Hey @ND1, Whatever @sainag_splunk mentioned  is all correct. Additionally, you'll also need to validate if the events that should cause the notable event to be created are present in the actual index events/datamodel summaries or not. Also, validate the trigger condition to see if the events are present, do they qualify for the correlation search to trigger the notable creation or not. Thanks, Tejas. ... View more

Hey @rishabhpatel20, Can you share the dashboard source code here to understand why the headers are not visible? Also, a clear screenshot from dashboard that shows the header is missing. The second screenshot displays fields like Hot Ports, and Trans/Hour. If those are not the headers, what are you expecting? Thanks, Tejas. ... View more

Hello @gabriele_chini, Can you provide the code you use for generating the token and do you save it in kvstore? How long does the token stay active and do you regenerate the token if it has already been expired? Thanks, Tejas.  ... View more

Hey @danielbb, While creating architecture diagrams, I used to go for config file icon only for any of the conf files  i.e. props, transforms, server, etc. Yes, for inputs there are multiple icons supported i.e. monitor input, API input, etc.  I haven't come across any specific stencils for props/transforms. Thanks, Tejas.  ... View more

Hello @NanSplk01, If it is only the actions field that you're interested in the subsearch, you don't need to perform all of the other operations. But since you're using splunk_server=* in the second search, here's something that might help you. | rest /servicesNS/-/-/saved/searches | search title=kafka* | rename dispatch.earliest_time AS "frequency", title AS "title", eai:acl.app AS "app", next_scheduled_time AS "nextRunTime", search AS "query", updated AS "lastUpdated", action.email.to AS "emailTo", action.email.cc AS "emailCC", action.email.subject AS "emailSubject", alert.severity AS "SEV" | eval severity=case(SEV == "5", "Critical-5", SEV == "4", "High-4",SEV == "3", "Warning-3",SEV == "2", "Low-2",SEV == "1", "Info-1") | eval identifierDate=now() | convert ctime(identifierDate) AS identifierDate | table identifierDate title lastUpdated, nextRunTime, emailTo, query, severity, emailTo | fillnull value="" | sort -lastUpdated | join type=left title [ | rest "/servicesNS/-/-/saved/searches" timeout=300 splunk_server=* | search disabled=0 AND title="kafka*" | fields title actions splunk_server | stats values(actions) as actions by title splunk_server]   Let me know if this helps your use case. Thanks, Tejas.   --- If the solution works, an upvote is appreciated..!! ... View more

Hello @eriktb, Did you try making DIRECT as a static and default value for the dependent dropdown. You can keep the makeresults section as it is to have different values populated based on the environment selection. However, if I understood the request properly, you need the DIRECT value selected by default for any of the environment. And, the case statement also ensures that for any of the environment value, DIRECT is one of the choice for the dependent dropdown.  Also, when I used your source code in my lab environment, it shows DIRECT as the selected value no matter what the environment dropdown selection is. Check the following screenshots for your reference: I'm on Splunk v9.3.2. Let me know if you meant something else and we can think about it.   Thanks, Tejas. ... View more

Hey @ilhwan, I believe as of now Splunk Support will only be able to provide you with the roadmap on when they plan to add support for Infoblox NIOS 9.0.3. Also, the last version was published in 2022 and since they haven't planned a release, I doubt it's going to be anytime soon. However, you can publish the request on ideas.splunk.com and have it voted on high number to get their traction and probably develop a new release supporting newer version of Infoblox.  Additionally, if the timeline is far away for the support and you have a use case, you can opt for developing a custom TA. If you enjoy scripting, you can definitely create new add-on using Splunk Add-on Builder and UCC framework.  Thanks, Tejas. --- If the solution helps your use case, an upvote is appreciated..!!  ... View more

Hello @_joe, If it is mentioned on the Splunkbase, then the TA would be compatible with the Splunk version. However, we will need more info on the ERROR log that you're receiving to understand why the input won't run.  Check if you can enable the DEBUG logging and what ERROR does the python script log and we can take it from there. Thanks, Tejas. ... View more

Hey @uagraw01, I understand that you might not have liked the solution. But it wasn't chatgpt based. If you would have read correctly, I mentioned that I used it as a solution and it worked perfectly in my scenario. Community is for helping every member and that's what I tried honestly. If you would have tried the solution, you could have observed how it would help you with the situation.   Anyways, I hope you get the solution that you need outside of ChatGPT. Happy Splunking >. Thanks, Tejas. ... View more

Hey @uagraw01 , mvexpand command works with only one field. And if you use it multiple times, it'll cause n number of duplicate values. Here's what I used in one scenario -  Combine all the multivalue fields using mvzip and a delimeter. In your case, it would be eqvivalent to -  | eval combined_multivalue_field = mvzip(mvzip(FunctionGroup, MsgNr, "|"),mvzip(alarm_severity,area,"|"),"|") This will give you one single column with all the field values separated by pipe (|) delimeter. You can then use mvexpand on combined_multivalue_field Then if you want to utilize each individual values, you can use string functions to separate out each values that you need and progress with the SPL query.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated. ... View more

