Hello I have a saved search that is running every month at 1st day. The search is not new and has been working a long time. The problem is that for the last run, it has returned count of 107 events instead of 108 for a specific date(2019-07-10). The search is running wiith timerange of Last month. I start to analyze today and I wanted to check first what happens if I run the search now and after I did that I found out that the search returns now 108 events which is correct so what things could have gone wrong at 01.08 so that splunk has not returned 1 event? We have checked index time of the events and are ok. We have checked that the indexers have not been down from a long time. It is a cluster solution with 4 indexers + 1 new indexer which has been installed somewhere in july(can that have messed something?) Splunks task is simply to return all data according to the search, so if Splunk has made error, can it be trusted? ... View more

Hello I found this attribute in mysql app in props.conf: PREAMBLE_REGEX = #\sTime:\s\d+\s+\d{1,2}:\d{2}:\d{2} test data: Time: 190807 13:26:28 The issue is that nothing happens and the line with this string is still comming in splunk and makes the whole parsing wrong as it creates a new event only for it instead of ignoring it:( I tried the regex and is correct. Tried it also in splunk with regex command and works fine so I believe this is due to that command. Some others to help or know more about it? ... View more

I investigate issue of creating too many new warm buckets and while I do that, one of the events which according to log splunkd has issues has strange problem which I am curious to find out why this happens. The event: fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd ... View more

Hello Yesterday I installed splunk 7.3.0 and I start running some searches and then I wanted to see statistics of my searches as there where some slow searches for the memory and cpu usage per search so I went in Monitoring Console-> Search -> Top 20 Memory-Consuming Searches but the graph is empty and when I check if there is data in that sourcetype, there isn't any. sourcetype - splunk_resource_usage index=_introspection Why ? ... View more

Hello Can you provide some working solution for eventgen with testdata and eventgen.conf which is working for you? I am 0 interested in how it is working or their docs as I've used hours to try make it working without success so I just need someone who has already working set of conf with some simple sample data. ... View more

Hello What options there are to tune search from already accelerated data model with 3+tb data? the slowliness comes from using by clause. search: | tstats summariesonly=true count FROM datamodel=mydatamodel WHERE earliest=-7d@d BY field1, field2 So far I have checked usage for cpu, memory on sh and idx but nothing unusual. (No high usage for nothing.) Datamodel status is 100% done ... View more

Hi Lets say I have value of 99.99875547590601 and I want to get only 99,99 so I use the function round(99.99875547590601,2) which returns 100 instead of 99,99. I think this behaviour might be normal but so what can I do instead of round to get precise result? Thank you. ... View more

Hello #splunkers I had to create my first self-signed ssl for splunk web and data and I followed splunks guides but I cannot understand the step where there needs to be created a signle pem file: https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/HowtoprepareyoursignedcertificatesforSplunk After the first guide : https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Howtoself-signcertificates I have 3 files for the server cert. : .pem , .csr, .key so why do I need create single pem file? Yesterdayy I followed similar guide for splunk web ssl and there I didnt do the step for single pem file and Splunk web is working. Is it important that I do it also there . If yes , why, what is happening besides that is working ok on first look..? Thanks ... View more