Hello @mahesh27, You can write an eval condition to rename the NULL value as whatever string you wish. | eval service_code=if(service_code="NULL","Non-Servicecode",service_code)  Just append the above eval condition to your SPL query and it should work.  Thanks, Tejas. ... View more

Hey @A_VA, Can you try wrapping the color token in quotes as "$red|s$". I believe this should work.  Relevant document: https://docs.splunk.com/Documentation/Splunk/9.2.1/Viz/tokens#Syntax_to_consume_tokens   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @vikas_gopal, Yes, the steps you have mentioned seems to be the appropriate to continue managing the app from SHC Deployer in future.  Thanks, Tejas.  ... View more

Hello @jrowland1230 , I tried ingesting the sample data in my environment and the following SPL works. source="community_question.txt" host="my_host" sourcetype="jrowland_json" | spath path=log output=log | spath input=log path=content output=content | rex field=content "status\":\"(?<status_extract>\w+)\"" | table status_extract | eval Service=case(status_extract="CANCELLED","Cancelled",status_extract="BAY","BAY",true(),"NULL") Please refer to the following screenshot as well:   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @mahesh27, Ideally attribute.app.servicecode should populate the dropdown. However, for simplified usage, you can use either rename or spath command to give a simple field name for use in the dashboard. Your XML input should look something like below: <fieldset submitButton="false"> <input type="dropdown" token="service_code_token"> <label>Service Code</label> <fieldForLabel>service_code</fieldForLabel> <fieldForValue>service_code</fieldForValue> <search> <query>index=application-idx |rename "attribute.app.servicecode" as service_code |stats count by service_code | fields service_code</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> After setting the input, to use the selected service_code value in subsequent panels, you can mention  | search service_code="$service_code_token$" OR | search "attribute.app.servicecode"="$service_code_token$"   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @cking,  You can follow the following steps for migrating the buckets from one smartstore location to the other. - Enable maintenance mode on the cluster-manager - Stop splunk on the indexer peers using splunk stop command. - Ensure that all the hot buckets have been rolled to warm state - Move all the buckets from current location to the desired one - Change the associated parameters in indexes.conf - Push the bundle to all the indexers - Verify that the data is searchable and connected to the new storage. You can refer to the following documentation link for migration steps - https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/MigratetoSmartStore. Although, the document mentions migration from non smartstore to smartstore index, similar steps can be used for migration to different S3 location.  PS> This activity should be performed via Splunk PS due to complex nature of the task. Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

@Santosh2, Glad to hear that the solution seemed to be working. It would be great if you can accept the answer as a solution so that it helps other community users. ... View more

Hey @tejasode , To check why the app console is currently not opening, it should be better to check splunkd.log and web_service.log. Apart from that for alternative solution, as I mentioned #3757 (Splunk Add-on for Microsoft Azure) has inputs to collect data from Azure Security Center.  Additionally, if you're able to stream the CAS logs to eventhub, you can also go for configuring #3110 (Splunk Add-on for Microsoft Cloudservices) inputs. It is also a supported add-on and is CIM compliant as well.  Thanks, Tejas. ... View more

Hey @tejasode , Not sure why you mention the app to be archived. I see that the app is available for use and download as well. Additionally, the similar inputs can also be found in Microsoft Azure Add-on for Splunk (https://splunkbase.splunk.com/app/3757). There are a lot of add-ons available on Splunkbase to fetch data from Azure. Can you elaborate more on what particular functionality are you looking for? Thanks, Tejas. ... View more

Hello @splunky_diamond , I am unsure if there are any apps/TAs available for Fudo PAM data. The best would be to write magic 8 props for parsing the data. You can find the relevant documentation links below: - https://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkdoeswithyourdata - https://docs.splunk.com/Documentation/Splunk/latest/Data/Overviewofeventprocessing - https://docs.splunk.com/Documentation/Splunk/latest/Data/Createsourcetypes - https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Configuring_new_source_types   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @Santosh2 , You can create an additional input for country and use the country value as token for site input. Your xml code should look something like below: <input type="dropdown" token="country"> <label>Country</label> <choice value="*">All</choice> <prefix></prefix> <suffix></suffix> <default>*</default> <fieldForLabel>country</fieldForLabel> <fieldForValue>country</fieldForValue> <search> <query> | makeresults | eval country="India" | fields country | append [ | makeresults | eval country="China" | fields country] | sort country | table country </query> </search> </input> Now use the country token as below in Site input <input type="dropdown" token="site"> <label>SITE</label> <choice value="*">All</choice> <prefix>site="</prefix> <suffix>"</suffix> <default>*</default> <fieldForLabel>site</fieldForLabel> <fieldForValue>site</fieldForValue> <search> <query> | makeresults | eval site=case($country$="India","BDC",$country$="SOC",true(),"BDC") | fields site </query> </search> </input>   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @dc18 , There are plenty of apps on Splunkbase that can be used for visalizing AWS data. One of them is following: https://splunkbase.splunk.com/app/6311 Additionally, you can also check for AWS Content Pack that can also assist with similar purpose.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hey @nsiva , The query that @inventsekar has posted will work with any of the ip address provided the raw event is  123 IP Address is 1.2.3.4  Can you please elaborate why the solution doesn't work for you?  And for your reference, I've used 4.3.2.1 in _raw and it still extracts the ip address. Find the below screenshot.   To assist you better, it would be great if you can provide the raw events and then ip field can be extracted from the same. You can redact the sensitive information.   Thanks, Tejas. ... View more

