I think I was having issues with the suggestion here as well, but I ended up going another route for my original problem. Thank you for coming up with a better solution! ... View more

@Cuyose, Up vote is usually the Up Arrow Icon next to answers and shows up when you hover over a comment. ^ . Waiting for your new question 🙂 ... View more

Nothing abnormal is showing with any of those queries unfortunately. ... View more

When you add each indexer as a search peer in distsearch.conf (or the GUI), vs joining the SH/SHC to a index cluster, you are essentially eliminating the mapreduce functionality of distributed search and the index cluster. This is because the SH/SHC no longer knows its searching a cluster, nor does it know where the searchable buckets are. So its essentially distributed to all indexers, and awaiting response. So extra compute... Rebuild your SHC to connect to the cluster master node and let search run properly. That should alleviate load. After that, you need to check through search log and determine where your searches are slowing down. E.g., is it indexer side disk or memory, or SH. From there, adjust resources as required.. ... View more

The host name is the name of network host (or domain name) from which the events originated. You can set a Host name as a: • Constant Value • Regular expression on path • Segment in path ... View more

very good then. kindly mark your answer as answered. well done ... View more

Hmm... not seeing the forest. Are you suggesting in your code that "somefield" is the "fieldname" of choice? If so, I cannot do this, since I need the ability to search All fields in the lookup table for a keyword. My first query does not, but searches only on a known keyword, not a wildcard, and searches across ALL fields equally. ... View more

Another trick is that you can copy this to an otherwise invisible field beginning with an underscore (such as _key ) which means that the data will not be visible inside of your visualization but will be accessible by reference. ... View more

To add a report not listed in the dropdown click the link marked "Reports" in the message "This does not contain all reports. Add a report that is not listed from Reports." to open the reports tab. Search/Find the desired report there, click on it and use the "Add to Dashboard" option and select the existing dashboard you want to add it to. ... View more

Sorry I have been swamped. I am going to try this now and see if I can make things work. Thanks! ... View more

How about using time latest=-2m, bin at 1m, accum and delta -6? earliest=-10m latest=-2m | bin _time span=1m | stats count(eval(errorSystem="ERROR")) AS fail_cnt, count as total_cnt by _time | accum fail_cnt as fail_cum | accum total_cnt as total_cum | delta fail_cum as fail_delta p=6 | delta total_cum as total_delta p=6 | eventstats max(_time) as maxtime | eval fail_pct=100*fail_delta/total_delta | where (fail_pct >= 5) and (_time==maxtime) Probably also want a 5m+ throttle on it. ... View more

Can I get confirmation that: Step 5 of the Pagerduty in their integration guide is incorrect. Instead of entering the URL provided by the Pagerduty/Configuration/Services/Splunk Alerts/Splunk, use JUST the integration key from the same screen. Inside the Splunk alert, I add PagerDuty as the trigger action and include the KEY, not the URL. Confirmed? ... View more

Ha, this is exactly what I was thinking of doing as well, but the syntax was throwing me. This did in fact work, thank you! ... View more

I accept that various concurrent search settings can initially cause this problem, HOWEVER, the main issue for me is that even with each panel auto refreshing and the dashboard as a whole auto refreshing, the message does not go away. It is only when the browser is refreshed with an F5 that the search is retried. ... View more

How did you fix this in your script, this still does not seem to address your original problem, coloring the whole row based on a text value in a cell. ... View more

Try this <nav search_view="search" color="#65A637"> <view name="search" default='true' /> <view name="data_models" /> <collection label="Reports"> <view name="reports" /> <saved source="unclassified"> </collections> <view name="alerts" /> <view name="dashboards" /> </nav> ... View more

For a non-distributed environment: a. Single Instance Splunk Deployment i.e. SH + Indexer on the same server: PSC and MLTK should be both installed b. 1 Search Head + 1 Indexer: PSC should be installed on both Search Head and Indexer (only if using streaming apply feature), while MLTK needs to be installed only on Search Head For distributed search environment: a. 1 Search Head + N Indexers: PSC should be installed on both Search Head and Indexers (only if using streaming apply feature), while MLTK needs to be installed only on Search Head b. N Search Heads + N Indexers: PSC should be installed on all Search Heads and Indexers (only if using streaming apply feature), while MLTK needs to be installed only on all Search Heads For Search Head Clustering - N Search Heads (part of Search Head Cluster) + M Indexers: PSC + MLTK should be installed via a deployer to the Search Head Cluster, in addition, PSC should be installed on all Indexers (only if using streaming apply feature). To be clear, please note that customers are required to install PSC on Indexers ONLY if they want to use the streaming apply capability. By default, the streaming apply feature is turned off, so you’re not required to have PSC installed on all your indexers in the indexing cluster. For more details, read Use your indexers to apply models here -> https://docs.splunk.com/Documentation/MLApp/2.0.0/User/Installandconfigure ... View more

There is no reason that this would ever happen without some sort of outside influence. Some places that I would look: Were changes made to your storage? Verify that indexes.conf is configured properly... http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Indexesconf Search "index=* startdaysago=7" Good luck! ... View more

Cool, this worked(Option 1), but its very odd that I had to resort to this, as the first example I tried had worked in many other situations! ... View more

Since the subsearch is going to be run on a much more limited time frame I will be good. The issue I am currently having is that I can't re-write the UPDATED value back after doing the latest(UPDATED) to filter out the dupes. ... View more

You need to play around with server.conf : I am pretty sure that if you deploy this setting BEFORE you start splunk the first time, it will initialize the way that you are asking: serverName=web-$COMPUTERNAME In any case, you can DEFINITELY edit the setting post-install in $SPLUNK_HOME/etc/system/local/server.conf and set it there and everything that that host sends in will be updated for all events (even the internal index=_* ones). http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf ... View more

Do you have a working solution (this is clicked Accepted )? ... View more