Hello @sgarcia, This behavior in the logs is because of squash threshold limit being hit for license_usage.log for h,s, st fields. Additional approach to measure the volume of ingestion would be from metrics.log by using either per_host_thruput, per_source_thruput, per_sourcetype_thruput. With this thruput, you can look at the series field to know which component has the highest volume. Additionally, the squash_threshold can be configured in limits.conf, but it is NOT advisable to update the limits without consulting Splunk Support because it can cause heavy memory issues if increased from the default value. Thanks, Tejas.  ... View more

Hello @vishalduttauk, Can you provide the complete search that you used for migrating the data from one server to other? Thanks, Tejas.  ... View more

Hello @kumva01, Can you explain more about what is the source and how are you trying to ingest the data? What will be the data flow? Just the props configuration will not be able to help you with breaking the events and maintaining the JSON format for further field extractions.   Thanks, Tejas.  ... View more

Hello @splunkreal, Yes, you'll need to define the outputs.conf on Indexers1 to forward the logs to indexers2. If you wish to send all the logs of indexers1 to indexers2, you can definitely use the defaultGroup parameter in outputs.conf. However, if you wish to send only a few logs from indexers1 to indexers2, it would be better to use _TCP_ROUTING in inputs.conf for those particular inputs.   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hello @splunkreal, If you're using rex to extract the fields at search time, there's no way that Splunk will auto extract the fields that are part of your json_msg field.  However, you can write the regex and have the fields extracted at search time using the field extraction from Settings -> Fields -> Field Extraction and define it under the sourcetype. So that everytime you run index based search, the fields json_msg will be extracted automatically and then you can use | spath json_msg to extract the subsequent fields.  Alternatively, from the source if you are able to convert the whole string into JSON format, the nested json fields will be extracted automatically. Regards, Tejas. --- If the above solution helps, an upvote is appreciated..!! ... View more

Hello @rrovers, The layout in the dashboard studio can be set to either absolute or grid. However, there is currently no option to set dynamic height and width of the table based on number of rows. Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hello @pratrox, I believe this has been addressed in the latest version of Upgrade Readiness App. Just have the app installed on your environment and run the Python scan from the UI interface and it should display incompatible apps/add-ons. Splunkbase link - https://splunkbase.splunk.com/app/5483   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated!! ... View more

Hello @KhalidAlharthi , This could be indicative of underlying hardware problem as well. You can check for the same if the issue still persist after a rolling restart. Apart from connectivity issue what other errors do you observe?   Thanks, Tejas. ... View more

In addition to what @dural_yyz said, you can restrict team1 from accessing the dedicated search head by not creating the users for team1 on the new instance. And make sure to provide appropriate capabilities to team2 so that they're not able to modify or search the indexes belonging to team1   Thanks, Tejas ... View more

Hey @kirk_in_porto , These are the minimum required hardware specifications. It is not that Splunk won't work with less number of cores or RAM, but it'll affect the performance. You might not get efficient output from less cores if you intend to run more number of searches or processes through the license manager instance. It'll still try to function as much as it can. However, just for training purpose, it is okay to have less number of cores/RAM associated to an instance.   Thanks, Tejas. ... View more

Can you share more details on which port you're trying to access? ... View more

Hello @shai, You can find the SplunkCloud root CA from the Universal Forwarder package present on your SplunkCloud search head. It gives you a forwarder package with preconfigured outputs to forward the data to SplunkCloud indexers. Within the same app, you can find the certificates that you need to append your self signed ones with. The package name should go something like this - 100_<<stack_name>>_splunkcloud   Thanks, Tejas.  ... View more

Hello @MatthewWolf, If you need the number of event counts for a particular category, you can use the following search:   index=<<index_name>> sourcetype="fraud_detection.csv" | stats count by category | sort - count This will give you output of all the categories present with event count in decreasing order (i.e. highest count first).   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated.!! ... View more

Hello @Viral_G, You can have token value set based on the selected field/column on the table. You can then have another panel created to display the selected token and have a drilldown set on the new panel.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hello @ccampbell, The reason you are not able to upgrade the app to the latest version is that the app is not listed to be compatible with SplunkCloud platform on Splunkbase. If you wish to have the updated package available for upgrade on SplunkCloud platform, you'll need to have the developer of the app update the platform compatibility details. Please refer to the following screenshot displaying platform compatibility for the app.   I assume that the app inspect vetting would have failed for the app package and hence platform compatibility for SplunkCloud would be missing. As a solution to this, you can download the app package from Splunkbase, modify the app_id (app.conf and the folder name, and anywhere else within the package if used), repackage the app and upload it as a private app. This approach is not recommended since it doesn't allow you to track and stay updated with the future updates. Additionally, while uploading the private app, if the app inspect fails, you'll need to work on fixing the errors and repackage the app again and vet it continuously until it succeeds the vetting process. The best approach would be to have the developer engaged and make the app compatible to SplunkCloud platform.   Thanks, Tejas   --- If the above solution helps, an upvote is appreciated.!!   ... View more