Hello @kkarthik2 , Please consider migrating from Splunk app for AWS to the AWS Content Pack along with ITEW/ITSI. ITE Works is a free application that helps integrate and help visualize different AWS app dashboards. As per Splunkbase, the Splunk App for AWS is archived and has reached EOL. Following is the documentation link for migrating from Splunk App for AWS to Content Pack for AWS - https://docs.splunk.com/Documentation/CPAWSDash/1.4.0/CP/Migrate Also, the reason you see so much warnings is because the old app references to custom JS which is now unsupported by Splunk and hence such visualization will not come into effect on the dashboard.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @rameshkommu , I don't think there's a possibility to add a placeholder text for any of the input. The value that you define in the DefaultValue actually gets passed as the value in the panels wherever the input is being referenced. You may want to raise an idea on ideas.splunk.com to have the feature included as part of new release.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Additionally, you can also try rolling the bucket manually as mentioned in the reason. The SF isn't met because it needs the bucket to be rolled. Click on the Actions drop down and roll the bucket. This should also help you fix the SF/RF not met issue without any downtime.   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated. ... View more

Hello @karthi2809, I'm not sure if searchmatch function can work with case condition or not. I've read that it must be used inside if condition. Can you try running the following search: | rename bucketFolder as BucketFolder | eval InterfaceName=case(BucketFolder like "%inbound%epm%","EPM", BucketFolder like "%inbound%KPIs%","APEX_File_Upload", BucketFolder like "%inbound%concur%","ConcurFile_Upload",true(),"Unknown") | stats values(InterfaceName) as InterfaceName min(timestamp) as Timestamp values(BucketFolder) as BucketFolder values(Status) as Status by correlationId | table Status InterfaceName Timestamp FileName Bucket BucketFolder correlationId   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated. ... View more

Hello @SReopelle, Additionally, you can try checking the list of KOs in All Configurations page from the Settings menu. You'll be able to find all the knowledge objects there.   Thanks, Tejas. ... View more

Hey @Tetonka , If you would have appeared for the Architect examination from Pearson VUE, then on the pearson portal itself you should be able to validate your results. Also, once the certification is cleared, it stays valid till either 2 or 3 years. I do not exactly remember it. And you can renew them by reappearing for the examination. Alternatively, you can also reach out to certifications@splunk.com for any queries.   Thanks, Tejas.   ... View more

Hello @jwhughes58 , Using REPORT, you generally call the transforms stanza that has the transformations written for extractions, routing, etc. You can simply write the regex that matches against _raw and extract the field required. If you use REPORT and call the transforms to extract the field, the same thing will happen.  If you necessarily want to use EXTRACT, you need to extract the Match_Details.match.properties.user field at index time and replace the (.) with (_). Then you'll be able to use EXTRACT parameter in props.conf for search time field extractions. Additionally, you can also consider using rex command in the SPL query to extract the fields at search time.  Relevant documents: https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Rex Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @SewingMachine77, I do not think there is a possibility to create templates and use them in the alerts. However, you can definitely customize the message for the saved search. Additionally, you can also use the search job tokens and use them in the message. Refer to the following document for assistance with search job tokens: https://docs.splunk.com/Documentation/Splunk/9.2.1/Alert/EmailNotificationTokens   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated.  ... View more

Hey @SplunkExplorer , As you mentioned, it indeed is a permission issue. The lookup might be created within the search app context and the permission might not be shared to access the lookup within different app context. You can update the permission of the KO to be shared globally and it should resolve your concern.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @dhana22 , For using cluster manager redundancy, I would suggest you to use the load balancer to switch between the active and the standby cluster managers. As per the following document as well, if the manager switch over mode is set to auto, ideally load balancing using a 3rd party load balancer would be the best possible solution to configure the indexer peers and the search heads. Document link - https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/CMredundancy#Configure_peer_nodes.2C_search_heads.2C_and_forwarders   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @heres , As per the latest version release notes, Mission Control is part of the exception list. It means that the Upgrade Readiness App will not be scanning the Mission Control app. Please find the following screenshot for your reference. Document link for exceptions - https://docs.splunk.com/Documentation/Splunk/9.2.1/UpgradeReadiness/About#Exceptions The doc link doesn't yet mention of adding Mission Control to the exception list. However, you can find the same on Splunkbase release notes: https://splunkbase.splunk.com/app/5483 Navigate to Version History and launch the release notes for v4.3.0   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated. ... View more