accepted answer. ... View more

Oh - and if I "Open In Search" from the dashboard, the results load as expected. So it looks like it's related purely to loading in the dashboard. ... View more

@BobM - My understanding is that there was some performance benefit to field extractions over rex, especially in distributed deployments, as there is a bit more caching that happens with field extractions. Using a rex extracts fields on every search instead of using matches for fields.... is this the case at all? ... View more

Are you running in a distributed environment (e.g. collecting TA results on a HF or something that isn't the search head), or does the IAM identity being used have the right permissions? The "getchecks" command makes an AWS API call - support:describe_trusted_advisor_checks (in us-east-1) - and then populates a lookup. The lookup needs to be populated on the search layer (not the collection layer). If you are collecting data on a splunk instance that isn't the search head, and the search head isn't authorized to invoke the AWS action, then the lookup won't populate. To resolve this, you can look at authorizing the search layer to make this call. You can check if getchecks is actually working by running a search of | getchecks - if you get results, then auth is set up properly, but it might be as easy as ensuring the search to populate lookups is enabled and scheduled: 1 other thing to check is that the search that runs getcheck and populates the lookup is actually scheduled: on your search layer, go to settings --> searches, reports and alerts. Find the search called " Trusted Advisor Checks Lookup Populator " in the Trusted Advisor app. Click the Edit --> Schedule. In our deployment, the "Schedule Report" option was disabled, ensure that it is enabled. The default schedule is to run every week on Monday at 00:00 with a time range of the last minute. ... View more

very useful, thanks @damiensurat ... View more

thanks @richgalloway , am testing this now. ... View more

Something like this: earliest="-60d@d" latest=now .... | eval key=if(_time > relative_time(now(), "-30d@h"),"currentPeriod","previousPeriod") | eval _time=if(key="previousPeriod",_time+604800,_time) | eval key=Country." ".key | timechart .. Not using chart with day, but timechart with the _time field. ... View more

If you want to optimize your search (instead of using an append), you could do a search for -60d - now and then do evals based on whether time is more than 30 days or not (case or if). ... View more

assuming the app is installed on the HF to collect data and send it to the indexer cluster, and the app is also installed on all the indexers for setting up stuff like props / transforms / indexes (specifically at least the indexes.conf). Or is it better to install the AWS app on a HF and manually configure awsindex through something like etc/system/local/indexes? Would imagine "install aws app on all nodes" is a better approach? ... View more

Hey Akshatj2. What I am asking is: If I have an existing data set on a single instance, and want to move that instance from standalone to clustered index, would the current dataset be searchable across the cluster if I were to copy all the buckets to all nodes? With 3 indexers and a RF and SF of 3, it means each 1 of the nodes has a copy of the raw data AND index data, and so it can simplify backup solutions. I know it's not the best way to optimize space utilization, but it makes some of the management aspects a bit easier. ... View more

thanks. accepting your answer. ... View more

last post: this doc describes setting up the deployer in step 2 - https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCdeploymentoverview however, i am looking to use the CLI to configure it, not modifying config files directly. ... View more

I am using this to configure shc deployer: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCconfigurationoverview#Configuration_methods ... View more

A quick note: splunk help edit shcluster-config does not show shcluster_label in the options - it shows secret and then replication factor param, timeouts and port settings. Also - I can set labels and secrets fine for the indexer cluster master and cluster. I am trying to also configure the indexer master as the shc deployer, it's the shcluster-config command that is not updating the config. However, I am still able to bring up shc's in a shc cluster with no label specified and it connects / registers to the deployer fine. However, i'd like to specify a secret and a label ... View more

@jdhunter - thanks for bringing up the license question - I was not installing the license. I have updated it to do so, but am still not seeing the right config get added. $ splunk add licenses /path/to/enterprise.lic The licenses object has been added You need to restart the Splunk Server (splunkd) for your changes to take effect. $ service splunk restart $ splunk list licenses # enterprise license shows. $ splunk list licenser-pools auto_generated_pool_enterprise description:auto_generated_pool_enterprise effective_quota:REDACTED is_unlimited:0 quota:MAX slaves: stack_id:enterprise used_bytes:0 $ splunk edit shcluster-config -secret testingsecret -shcluster_label shclusterlabel_test The shcluster-config property has been edited. $ cat etc/system/local/server.conf [lmpool:auto_generated_pool_enterprise] description = auto_generated_pool_enterprise quota = MAX slaves = * stack_id = enterprise [license] active_group = Enterprise [shclustering] shcluster_label and the secret is not set still in the [shclustering] section. However, when I run the indexer cluster master commands "edit cluster-config" with cluster_label and secret, it is set as expected in the [clustering] section. ... View more

Hi @DavidHourani - yep, using that app. Am posting looking for feedback on whether that config looks right. ... View more