Hi. As an experiment I upgraded from 8.1.3 to 8.2.1 and we use a third party for certs and things DID work. I strongly recommend a Splunk support case be opened! Splunk support can help turn on extra debugging to track this issue down. ... View more

Hi. These are changes for Apache so would be done by the Apache team. You are configuring Apache to change the log formatting.  The Apache team makes the configuration changes, restart Apache and then the logs are in a different/better format. ... View more

https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#customlog So you have to change the configs on Apache. The above has an example # CustomLog with explicit format string CustomLog "logs/access_log" "%h %l %u %t \"%r\" %>s %b"  Instead you would have something like CustomLog "logs/access_log" "%{%Y-%m-%d %H:%M:%S %z}t %{%z}t" remotehost=%h status=%b" And then your access log would just have the date at the start of the event. The date would include the timezone (always include that) followed by remotehost=<hostname> status=<status value> ... View more

Hello. If i understand your requirement you want to run one search and send to different email addresses. There's a handy splunkbase app sendresults: https://splunkbase.splunk.com/app/1794/ You might be interested in using it. ... View more

Hi. What I did for Apache log was to use the CustomLog Specify the fields that you want the data to be extracted into remotehost=%h     status=%b .. And then when your logs get ingested the fields named remotehost, status etc will have the values already. You don't have to worry about positional or extractions etc. The keyword=value pairs will get extracted by Splunk.     ... View more

Hi .. under alert type do you have Scheduled or Real-time? Also, not sure if you have a search head cluster and a monitoring console/DMC. That might show you skipped searches etc. Finally there are records for the saved search in the audit log. This might help you see if the the scheduler believes that the jobs were completed. ... View more

Hi. Can you check the version of SSL Certificate checker and also what version of Splunk are you running? ... View more

So tstats fails | tstats count where index=_internal by host  but this works? index=_internal | stats count by host   ... View more

Hi. Is it only this summary index that you cannot search? Are you able to provide an example of the log and the search you are trying? ... View more

Hi @yuanliu are you able to open a support case for this issue? ... View more

@rensvanleeuwen Hello. Did you ever find a solution for this problem? ... View more

Hi. Are you saying you had a search head that could query 6 index clusters but you can't query the 7th? We are able to query 7 different index clusters so I don't think that is the limitation. What errors are you seeing and what exactly isn't working? Can you search the previous 6 index clusters?   ... View more

@shreya17  Great job! I tested these and they seem correct. A couple of settings I like to add MAX_TIMESTAMP_LOOKAHEAD .. make it be the total number of characters in the time including timezone etc SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)..     This one you put the regular expression that matches the beginning of an event. That way if there's some garbage lines they won't be treated as single events (if you want that) e.g. for 2 of your events it would be LINE_BREAKER=([\r\n]+\####< TRUNCATE=9999 or whatever you want. The maximum line length you will accept ... View more

Run the command Guissepe provided. Each title is an alert. Edit the alert and find the alert action which is an email alert. Edit the email action or remove the email action. ... View more

I don't know of any easy way to see which serverclass a host would match other than trying each whitelist/blacklist. You can look through your deployment servers _internal log for splunkd.log. The entries are given by host IP address (sadly) For example host with ip 1.2.3.4 matched service class blah and is getting 2 apps myapps_outputs and myapps_inputs   7-07-2021 11:59:03.491 +0000 INFO ClientSessionsManager - ip=1.2.3.4 name=blah New record for sc=myserviceclass app=myapp_outputs: action=Phonehome result=Ok checksum=0 07-07-2021 11:59:03.491 +0000 INFO ClientSessionsManager - ip=1.2.3.4 name=blah New record for sc=myserviceclass app=myapp_inputs: action=Phonehome result=Ok checksum=0    ... View more

Hi. Instead of us just providing you with the answer, do you want to take a crack at the timestamp settings? Here are documented examples on the date/time format settings: https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Examples I also came across this handy video that shows you how to interact with Splunk and test these settings.  https://www.youtube.com/watch?v=Q5EWCT79nZ4 Give the settings a try and let us know what works/doesn't work or that you have questions about. Thanks! ... View more

You want to know when your users are querying the indexers you want to de peer from? ... View more

Suggestion: use btool to find out exactly which deploymentclient.conf is getting overwritten.   # /opt/splunkforwarder/bin/splunk btool deploymentclient list --debug /opt/splunkforwarder/etc/apps/myapp/default/deploymentclient.conf [deployment-client] /opt/splunkforwarder/etc/system/local/deploymentclient.conf clientName = my_fwdr /opt/splunkforwarder/etc/apps/myapp/default/deploymentclient.conf phoneHomeIntervalInSecs = 500 /opt/splunkforwarder/etc/system/local/deploymentclient.conf [target-broker:deploymentServer] /opt/splunkforwarder/etc/system/local/deploymentclient.conf targetUri = mydeploymentserver.mycompany.com:1234 ... View more

hi @kanra I think possibly your question got cut off. ... View more

Hi.  Just by searching answers I found these two: You can list the indexers your heads are talking to with | rest /services/server/info | table splunk_server  You can list all the indexes with tstats (you would need a large window of time, possibly) | tstats count WHERE index=* by index | table index   ... View more

Hi. You use the URL to your indexer that has the inputs.conf with the HEC token.  ... View more

Hi @hellosplunkit Did you ever figure out what caused this error? I see it on one busy indexer. ... View more