ALLOCATION_LIMIT_GB$\" | eval PERCENT=\"$PERCENT$\" | eval SERVICE_NAME = \"$SERVICE_NAME$\" | eval USED_MEMORY_SIZE_GB = \"$USED_MEMORY_SIZE_GB$\" ] " Kind Regards, Kamil ... View more

Could you please convert your answer that I can accept it? ... View more

@anmolpatel Thank you for your input, it was really helpful. Kind Regards, Kamil ... View more

Thank you. I like the event-timeline-viz very much, it is so much better than the timeline, at least for me. Also my original issue could be addressed with your help. One last question: Is it possible to change the color of the bar but in case of specific label value? I would like in some cases give the label "Restart phase not running" for some events and only for these set the color e.g. to yellow, that one can see at the first glance the difference. Is it possible? Kind Regards, Kamil ... View more

Thank you. ... View more

Thank you. I like this solution, however I would have additional question: The span looks fine, but what also changed is the line spacing, as if it would be double. This is btw same for the table solution. Is there any way to keep the previous / single line spacing? ... View more